X-Git-Url: http://git.ipfire.org/?a=blobdiff_plain;f=src%2Fcore%2Fexecute.c;h=a7e2362236d2c5e7628152efb45d1bc77c36cac2;hb=b213e1c11d5a383faf5c456a31389d5c0c0f039b;hp=eef2dacc54b850b0ce7b6e02fac663552f8fb092;hpb=6bf6e43e7e214a4bd03008a91a7fc77ce6934d65;p=thirdparty%2Fsystemd.git

diff --git a/src/core/execute.c b/src/core/execute.c
index eef2dacc54b..a7e2362236d 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -1582,18 +1582,15 @@ static int exec_child(
                 }
         }
 
+        umask(context->umask);
+
         if (params->apply_permissions) {
                 r = enforce_groups(context, username, gid);
                 if (r < 0) {
                         *exit_status = EXIT_GROUP;
                         return r;
                 }
-        }
-
-        umask(context->umask);
-
 #ifdef HAVE_SMACK
-        if (params->apply_permissions) {
                 if (context->smack_process_label) {
                         r = mac_smack_apply_pid(0, context->smack_process_label);
                         if (r < 0) {
@@ -1617,19 +1614,18 @@ static int exec_child(
                                 return r;
                         }
                 }
-        }
 #endif
 #endif
-
 #ifdef HAVE_PAM
-        if (params->apply_permissions && context->pam_name && username) {
-                r = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
-                if (r < 0) {
-                        *exit_status = EXIT_PAM;
-                        return r;
+                if (context->pam_name && username) {
+                        r = setup_pam(context->pam_name, username, uid, context->tty_path, &pam_env, fds, n_fds);
+                        if (r < 0) {
+                                *exit_status = EXIT_PAM;
+                                return r;
+                        }
                 }
-        }
 #endif
+        }
 
         if (context->private_network && runtime && runtime->netns_storage_socket[0] >= 0) {
                 r = setup_netns(runtime->netns_storage_socket);