diff options
author | Filipe Brandenburger <filbranden@google.com> | 2018-03-28 00:00:42 -0700 |
---|---|---|
committer | Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> | 2018-03-28 09:00:42 +0200 |
commit | 2ef044ea1ec359d7ffe9c8b3c7c75429186bd8a6 (patch) | |
tree | e35c613e3ae4a7accfe322473c97065ac3db2430 /src/core | |
parent | 1700f4f42c569adb7c15bb403f840263c9a5a88d (diff) | |
download | systemd-2ef044ea1ec359d7ffe9c8b3c7c75429186bd8a6.tar.gz |
core/socket: use chase_symlinks to find binary inside chroot when looking for SELinux label (#8591)
This is a follow up for this comment from @poettering:
https://github.com/systemd/systemd/pull/8405#discussion_r175719214
This updates PR #8405.
Tested manually using the same commands in
https://lists.freedesktop.org/archives/systemd-devel/2018-March/040478.html.
Diffstat (limited to 'src/core')
-rw-r--r-- | src/core/socket.c | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/src/core/socket.c b/src/core/socket.c index eecf6fbe18..6410939dca 100644 --- a/src/core/socket.c +++ b/src/core/socket.c @@ -1426,7 +1426,7 @@ fail: static int socket_determine_selinux_label(Socket *s, char **ret) { Service *service; ExecCommand *c; - const char *path; + _cleanup_free_ char *path = NULL; int r; assert(s); @@ -1453,7 +1453,10 @@ static int socket_determine_selinux_label(Socket *s, char **ret) { if (!c) goto no_label; - path = prefix_roota(service->exec_context.root_directory, c->path); + r = chase_symlinks(c->path, service->exec_context.root_directory, CHASE_PREFIX_ROOT, &path); + if (r < 0) + goto no_label; + r = mac_selinux_get_create_label_from_exe(path, ret); if (IN_SET(r, -EPERM, -EOPNOTSUPP)) goto no_label; |