You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
78 lines
3.1 KiB
78 lines
3.1 KiB
7 years ago
|
From e1a9c6a30820620c482ed597ff6920a549c49bec Mon Sep 17 00:00:00 2001
|
||
|
From: HATAYAMA Daisuke <d.hatayama@jp.fujitsu.com>
|
||
|
Date: Wed, 26 Aug 2015 12:07:31 +0900
|
||
|
Subject: [PATCH] selinux: fix regression of systemctl subcommands when
|
||
|
absolute unit file paths are specified
|
||
|
|
||
|
The commit 4938696301a914ec26bcfc60bb99a1e9624e3789 overlooked the
|
||
|
fact that unit files can be specified as unit file paths, not unit
|
||
|
file names, wrongly passing a unit file path to the 1st argument of
|
||
|
manager_load_unit() that handles it as a unit file name. As a result,
|
||
|
the following 4 systemctl subcommands:
|
||
|
|
||
|
enable
|
||
|
disable
|
||
|
reenable
|
||
|
link
|
||
|
mask
|
||
|
unmask
|
||
|
|
||
|
fail with the following error message:
|
||
|
|
||
|
# systemctl enable /usr/lib/systemd/system/kdump.service
|
||
|
Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
|
||
|
# systemctl disable /usr/lib/systemd/system/kdump.service
|
||
|
Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
|
||
|
# systemctl reenable /usr/lib/systemd/system/kdump.service
|
||
|
Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
|
||
|
# cp /usr/lib/systemd/system/kdump.service /tmp/
|
||
|
# systemctl link /tmp/kdump.service
|
||
|
Failed to execute operation: Unit name /tmp/kdump.service is not valid.
|
||
|
# systemctl mask /usr/lib/systemd/system/kdump.service
|
||
|
Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
|
||
|
# systemctl unmask /usr/lib/systemd/system/kdump.service
|
||
|
Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
|
||
|
|
||
|
To fix the issue, first check whether a unit file is passed as a unit
|
||
|
file name or a unit file path, and then pass the unit file to the
|
||
|
appropreate argument of manager_load_unit().
|
||
|
|
||
|
By the way, even with this commit mask and unmask reject unit file
|
||
|
paths as follows and this is a correct behavior:
|
||
|
|
||
|
# systemctl mask /usr/lib/systemd/system/kdump.service
|
||
|
Failed to execute operation: Invalid argument
|
||
|
# systemctl unmask /usr/lib/systemd/system/kdump.service
|
||
|
Failed to execute operation: Invalid argument
|
||
|
|
||
|
Cherry-picked from: 9fa7c1aeb9ec7e9d9f35184ce5c9d334f057d9de
|
||
|
Related: #1185120
|
||
|
---
|
||
|
src/core/selinux-access.c | 6 +++++-
|
||
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
||
|
|
||
|
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
|
||
|
index 297372d12..6cc0a49b9 100644
|
||
|
--- a/src/core/selinux-access.c
|
||
|
+++ b/src/core/selinux-access.c
|
||
|
@@ -42,6 +42,7 @@
|
||
|
#include "selinux-util.h"
|
||
|
#include "audit-fd.h"
|
||
|
#include "strv.h"
|
||
|
+#include "path-util.h"
|
||
|
|
||
|
static bool initialized = false;
|
||
|
|
||
|
@@ -272,7 +273,10 @@ int mac_selinux_unit_access_check_strv(char **units,
|
||
|
int r;
|
||
|
|
||
|
STRV_FOREACH(i, units) {
|
||
|
- r = manager_load_unit(m, *i, NULL, error, &u);
|
||
|
+ if (is_path(*i))
|
||
|
+ r = manager_load_unit(m, NULL, *i, error, &u);
|
||
|
+ else
|
||
|
+ r = manager_load_unit(m, *i, NULL, error, &u);
|
||
|
if (r < 0)
|
||
|
return r;
|
||
|
r = mac_selinux_unit_access_check(u, message, permission, error);
|