From 1903fdfbf63f499b170c6fb6bd9ba4cf4aea866c Mon Sep 17 00:00:00 2001 From: Michal Schmidt Date: Thu, 6 Nov 2014 16:48:11 +0100 Subject: shared: create files even if the SELinux policy has no context for them The SELinux policy defines no context for some files. E.g.: $ matchpathcon /run/lock/subsys /dev/mqueue /run/lock/subsys <> /dev/mqueue <> We still need to be able to create them. In this case selabel_lookup_raw() returns ENOENT. We should then skip setfscreatecon(), but still return success. It was broken since c34255bdb2 ("label: unify code to make directories, symlinks"). --- src/shared/selinux-util.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c index 1eddd17d2..6bd3bf1c8 100644 --- a/src/shared/selinux-util.c +++ b/src/shared/selinux-util.c @@ -332,9 +332,13 @@ int mac_selinux_create_file_prepare(const char *path, mode_t mode) { r = selabel_lookup_raw(label_hnd, &filecon, newpath, mode); } - if (r < 0 && errno != ENOENT) + /* No context specified by the policy? Proceed without setting it. */ + if (r < 0 && errno == ENOENT) + return 0; + + if (r < 0) r = -errno; - else if (r == 0) { + else { r = setfscreatecon(filecon); if (r < 0) { log_enforcing("Failed to set SELinux security context %s for %s: %m", filecon, path); -- cgit v1.2.3-65-gdbad