diff options
Diffstat (limited to 'src/basic/selinux-util.c')
-rw-r--r-- | src/basic/selinux-util.c | 79 |
1 files changed, 58 insertions, 21 deletions
diff --git a/src/basic/selinux-util.c b/src/basic/selinux-util.c index e15bd7e1fa..dc06f3d074 100644 --- a/src/basic/selinux-util.c +++ b/src/basic/selinux-util.c @@ -316,48 +316,85 @@ char* mac_selinux_free(char *label) { return NULL; } -int mac_selinux_create_file_prepare(const char *path, mode_t mode) { - #if HAVE_SELINUX +static int selinux_create_file_prepare_abspath(const char *abspath, mode_t mode) { _cleanup_freecon_ char *filecon = NULL; int r; - assert(path); - - if (!label_hnd) - return 0; - - if (path_is_absolute(path)) - r = selabel_lookup_raw(label_hnd, &filecon, path, mode); - else { - _cleanup_free_ char *newpath = NULL; - - r = path_make_absolute_cwd(path, &newpath); - if (r < 0) - return r; - - r = selabel_lookup_raw(label_hnd, &filecon, newpath, mode); - } + assert(abspath); + assert(path_is_absolute(abspath)); + r = selabel_lookup_raw(label_hnd, &filecon, abspath, mode); if (r < 0) { /* No context specified by the policy? Proceed without setting it. */ if (errno == ENOENT) return 0; - log_enforcing_errno(errno, "Failed to determine SELinux security context for %s: %m", path); + log_enforcing_errno(errno, "Failed to determine SELinux security context for %s: %m", abspath); } else { if (setfscreatecon_raw(filecon) >= 0) return 0; /* Success! */ - log_enforcing_errno(errno, "Failed to set SELinux security context %s for %s: %m", filecon, path); + log_enforcing_errno(errno, "Failed to set SELinux security context %s for %s: %m", filecon, abspath); } if (security_getenforce() > 0) return -errno; -#endif return 0; } +#endif + +int mac_selinux_create_file_prepare_at(int dirfd, const char *path, mode_t mode) { + int r = 0; + +#if HAVE_SELINUX + _cleanup_free_ char *abspath = NULL; + + assert(path); + + if (!label_hnd) + return 0; + + if (!path_is_absolute(path)) { + _cleanup_free_ char *p = NULL; + + if (dirfd == AT_FDCWD) + r = safe_getcwd(&p); + else + r = fd_get_path(dirfd, &p); + if (r < 0) + return r; + + path = abspath = path_join(p, path); + if (!path) + return -ENOMEM; + } + + r = selinux_create_file_prepare_abspath(path, mode); +#endif + return r; +} + +int mac_selinux_create_file_prepare(const char *path, mode_t mode) { + int r = 0; + +#if HAVE_SELINUX + _cleanup_free_ char *abspath = NULL; + + assert(path); + + if (!label_hnd) + return 0; + + r = path_make_absolute_cwd(path, &abspath); + if (r < 0) + return r; + + r = selinux_create_file_prepare_abspath(abspath, mode); +#endif + return r; +} void mac_selinux_create_file_clear(void) { |