From 0b630ecdbfe20ddff9da4f4b6712e80b745b5ab2 Mon Sep 17 00:00:00 2001 From: HATAYAMA Daisuke Date: Wed, 24 Jun 2015 12:01:26 +0900 Subject: [PATCH] selinux: fix missing SELinux unit access check Currently, SELinux unit access check is not performed if a given unit file has not been registered in a hash table. This is because function manager_get_unit() only tries to pick up a Unit object from a Unit hash table. Instead, we use function manager_load_unit() searching Unit file pathes for the given Unit file. Cherry-picked from: 4938696301a914ec26bcfc60bb99a1e9624e378 Resolves: #1185120 --- src/core/selinux-access.c | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c index 91460b8af9..f11247c092 100644 --- a/src/core/selinux-access.c +++ b/src/core/selinux-access.c @@ -272,12 +272,12 @@ int mac_selinux_unit_access_check_strv(char **units, int r; STRV_FOREACH(i, units) { - u = manager_get_unit(m, *i); - if (u) { - r = mac_selinux_unit_access_check(u, message, permission, error); - if (r < 0) - return r; - } + r = manager_load_unit(m, *i, NULL, error, &u); + if (r < 0) + return r; + r = mac_selinux_unit_access_check(u, message, permission, error); + if (r < 0) + return r; } #endif return 0;