Attachment 590965 Details for Bug 826023 – This patch will turn the log_debugs to log_errors even in permissive mode.

[patch] This patch will turn the log_debugs to log_errors even in permissive mode.

systemd_permissivemode.patch (text/plain), 3.80 KB, created by Daniel Walsh on 2012-06-11 14:59:33 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Daniel Walsh

Created: 2012-06-11 14:59:33 UTC

Size: 3.80 KB

patch

obsolete

>diff --git a/src/shared/label.c b/src/shared/label.c
>index d912574..030faef 100644
>--- a/src/shared/label.c
>+++ b/src/shared/label.c
>@@ -78,9 +78,10 @@ int label_init(const char *prefixes[]) {
>                 label_hnd = selabel_open(SELABEL_CTX_FILE, NULL, 0);
> 
>         if (!label_hnd) {
>-                log_full(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG,
>-                         "Failed to initialize SELinux context: %m");
>+                log_full(LOG_ERR, "Failed to initialize SELinux context: %m");
>                 r = security_getenforce() == 1 ? -errno : 0;
>+                if (r == 0) 
>+                        log_full(LOG_ERR, "Continuing SELinux in permissive mode");
>         } else  {
>                 char timespan[FORMAT_TIMESPAN_MAX];
>                 int l;
>@@ -132,9 +133,10 @@ int label_fix(const char *path, bool ignore_enoent) {
>                 if (ignore_enoent && errno == ENOENT)
>                         return 0;
> 
>-                log_full(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG,
>-                         "Unable to fix label of %s: %m", path);
>+                log_full(LOG_ERR, "Unable to fix label of %s: %m", path);
>                 r = security_getenforce() == 1 ? -errno : 0;
>+                if (r == 0) 
>+                        log_full(LOG_ERR, "Continuing SELinux in permissive mode");
>         }
> #endif
> 
>@@ -174,6 +176,11 @@ int label_get_create_label_from_exe(const char *exe, char **label) {
>         r = security_compute_create(mycon, fcon, sclass, (security_context_t *) label);
>         if (r == 0)
>                 log_debug("SELinux Socket context for %s will be set to %s", exe, *label);
>+        else {
>+                log_error("Failed to get SELinux Socket context for %s", exe);
>+                if (security_getenforce() == 0) 
>+                        log_full(LOG_ERR, "Continuing SELinux in permissive mode");
>+        }
> 
> fail:
>         if (r < 0 && security_getenforce() == 1)
>@@ -202,14 +209,15 @@ int label_context_set(const char *path, mode_t mode) {
>                 r = setfscreatecon(filecon);
>                 if (r < 0) {
>                         log_error("Failed to set SELinux file context on %s: %m", path);
>-                        r = -errno;
>+                        if (security_getenforce() != 0)
>+                                r = -errno;
>+                        else
>+                                log_full(LOG_ERR, "Continuing SELinux in permissive mode");
>+
>                 }
> 
>                 freecon(filecon);
>         }
>-
>-        if (r < 0 && security_getenforce() == 0)
>-                r = 0;
> #endif
> 
>         return r;
>@@ -222,11 +230,12 @@ int label_socket_set(const char *label) {
>                 return 0;
> 
>         if (setsockcreatecon((security_context_t) label) < 0) {
>-                log_full(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG,
>-                         "Failed to set SELinux context (%s) on socket: %m", label);
>+                log_full(LOG_ERR, "Failed to set SELinux context (%s) on socket: %m", label);
> 
>                 if (security_getenforce() == 1)
>                         return -errno;
>+                else
>+                        log_full(LOG_ERR, "Continuing SELinux in permissive mode");
>         }
> #endif
> 
>@@ -296,6 +305,7 @@ int label_mkdir(const char *path, mode_t mode, bool apply) {
>                         r = -errno;
>                         goto finish;
>                 }
>+                log_full(LOG_ERR, "Continuing SELinux in permissive mode");
>         }
> 
>         r = mkdir(path, mode);
>@@ -373,6 +383,7 @@ int label_bind(int fd, const struct sockaddr *addr, socklen_t addrlen) {
>                         r = -errno;
>                         goto finish;
>                 }
>+                log_full(LOG_ERR, "Continuing SELinux in permissive mode");
>         }
> 
>         r = bind(fd, addr, addrlen);

Actions: View | Diff

Attachments on bug 826023: 590965