|
 |
923a60 |
From bfd900a5a995e3bc342acd50ac816df6da37bf62 Mon Sep 17 00:00:00 2001
|
|
|
923a60 |
From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= <zbyszek@in.waw.pl>
|
|
|
923a60 |
Date: Sat, 21 Mar 2015 18:50:10 -0400
|
|
|
923a60 |
Subject: [PATCH] core: make SELinux enable/disable check symmetric
|
|
|
923a60 |
|
|
|
923a60 |
We'd use the generic check for disable, and a unit-file-specific one for enable.
|
|
|
923a60 |
Use the more specific one both ways.
|
|
|
923a60 |
|
|
|
923a60 |
systemd[1]: SELinux access check scon=system_u:system_r:systemd_timedated_t:s0 tcon=system_u:system_r:init_t:s0 tclass=system perm=disable path=(null) cmdline=/usr/lib/systemd/systemd-timedated: -13
|
|
|
923a60 |
systemd[1]: SELinux access check scon=system_u:system_r:systemd_timedated_t:s0 tcon=system_u:object_r:systemd_unit_file_t:s0 tclass=service perm=enable path=/usr/lib/systemd/system/systemd-timesyncd.service cmdline=/usr/lib/systemd/systemd-timedated: -13
|
|
|
923a60 |
|
|
|
923a60 |
https://bugzilla.redhat.com/show_bug.cgi?id=1014315
|
|
|
923a60 |
(cherry picked from commit df823e23f04da832ad5fc078176f8c26597a9845)
|
|
|
923a60 |
|
|
|
923a60 |
Conflicts:
|
|
|
923a60 |
src/core/dbus-manager.c
|
|
|
923a60 |
---
|
|
|
923a60 |
src/core/dbus-manager.c | 6 +++---
|
|
|
923a60 |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
923a60 |
|
|
|
923a60 |
diff --git a/src/core/dbus-manager.c b/src/core/dbus-manager.c
|
|
|
923a60 |
index 8ba665dc3d..2bc37ba60e 100644
|
|
|
923a60 |
--- a/src/core/dbus-manager.c
|
|
|
923a60 |
+++ b/src/core/dbus-manager.c
|
|
|
923a60 |
@@ -1772,15 +1772,15 @@ static int method_disable_unit_files_generic(
|
|
|
923a60 |
if (r == 0)
|
|
|
923a60 |
return 1; /* No authorization for now, but the async polkit stuff will call us again when it has it */
|
|
|
923a60 |
|
|
|
923a60 |
- r = mac_selinux_access_check(message, verb, error);
|
|
|
923a60 |
+ r = sd_bus_message_read_strv(message, &l);
|
|
|
923a60 |
if (r < 0)
|
|
|
923a60 |
return r;
|
|
|
923a60 |
|
|
|
923a60 |
- r = sd_bus_message_read_strv(message, &l);
|
|
|
923a60 |
+ r = sd_bus_message_read(message, "b", &runtime);
|
|
|
923a60 |
if (r < 0)
|
|
|
923a60 |
return r;
|
|
|
923a60 |
|
|
|
923a60 |
- r = sd_bus_message_read(message, "b", &runtime);
|
|
|
923a60 |
+ r = mac_selinux_unit_access_check_strv(l, message, m, verb, error);
|
|
|
923a60 |
if (r < 0)
|
|
|
923a60 |
return r;
|
|
|
923a60 |
|