78 lines
3.0 KiB
Diff
78 lines
3.0 KiB
Diff
From d167b3653665d5d617f02e877e1f9e38e5a05a6c Mon Sep 17 00:00:00 2001
|
|
From: HATAYAMA Daisuke <d.hatayama@jp.fujitsu.com>
|
|
Date: Wed, 26 Aug 2015 12:07:31 +0900
|
|
Subject: [PATCH 37/47] selinux: fix regression of systemctl subcommands when
|
|
absolute unit file paths are specified
|
|
|
|
The commit 4938696301a914ec26bcfc60bb99a1e9624e3789 overlooked the
|
|
fact that unit files can be specified as unit file paths, not unit
|
|
file names, wrongly passing a unit file path to the 1st argument of
|
|
manager_load_unit() that handles it as a unit file name. As a result,
|
|
the following 4 systemctl subcommands:
|
|
|
|
enable
|
|
disable
|
|
reenable
|
|
link
|
|
mask
|
|
unmask
|
|
|
|
fail with the following error message:
|
|
|
|
# systemctl enable /usr/lib/systemd/system/kdump.service
|
|
Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
|
|
# systemctl disable /usr/lib/systemd/system/kdump.service
|
|
Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
|
|
# systemctl reenable /usr/lib/systemd/system/kdump.service
|
|
Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
|
|
# cp /usr/lib/systemd/system/kdump.service /tmp/
|
|
# systemctl link /tmp/kdump.service
|
|
Failed to execute operation: Unit name /tmp/kdump.service is not valid.
|
|
# systemctl mask /usr/lib/systemd/system/kdump.service
|
|
Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
|
|
# systemctl unmask /usr/lib/systemd/system/kdump.service
|
|
Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
|
|
|
|
To fix the issue, first check whether a unit file is passed as a unit
|
|
file name or a unit file path, and then pass the unit file to the
|
|
appropreate argument of manager_load_unit().
|
|
|
|
By the way, even with this commit mask and unmask reject unit file
|
|
paths as follows and this is a correct behavior:
|
|
|
|
# systemctl mask /usr/lib/systemd/system/kdump.service
|
|
Failed to execute operation: Invalid argument
|
|
# systemctl unmask /usr/lib/systemd/system/kdump.service
|
|
Failed to execute operation: Invalid argument
|
|
---
|
|
src/core/selinux-access.c | 6 +++++-
|
|
1 file changed, 5 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
|
|
index 50a90b0..2ecfa40 100644
|
|
--- a/src/core/selinux-access.c
|
|
+++ b/src/core/selinux-access.c
|
|
@@ -38,6 +38,7 @@
|
|
#include "selinux-util.h"
|
|
#include "audit-fd.h"
|
|
#include "strv.h"
|
|
+#include "path-util.h"
|
|
|
|
static bool initialized = false;
|
|
|
|
@@ -302,7 +303,10 @@ int mac_selinux_unit_access_check_strv(
|
|
int r;
|
|
|
|
STRV_FOREACH(i, units) {
|
|
- r = manager_load_unit(m, *i, NULL, error, &u);
|
|
+ if (is_path(*i))
|
|
+ r = manager_load_unit(m, NULL, *i, error, &u);
|
|
+ else
|
|
+ r = manager_load_unit(m, *i, NULL, error, &u);
|
|
if (r < 0)
|
|
return r;
|
|
r = mac_selinux_unit_access_check(u, message, permission, error);
|
|
--
|
|
2.5.0
|
|
|