|
 |
bd1529 |
From c67be1c7d69a0662ab85720aa0209110c39479f9 Mon Sep 17 00:00:00 2001
|
|
|
bd1529 |
From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgzones@googlemail.com>
|
|
|
bd1529 |
Date: Wed, 27 Nov 2019 19:43:47 +0100
|
|
|
bd1529 |
Subject: [PATCH] core: reload SELinux label cache on daemon-reload
|
|
|
bd1529 |
|
|
|
bd1529 |
Reloading the SELinux label cache here enables a light-wight follow-up of a SELinux policy change, e.g. adding a label for a RuntimeDirectory.
|
|
|
bd1529 |
|
|
|
bd1529 |
Closes: #13363
|
|
|
bd1529 |
(cherry picked from commit a9dfac21ec850eb5dcaf1ae9ef729389e4c12802)
|
|
|
bd1529 |
|
|
|
bd1529 |
Resolves: #1888912
|
|
|
bd1529 |
---
|
|
|
bd1529 |
src/basic/selinux-util.c | 20 ++++++++++++++++++++
|
|
|
bd1529 |
src/basic/selinux-util.h | 1 +
|
|
|
bd1529 |
src/core/main.c | 2 ++
|
|
|
bd1529 |
3 files changed, 23 insertions(+)
|
|
|
bd1529 |
|
|
|
bd1529 |
diff --git a/src/basic/selinux-util.c b/src/basic/selinux-util.c
|
|
|
bd1529 |
index e15bd7e1fa..f69d88eb1e 100644
|
|
|
bd1529 |
--- a/src/basic/selinux-util.c
|
|
|
bd1529 |
+++ b/src/basic/selinux-util.c
|
|
|
bd1529 |
@@ -105,6 +105,26 @@ void mac_selinux_finish(void) {
|
|
|
bd1529 |
#endif
|
|
|
bd1529 |
}
|
|
|
bd1529 |
|
|
|
bd1529 |
+void mac_selinux_reload(void) {
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+#if HAVE_SELINUX
|
|
|
bd1529 |
+ struct selabel_handle *backup_label_hnd;
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ if (!label_hnd)
|
|
|
bd1529 |
+ return;
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ backup_label_hnd = TAKE_PTR(label_hnd);
|
|
|
bd1529 |
+
|
|
|
bd1529 |
+ /* try to initialize new handle
|
|
|
bd1529 |
+ * on success close backup
|
|
|
bd1529 |
+ * on failure restore backup */
|
|
|
bd1529 |
+ if (mac_selinux_init() == 0)
|
|
|
bd1529 |
+ selabel_close(backup_label_hnd);
|
|
|
bd1529 |
+ else
|
|
|
bd1529 |
+ label_hnd = backup_label_hnd;
|
|
|
bd1529 |
+#endif
|
|
|
bd1529 |
+}
|
|
|
bd1529 |
+
|
|
|
bd1529 |
int mac_selinux_fix(const char *path, LabelFixFlags flags) {
|
|
|
bd1529 |
|
|
|
bd1529 |
#if HAVE_SELINUX
|
|
|
bd1529 |
diff --git a/src/basic/selinux-util.h b/src/basic/selinux-util.h
|
|
|
bd1529 |
index 08314057fb..abcfabe777 100644
|
|
|
bd1529 |
--- a/src/basic/selinux-util.h
|
|
|
bd1529 |
+++ b/src/basic/selinux-util.h
|
|
|
bd1529 |
@@ -13,6 +13,7 @@ void mac_selinux_retest(void);
|
|
|
bd1529 |
|
|
|
bd1529 |
int mac_selinux_init(void);
|
|
|
bd1529 |
void mac_selinux_finish(void);
|
|
|
bd1529 |
+void mac_selinux_reload(void);
|
|
|
bd1529 |
|
|
|
bd1529 |
int mac_selinux_fix(const char *path, LabelFixFlags flags);
|
|
|
bd1529 |
int mac_selinux_apply(const char *path, const char *label);
|
|
|
bd1529 |
diff --git a/src/core/main.c b/src/core/main.c
|
|
|
bd1529 |
index d897155644..d5c41da0c4 100644
|
|
|
bd1529 |
--- a/src/core/main.c
|
|
|
bd1529 |
+++ b/src/core/main.c
|
|
|
bd1529 |
@@ -1682,6 +1682,8 @@ static int invoke_main_loop(
|
|
|
bd1529 |
saved_log_level = m->log_level_overridden ? log_get_max_level() : -1;
|
|
|
bd1529 |
saved_log_target = m->log_target_overridden ? log_get_target() : _LOG_TARGET_INVALID;
|
|
|
bd1529 |
|
|
|
bd1529 |
+ mac_selinux_reload();
|
|
|
bd1529 |
+
|
|
|
bd1529 |
(void) parse_configuration(saved_rlimit_nofile, saved_rlimit_memlock);
|
|
|
bd1529 |
|
|
|
bd1529 |
set_manager_defaults(m);
|