48 lines
1.8 KiB
Diff
48 lines
1.8 KiB
Diff
From 60ef4baeedc34b5c7ab0e2f211684f9b96d63f82 Mon Sep 17 00:00:00 2001
|
|
From: Luca Boccassi <bluca@debian.org>
|
|
Date: Thu, 23 Nov 2023 19:08:22 +0000
|
|
Subject: [PATCH 1/3] core: pass bpf_outer_map_fd to sd-executor only if
|
|
RestrictFileSystems was set
|
|
|
|
It causes SELinux denials to be raised, so restrict it only where needed
|
|
|
|
Follow-up for beb4ae87558cae
|
|
---
|
|
src/core/execute-serialize.c | 6 +++---
|
|
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/src/core/execute-serialize.c b/src/core/execute-serialize.c
|
|
index 342883994a..60c121a0d1 100644
|
|
--- a/src/core/execute-serialize.c
|
|
+++ b/src/core/execute-serialize.c
|
|
@@ -1244,7 +1244,7 @@ static bool exec_parameters_is_idle_pipe_set(const ExecParameters *p) {
|
|
p->idle_pipe[3] >= 0;
|
|
}
|
|
|
|
-static int exec_parameters_serialize(const ExecParameters *p, FILE *f, FDSet *fds) {
|
|
+static int exec_parameters_serialize(const ExecParameters *p, const ExecContext *c, FILE *f, FDSet *fds) {
|
|
int r;
|
|
|
|
assert(f);
|
|
@@ -1375,7 +1375,7 @@ static int exec_parameters_serialize(const ExecParameters *p, FILE *f, FDSet *fd
|
|
return r;
|
|
}
|
|
|
|
- if (p->bpf_outer_map_fd >= 0) {
|
|
+ if (c && exec_context_restrict_filesystems_set(c) && p->bpf_outer_map_fd >= 0) {
|
|
r = serialize_fd(f, fds, "exec-parameters-bpf-outer-map-fd", p->bpf_outer_map_fd);
|
|
if (r < 0)
|
|
return r;
|
|
@@ -3860,7 +3860,7 @@ int exec_serialize_invocation(
|
|
if (r < 0)
|
|
return log_debug_errno(r, "Failed to serialize command: %m");
|
|
|
|
- r = exec_parameters_serialize(p, f, fds);
|
|
+ r = exec_parameters_serialize(p, ctx, f, fds);
|
|
if (r < 0)
|
|
return log_debug_errno(r, "Failed to serialize parameters: %m");
|
|
|
|
--
|
|
2.43.0
|
|
|