From 60ef4baeedc34b5c7ab0e2f211684f9b96d63f82 Mon Sep 17 00:00:00 2001

From: Luca Boccassi <bluca@debian.org>

Date: Thu, 23 Nov 2023 19:08:22 +0000

Subject: [PATCH 1/3] core: pass bpf_outer_map_fd to sd-executor only if

 RestrictFileSystems was set

It causes SELinux denials to be raised, so restrict it only where needed

Follow-up for beb4ae87558cae

---

 src/core/execute-serialize.c | 6 +++---

 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/core/execute-serialize.c b/src/core/execute-serialize.c

index 342883994a..60c121a0d1 100644

--- a/src/core/execute-serialize.c

+++ b/src/core/execute-serialize.c

@@ -1244,7 +1244,7 @@ static bool exec_parameters_is_idle_pipe_set(const ExecParameters *p) {

                 p->idle_pipe[3] >= 0;

 }

-static int exec_parameters_serialize(const ExecParameters *p, FILE *f, FDSet *fds) {

+static int exec_parameters_serialize(const ExecParameters *p, const ExecContext *c, FILE *f, FDSet *fds) {

         int r;

         assert(f);

@@ -1375,7 +1375,7 @@ static int exec_parameters_serialize(const ExecParameters *p, FILE *f, FDSet *fd

                         return r;

         }

-        if (p->bpf_outer_map_fd >= 0) {

+        if (c && exec_context_restrict_filesystems_set(c) && p->bpf_outer_map_fd >= 0) {

                 r = serialize_fd(f, fds, "exec-parameters-bpf-outer-map-fd", p->bpf_outer_map_fd);

                 if (r < 0)

                         return r;

@@ -3860,7 +3860,7 @@ int exec_serialize_invocation(

         if (r < 0)

                 return log_debug_errno(r, "Failed to serialize command: %m");

-        r = exec_parameters_serialize(p, f, fds);

+        r = exec_parameters_serialize(p, ctx, f, fds);

         if (r < 0)

                 return log_debug_errno(r, "Failed to serialize parameters: %m");

-- 

2.43.0