daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
1ff636
From e1a9c6a30820620c482ed597ff6920a549c49bec Mon Sep 17 00:00:00 2001
1ff636
From: HATAYAMA Daisuke <d.hatayama@jp.fujitsu.com>
1ff636
Date: Wed, 26 Aug 2015 12:07:31 +0900
1ff636
Subject: [PATCH] selinux: fix regression of systemctl subcommands when
1ff636
 absolute unit file paths are specified
1ff636
1ff636
The commit 4938696301a914ec26bcfc60bb99a1e9624e3789 overlooked the
1ff636
fact that unit files can be specified as unit file paths, not unit
1ff636
file names, wrongly passing a unit file path to the 1st argument of
1ff636
manager_load_unit() that handles it as a unit file name. As a result,
1ff636
the following 4 systemctl subcommands:
1ff636
1ff636
    enable
1ff636
    disable
1ff636
    reenable
1ff636
    link
1ff636
    mask
1ff636
    unmask
1ff636
1ff636
fail with the following error message:
1ff636
1ff636
    # systemctl enable /usr/lib/systemd/system/kdump.service
1ff636
    Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
1ff636
    # systemctl disable /usr/lib/systemd/system/kdump.service
1ff636
    Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
1ff636
    # systemctl reenable /usr/lib/systemd/system/kdump.service
1ff636
    Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
1ff636
    # cp /usr/lib/systemd/system/kdump.service /tmp/
1ff636
    # systemctl link /tmp/kdump.service
1ff636
    Failed to execute operation: Unit name /tmp/kdump.service is not valid.
1ff636
    # systemctl mask /usr/lib/systemd/system/kdump.service
1ff636
    Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
1ff636
    # systemctl unmask /usr/lib/systemd/system/kdump.service
1ff636
    Failed to execute operation: Unit name /usr/lib/systemd/system/kdump.service is not valid.
1ff636
1ff636
To fix the issue, first check whether a unit file is passed as a unit
1ff636
file name or a unit file path, and then pass the unit file to the
1ff636
appropreate argument of manager_load_unit().
1ff636
1ff636
By the way, even with this commit mask and unmask reject unit file
1ff636
paths as follows and this is a correct behavior:
1ff636
1ff636
    # systemctl mask /usr/lib/systemd/system/kdump.service
1ff636
    Failed to execute operation: Invalid argument
1ff636
    # systemctl unmask /usr/lib/systemd/system/kdump.service
1ff636
    Failed to execute operation: Invalid argument
1ff636
1ff636
Cherry-picked from: 9fa7c1aeb9ec7e9d9f35184ce5c9d334f057d9de
1ff636
Related: #1185120
1ff636
---
1ff636
 src/core/selinux-access.c | 6 +++++-
1ff636
 1 file changed, 5 insertions(+), 1 deletion(-)
1ff636
1ff636
diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
c62b8e
index 297372d126..6cc0a49b92 100644
1ff636
--- a/src/core/selinux-access.c
1ff636
+++ b/src/core/selinux-access.c
1ff636
@@ -42,6 +42,7 @@
1ff636
 #include "selinux-util.h"
1ff636
 #include "audit-fd.h"
1ff636
 #include "strv.h"
1ff636
+#include "path-util.h"
1ff636
 
1ff636
 static bool initialized = false;
1ff636
 
1ff636
@@ -272,7 +273,10 @@ int mac_selinux_unit_access_check_strv(char **units,
1ff636
         int r;
1ff636
 
1ff636
         STRV_FOREACH(i, units) {
1ff636
-                r = manager_load_unit(m, *i, NULL, error, &u);
1ff636
+                if (is_path(*i))
1ff636
+                        r = manager_load_unit(m, NULL, *i, error, &u);
1ff636
+                else
1ff636
+                        r = manager_load_unit(m, *i, NULL, error, &u);
1ff636
                 if (r < 0)
1ff636
                         return r;
1ff636
                 r = mac_selinux_unit_access_check(u, message, permission, error);