diff options
| author | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2021-09-22 12:57:30 +0200 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2021-09-22 12:57:30 +0200 |
| commit | 465a6f154452cc19b995ba3a3c4eb4d29b8703bc (patch) | |
| tree | f994d3c63007c93f80e1f18fd967e6be76aad72a /src/shared | |
| parent | Add Logitech USB-PS/2 M-BT96A to hwdb (diff) | |
| parent | portable: copy SELinux label when extracting units from images (diff) | |
| download | systemd-465a6f154452cc19b995ba3a3c4eb4d29b8703bc.tar.xz systemd-465a6f154452cc19b995ba3a3c4eb4d29b8703bc.zip | |
Merge pull request #20767 from bluca/portable_extract_selinux
portable: copy SELinux label when extracting units from images
Diffstat (limited to 'src/shared')
| -rw-r--r-- | src/shared/selinux-util.c | 15 | ||||
| -rw-r--r-- | src/shared/selinux-util.h | 1 |
2 files changed, 16 insertions, 0 deletions
diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c index 34e78e6792..ca92a65efc 100644 --- a/src/shared/selinux-util.c +++ b/src/shared/selinux-util.c @@ -562,6 +562,21 @@ int mac_selinux_create_file_prepare(const char *path, mode_t mode) { #endif } +int mac_selinux_create_file_prepare_label(const char *path, const char *label) { +#if HAVE_SELINUX + + if (!label) + return 0; + + if (!mac_selinux_use()) + return 0; + + if (setfscreatecon_raw(label) < 0) + return log_enforcing_errno(errno, "Failed to set specified SELinux security context '%s' for '%s': %m", label, strna(path)); +#endif + return 0; +} + void mac_selinux_create_file_clear(void) { #if HAVE_SELINUX diff --git a/src/shared/selinux-util.h b/src/shared/selinux-util.h index 1095bdef0e..4147a3ad50 100644 --- a/src/shared/selinux-util.h +++ b/src/shared/selinux-util.h @@ -43,6 +43,7 @@ char* mac_selinux_free(char *label); int mac_selinux_create_file_prepare(const char *path, mode_t mode); int mac_selinux_create_file_prepare_at(int dirfd, const char *path, mode_t mode); +int mac_selinux_create_file_prepare_label(const char *path, const char *label); void mac_selinux_create_file_clear(void); int mac_selinux_create_socket_prepare(const char *label); |