proxmox-mirrors/mirror_lxc
1
0
Fork 0
mirror of https://git.proxmox.com/git/mirror_lxc synced 2025-07-30 01:05:52 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'marcosps-selinux_simplification' into lxc/master

Browse Source
This commit is contained in:
Christian Brauner 2018-02-08 10:50:10 +01:00
commit ca20a3b350
No known key found for this signature in database
GPG Key ID: 8EB056D53EECB12D
2 changed files with 27 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/lxc/lsm/apparmor.c
View File

@ -162,8 +162,8 @@ static bool aa_needs_transition(char *curlabel)
* apparmor_process_label_set: Set AppArmor process profile * apparmor_process_label_set: Set AppArmor process profile
* *
* @label : the profile to set * @label : the profile to set
* @conf : the container configuration to use @label is NULL * @conf : the container configuration to use if @label is NULL
* @default : use the default profile if label is NULL * @default : use the default profile if @label is NULL
* @on_exec : this is ignored. Apparmor profile will be changed immediately * @on_exec : this is ignored. Apparmor profile will be changed immediately
* *
* Returns 0 on success, < 0 on failure * Returns 0 on success, < 0 on failure
@ -230,7 +230,6 @@ static int apparmor_process_label_set(const char *inlabel, struct lxc_conf *conf
INFO("apparmor profile unchanged"); INFO("apparmor profile unchanged");
return 0; return 0;
} }
tid = lxc_raw_gettid(); tid = lxc_raw_gettid();
label_fd = lsm_process_label_fd_get(tid, on_exec); label_fd = lsm_process_label_fd_get(tid, on_exec);
if (label_fd < 0) { if (label_fd < 0) {

46
src/lxc/lsm/selinux.c
View File

@ -23,13 +23,15 @@
#include <errno.h> #include <errno.h>
#include <stdlib.h> #include <stdlib.h>
#include <sys/types.h> #include <stdbool.h>
#include <string.h>
#include <unistd.h> #include <unistd.h>
#include <selinux/selinux.h> #include <selinux/selinux.h>
#include <sys/types.h>
#include "conf.h"
#include "log.h" #include "log.h"
#include "lsm.h" #include "lsm.h"
#include "conf.h"
#define DEFAULT_LABEL "unconfined_t" #define DEFAULT_LABEL "unconfined_t"
@ -63,8 +65,8 @@ static char *selinux_process_label_get(pid_t pid)
* selinux_process_label_set: Set SELinux context of a process * selinux_process_label_set: Set SELinux context of a process
* *
* @label : label string * @label : label string
* @conf : the container configuration to use @label is NULL * @conf : the container configuration to use if @label is NULL
* @default : use the default context if label is NULL * @default : use the default context if @label is NULL
* @on_exec : the new context will take effect on exec(2) not immediately * @on_exec : the new context will take effect on exec(2) not immediately
* *
* Returns 0 on success, < 0 on failure * Returns 0 on success, < 0 on failure
@ -74,29 +76,31 @@ static char *selinux_process_label_get(pid_t pid)
static int selinux_process_label_set(const char *inlabel, struct lxc_conf *conf, static int selinux_process_label_set(const char *inlabel, struct lxc_conf *conf,
bool use_default, bool on_exec) bool use_default, bool on_exec)
{ {
const char *label = inlabel ? inlabel : conf->lsm_se_context; int ret;
const char *label;
label = inlabel ? inlabel : conf->lsm_se_context;
if (!label) { if (!label) {
if (use_default) if (!use_default)
label = DEFAULT_LABEL; return -EINVAL;
else
return -1; label = DEFAULT_LABEL;
} }
if (!strcmp(label, "unconfined_t"))
if (strcmp(label, "unconfined_t") == 0)
return 0; return 0;
if (on_exec) { if (on_exec)
if (setexeccon_raw((char *)label) < 0) { ret = setexeccon_raw((char *)label);
SYSERROR("failed to set new SELinux exec context %s", label); else
return -1; ret = setcon_raw((char *)label);
} if (ret < 0) {
} else { SYSERROR("Failed to set SELinux%s context to \"%s\"",
if (setcon_raw((char *)label) < 0) { on_exec ? " exec" : "", label);
SYSERROR("failed to set new SELinux context %s", label); return -1;
return -1;
}
} }
INFO("changed SELinux%s context to %s", on_exec ? " exec" : "", label); INFO("Changed SELinux%s context to \"%s\"", on_exec ? " exec" : "", label);
return 0; return 0;
} }