1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
5 #include "sd-messages.h"
7 #include "errno-util.h"
8 #include "initrd-util.h"
10 #include "selinux-setup.h"
11 #include "selinux-util.h"
12 #include "string-util.h"
13 #include "time-util.h"
15 int mac_selinux_setup(bool *loaded_policy
) {
16 assert(loaded_policy
);
21 mac_selinux_disable_logging();
23 /* Don't load policy in the initrd if we don't appear to have it. For the real root, we check below
24 * if we've already loaded policy, and return gracefully. */
25 if (in_initrd() && access(selinux_path(), F_OK
) < 0) {
27 log_warning_errno(errno
, "Unable to check if %s exists, assuming it does not: %m", selinux_path());
32 bool initialized
= false;
34 /* Already initialized by somebody else?
36 * Note: getcon_raw() can return 0, and still give us a NULL pointer if /proc/self/attr/current is
37 * empty. SELinux guarantees this won't happen, but that file isn't specific to SELinux, and may be
38 * provided by some other arbitrary LSM with different semantics. */
39 _cleanup_freecon_
char *con
= NULL
;
40 if (getcon_raw(&con
) < 0)
41 log_debug_errno(errno
, "getcon_raw() failed, assuming SELinux is not initialized: %m");
43 initialized
= !streq(con
, "kernel");
44 log_debug("SELinux already initialized: %s", yes_no(initialized
));
47 /* Make sure we have no fds open while loading the policy and transitioning */
50 /* Now load the policy */
51 usec_t before_load
= now(CLOCK_MONOTONIC
);
53 if (selinux_init_load_policy(&enforce
) == 0) { /* NB: Apparently doesn't set useful errno! */
56 /* Transition to the new context */
57 _cleanup_freecon_
char *label
= NULL
;
58 r
= mac_selinux_get_create_label_from_exe(SYSTEMD_BINARY_PATH
, &label
);
61 log_warning_errno(r
, "Failed to compute init label, ignoring: %m");
63 r
= RET_NERRNO(setcon_raw(label
));
66 log_warning_errno(r
, "Failed to transition into init label '%s', ignoring: %m", label
);
68 log_debug("Successfully switched to calculated init label '%s'.", label
);
71 usec_t after_load
= now(CLOCK_MONOTONIC
);
72 log_info("Successfully loaded SELinux policy in %s.",
73 FORMAT_TIMESPAN(after_load
- before_load
, 0));
75 *loaded_policy
= true;
81 return log_struct_errno(LOG_EMERG
, SYNTHETIC_ERRNO(EIO
),
82 LOG_MESSAGE("Failed to load SELinux policy :%m"),
83 LOG_MESSAGE_ID(SD_MESSAGE_SELINUX_FAILED_STR
));
85 log_notice("Failed to load new SELinux policy. Continuing with old policy.");
87 log_debug("Unable to load SELinux policy. Ignoring.");