diff options
| author |   Donald Chan <hoiho@amazon.com> | 2022-01-28 22:53:46 +0000 |
|---|---|---|
| committer |   Yu Watanabe <watanabe.yu+github@gmail.com> | 2022-01-31 04:43:56 +0900 |
| commit | a718364e9d9242cc2111c9860f2ab5bb9bb26db9 (patch) | |
| tree | 2b39677da87c6f54b8f03ba3766fde81518576bd | |
| parent | shared: Handle filesystems that don't support hole punching in COPY_HOLES (diff) | |
| download | systemd-a718364e9d9242cc2111c9860f2ab5bb9bb26db9.tar.xz systemd-a718364e9d9242cc2111c9860f2ab5bb9bb26db9.zip | |
basic: mac_[selinux,smack]_apply_fd does not work when applying labels
Commit a7fdc6c introduced a regression where file descriptors are opened
using O_PATH option. mac_smack_apply_fd() calls fsetxattr() and would fail
with a -EBADF (Bad file descriptor) error.
Use FORMAT_PROC_FD_PATH(fd) to convert the fd back into a full path and
call setxattr() or setfilecon() instead.
Signed-off-by: Donald Chan <hoiho@amazon.com>
| -rw-r--r-- | src/shared/selinux-util.c | 2 | ||||
| -rw-r--r-- | src/shared/smack-util.c | 4 |
2 files changed, 3 insertions, 3 deletions
diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c index a1359a5bfd3..67ea8581422 100644 --- a/src/shared/selinux-util.c +++ b/src/shared/selinux-util.c @@ -346,7 +346,7 @@ int mac_selinux_apply_fd(int fd, const char *path, const char *label) { assert(label); - if (fsetfilecon(fd, label) < 0) + if (setfilecon(FORMAT_PROC_FD_PATH(fd), label) < 0) return log_enforcing_errno(errno, "Failed to set SELinux security context %s on path %s: %m", label, strna(path)); #endif return 0; diff --git a/src/shared/smack-util.c b/src/shared/smack-util.c index b8434b068ca..0df1778cb2d 100644 --- a/src/shared/smack-util.c +++ b/src/shared/smack-util.c @@ -95,9 +95,9 @@ int mac_smack_apply_fd(int fd, SmackAttr attr, const char *label) { return 0; if (label) - r = fsetxattr(fd, smack_attr_to_string(attr), label, strlen(label), 0); + r = setxattr(FORMAT_PROC_FD_PATH(fd), smack_attr_to_string(attr), label, strlen(label), 0); else - r = fremovexattr(fd, smack_attr_to_string(attr)); + r = removexattr(FORMAT_PROC_FD_PATH(fd), smack_attr_to_string(attr)); if (r < 0) return -errno; |