From ce0458be09911e75bfd3b4d802c9594c55a9c98d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 21 Sep 2021 18:29:23 +0200 Subject: [PATCH 1/2] smack: move helper function to smack-util.c The function was in basic/fileio.c, but it's more appropriate to keep it out of src/basic. Fixes compilation with -Dsmack-run-label= set. --- src/basic/fileio.c | 13 ------------- src/basic/fileio.h | 2 -- src/firstboot/firstboot.c | 1 + src/shared/smack-util.c | 13 +++++++++++++ src/shared/smack-util.h | 2 ++ 5 files changed, 16 insertions(+), 15 deletions(-) diff --git a/src/basic/fileio.c b/src/basic/fileio.c index 60a9885108..6a4a65723f 100644 --- a/src/basic/fileio.c +++ b/src/basic/fileio.c @@ -1434,16 +1434,3 @@ int warn_file_is_world_accessible(const char *filename, struct stat *st, const c filename, st->st_mode & 07777); return 0; } - -int rename_and_apply_smack_floor_label(const char *from, const char *to) { - int r = 0; - if (rename(from, to) < 0) - return -errno; - -#if HAVE_SMACK_RUN_LABEL - r = mac_smack_apply(to, SMACK_ATTR_ACCESS, SMACK_FLOOR_LABEL); - if (r < 0) - return r; -#endif - return r; -} diff --git a/src/basic/fileio.h b/src/basic/fileio.h index 4295b84a85..9defa4e6bc 100644 --- a/src/basic/fileio.h +++ b/src/basic/fileio.h @@ -124,5 +124,3 @@ static inline int read_nul_string(FILE *f, size_t limit, char **ret) { int safe_fgetc(FILE *f, char *ret); int warn_file_is_world_accessible(const char *filename, struct stat *st, const char *unit, unsigned line); - -int rename_and_apply_smack_floor_label(const char *temp_path, const char *dest_path); diff --git a/src/firstboot/firstboot.c b/src/firstboot/firstboot.c index 93ce800bd7..6fdba66f57 100644 --- a/src/firstboot/firstboot.c +++ b/src/firstboot/firstboot.c @@ -32,6 +32,7 @@ #include "proc-cmdline.h" #include "pwquality-util.h" #include "random-util.h" +#include "smack-util.h" #include "string-util.h" #include "strv.h" #include "terminal-util.h" diff --git a/src/shared/smack-util.c b/src/shared/smack-util.c index 2ae11e7f9a..01958f0b0d 100644 --- a/src/shared/smack-util.c +++ b/src/shared/smack-util.c @@ -284,3 +284,16 @@ int mac_smack_copy(const char *dest, const char *src) { return 0; } #endif + +int rename_and_apply_smack_floor_label(const char *from, const char *to) { + int r = 0; + if (rename(from, to) < 0) + return -errno; + +#if HAVE_SMACK_RUN_LABEL + r = mac_smack_apply(to, SMACK_ATTR_ACCESS, SMACK_FLOOR_LABEL); + if (r < 0) + return r; +#endif + return r; +} diff --git a/src/shared/smack-util.h b/src/shared/smack-util.h index 36fdc72083..df91c89e01 100644 --- a/src/shared/smack-util.h +++ b/src/shared/smack-util.h @@ -44,3 +44,5 @@ int mac_smack_apply(const char *path, SmackAttr attr, const char *label); int mac_smack_apply_fd(int fd, SmackAttr attr, const char *label); int mac_smack_apply_pid(pid_t pid, const char *label); int mac_smack_copy(const char *dest, const char *src); + +int rename_and_apply_smack_floor_label(const char *temp_path, const char *dest_path); From 07b382cc2bd274439770b1a47878ab125aa85499 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Zbigniew=20J=C4=99drzejewski-Szmek?= Date: Tue, 21 Sep 2021 19:53:20 +0200 Subject: [PATCH 2/2] meson: ignore -Dsmack-run-label= if -Dsmack=false Compilation would fail because we could have HAVE_SMACK_RUN_LABEL without HAVE_SMACK. This doesn't make much sense, so let's just make -Dsmack=false completely disable smack. Also, the logic in smack-setup.c seems dubious: '#ifdef SMACK_RUN_LABEL' would evaluate to true even if -Dsmack-run-label='' is used. I think this was introduced in the conversion to meson: 8b197c3a8a57c3f7c231b39e5660856fd9580c80 added AC_ARG_WITH(smack-run-label, AS_HELP_STRING([--with-smack-run-label=STRING], [run systemd --system with a specific SMACK label]), [AC_DEFINE_UNQUOTED(SMACK_RUN_LABEL, ["$withval"], [Run with a smack label])], []) i.e. it really was undefined if not specified. And it was same still in 72cdb3e783174dcf9223a49f03e3b0e2ca95ddb8 when configure.ac was dropped. So let's use the single conditional HAVE_SMACK_RUN_LABEL everywhere. --- meson.build | 7 +++++-- src/core/smack-setup.c | 2 +- src/shared/mount-setup.c | 2 +- 3 files changed, 7 insertions(+), 4 deletions(-) diff --git a/meson.build b/meson.build index 8261b13155..fe6b26b835 100644 --- a/meson.build +++ b/meson.build @@ -1024,8 +1024,11 @@ else endif conf.set10('HAVE_APPARMOR', have) -conf.set10('HAVE_SMACK_RUN_LABEL', get_option('smack-run-label') != '') -conf.set_quoted('SMACK_RUN_LABEL', get_option('smack-run-label')) +have = get_option('smack') and get_option('smack-run-label') != '' +conf.set10('HAVE_SMACK_RUN_LABEL', have) +if have + conf.set_quoted('SMACK_RUN_LABEL', get_option('smack-run-label')) +endif want_polkit = get_option('polkit') install_polkit = false diff --git a/src/core/smack-setup.c b/src/core/smack-setup.c index 79c4808473..5b2671ff40 100644 --- a/src/core/smack-setup.c +++ b/src/core/smack-setup.c @@ -322,7 +322,7 @@ int mac_smack_setup(bool *loaded_policy) { return 0; } -#ifdef SMACK_RUN_LABEL +#if HAVE_SMACK_RUN_LABEL r = write_string_file("/proc/self/attr/current", SMACK_RUN_LABEL, WRITE_STRING_FILE_DISABLE_BUFFER); if (r < 0) log_warning_errno(r, "Failed to set SMACK label \"" SMACK_RUN_LABEL "\" on self: %m"); diff --git a/src/shared/mount-setup.c b/src/shared/mount-setup.c index 0f2fb5d098..ae148541d7 100644 --- a/src/shared/mount-setup.c +++ b/src/shared/mount-setup.c @@ -278,7 +278,7 @@ static int symlink_controller(const char *target, const char *alias) { if (r < 0) return log_error_errno(r, "Failed to create symlink %s: %m", a); -#ifdef SMACK_RUN_LABEL +#if HAVE_SMACK_RUN_LABEL const char *p; p = strjoina("/sys/fs/cgroup/", target);