From 5c2592bf519dc7b2b28cde77f5f35422ec7a9320 Mon Sep 17 00:00:00 2001
From: Michael Scherer <misc@zarb.org>
Date: Thu, 6 Feb 2014 10:05:18 +0100
Subject: [PATCH] exec: Add support for ignoring errors on SELinuxContext by
 prefixing it with -, like for others settings.

Also remove call to security_check_context, as this doesn't serve anything, since
setexeccon will fail anyway.

(cherry picked from commit 0d3f7bb3a5bc6d5c0712f88a080fed388981bca3)

Related: #1113790
---
 man/systemd.exec.xml |  4 +++-
 src/core/execute.c   | 20 +++++++++++++-------
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/man/systemd.exec.xml b/man/systemd.exec.xml
index a68cfa7..7608489 100644
--- a/man/systemd.exec.xml
+++ b/man/systemd.exec.xml
@@ -924,7 +924,9 @@
                                 <listitem><para>Set the SELinux context of the
                                 executed process. If set, this will override the
                                 automated domain transition. However, the policy
-                                still need to autorize the transition. See
+                                still need to autorize the transition. This directive
+                                is ignored if SELinux is disabled. If prefixed by <literal>-</literal>,
+                                all errors will be ignored. See
                                 <citerefentry><refentrytitle>setexeccon</refentrytitle><manvolnum>3</manvolnum></citerefentry>
                                 for details.</para></listitem>
                         </varlistentry>
diff --git a/src/core/execute.c b/src/core/execute.c
index cb6f146..9fc5090 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -72,6 +72,7 @@
 #include "fileio.h"
 #include "unit.h"
 #include "async.h"
+#include "selinux-util.h"
 
 #define IDLE_TIMEOUT_USEC (5*USEC_PER_SEC)
 #define IDLE_TIMEOUT2_USEC (1*USEC_PER_SEC)
@@ -1473,13 +1474,18 @@ int exec_spawn(ExecCommand *command,
                         }
 #ifdef HAVE_SELINUX
                         if (context->selinux_context && use_selinux()) {
-                                err = security_check_context(context->selinux_context);
-                                if (err < 0) {
-                                        r = EXIT_SELINUX_CONTEXT;
-                                        goto fail_child;
-                                }
-                                err = setexeccon(context->selinux_context);
-                                if (err < 0) {
+                                bool ignore;
+                                char* c;
+
+                                c = context->selinux_context;
+                                if (c[0] == '-') {
+                                        c++;
+                                        ignore = true;
+                                } else
+                                        ignore = false;
+
+                                err = setexeccon(c);
+                                if (err < 0 && !ignore) {
                                         r = EXIT_SELINUX_CONTEXT;
                                         goto fail_child;
                                 }