daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
803fb7
From e1a9c6a30820620c482ed597ff6920a549c49bec Mon Sep 17 00:00:00 2001
803fb7
From: HATAYAMA Daisuke <d.hatayama@jp.fujitsu.com>
803fb7
Date: Wed, 26 Aug 2015 12:07:31 +0900
803fb7
Subject: [PATCH] selinux: fix regression of systemctl subcommands when
803fb7
 absolute unit file paths are specified
803fb7
803fb7
The commit 4938696301a914ec26bcfc60bb99a1e9624e3789 overlooked the
803fb7
fact that unit files can be specified as unit file paths, not unit
803fb7
file names, wrongly passing a unit file path to the 1st argument of
803fb7
manager_load_unit() that handles it as a unit file name. As a result,
803fb7
the following 4 systemctl subcommands:
803fb7
803fb7
    enable
803fb7
    disable
803fb7
    reenable
803fb7
    link
803fb7
    mask
803fb7
    unmask
803fb7
803fb7
fail with the following error message:
803fb7
803fb7
    # systemctl enable /usr/lib/systemd/system/kdump.service
803fb7
    Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
803fb7
    # systemctl disable /usr/lib/systemd/system/kdump.service
803fb7
    Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
803fb7
    # systemctl reenable /usr/lib/systemd/system/kdump.service
803fb7
    Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
803fb7
    # cp /usr/lib/systemd/system/kdump.service /tmp/
803fb7
    # systemctl link /tmp/kdump.service
803fb7
    Failed to execute operation: Unit name /tmp/kdump.service is not valid.
803fb7
    # systemctl mask /usr/lib/systemd/system/kdump.service
803fb7
    Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
803fb7
    # systemctl unmask /usr/lib/systemd/system/kdump.service
803fb7
    Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
803fb7
803fb7
To fix the issue, first check whether a unit file is passed as a unit
803fb7
file name or a unit file path, and then pass the unit file to the
803fb7
appropreate argument of manager_load_unit().
803fb7
803fb7
By the way, even with this commit mask and unmask reject unit file
803fb7
paths as follows and this is a correct behavior:
803fb7
803fb7
    # systemctl mask /usr/lib/systemd/system/kdump.service
803fb7
    Failed to execute operation: Invalid argument
803fb7
    # systemctl unmask /usr/lib/systemd/system/kdump.service
803fb7
    Failed to execute operation: Invalid argument
803fb7
803fb7
Cherry-picked from: 9fa7c1aeb9ec7e9d9f35184ce5c9d334f057d9de
803fb7
Related: #1185120
803fb7
---
803fb7
 src/core/selinux-access.c | 6 +++++-
803fb7
 1 file changed, 5 insertions(+), 1 deletion(-)
803fb7
803fb7
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
803fb7
index 297372d12..6cc0a49b9 100644
803fb7
--- a/src/core/selinux-access.c
803fb7
+++ b/src/core/selinux-access.c
803fb7
@@ -42,6 +42,7 @@
803fb7
 #include "selinux-util.h"
803fb7
 #include "audit-fd.h"
803fb7
 #include "strv.h"
803fb7
+#include "path-util.h"
803fb7
 
803fb7
 static bool initialized = false;
803fb7
 
803fb7
@@ -272,7 +273,10 @@ int mac_selinux_unit_access_check_strv(char **units,
803fb7
         int r;
803fb7
 
803fb7
         STRV_FOREACH(i, units) {
803fb7
-                r = manager_load_unit(m, *i, NULL, error, &u);
803fb7
+                if (is_path(*i))
803fb7
+                        r = manager_load_unit(m, NULL, *i, error, &u);
803fb7
+                else
803fb7
+                        r = manager_load_unit(m, *i, NULL, error, &u);
803fb7
                 if (r < 0)
803fb7
                         return r;
803fb7
                 r = mac_selinux_unit_access_check(u, message, permission, error);