From dd5e5ef3392a83525d23aa9a523e9d187fb7faaf Mon Sep 17 00:00:00 2001

From: Michal Schmidt <mschmidt@redhat.com>

Date: Thu, 6 Nov 2014 16:48:11 +0100

Subject: [PATCH] shared: create files even if the SELinux policy has no

 context for them

The SELinux policy defines no context for some files. E.g.:

  $ matchpathcon /run/lock/subsys /dev/mqueue

  /run/lock/subsys        <<none>>

  /dev/mqueue     <<none>>

We still need to be able to create them.

In this case selabel_lookup_raw() returns ENOENT. We should then skip

setfscreatecon(), but still return success.

It was broken since c34255bdb2 ("label: unify code to make directories,

symlinks").

(cherry picked from commit 2d58aa4692e9fc47911bff5d064ba3e328c35369)

---

 src/shared/selinux-util.c | 8 ++++++--

 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c

index 1eddd17d27..6bd3bf1c80 100644

--- a/src/shared/selinux-util.c

+++ b/src/shared/selinux-util.c

@@ -332,9 +332,13 @@ int mac_selinux_create_file_prepare(const char *path, mode_t mode) {

                 r = selabel_lookup_raw(label_hnd, &filecon, newpath, mode);

         }

-        if (r < 0 && errno != ENOENT)

+        /* No context specified by the policy? Proceed without setting it. */

+        if (r < 0 && errno == ENOENT)

+                return 0;

+

+        if (r < 0)

                 r = -errno;

-        else if (r == 0) {

+        else {

                 r = setfscreatecon(filecon);

                 if (r < 0) {

                         log_enforcing("Failed to set SELinux security context %s for %s: %m", filecon, path);