selinux: create unit invocation links with default SELinux context

diff --git a/src/basic/label.c b/src/basic/label.c
index 741c43c2b9af1f4f37a06cbe21e9ab18b4574970..107028e0680ca49c3f882a0eabd47b1451303a2f 100644 (file)
--- a/src/basic/label.c
+++ b/src/basic/label.c
@@ -5,6 +5,7 @@
 #include <unistd.h>
 
 #include "btrfs-util.h"
+#include "fs-util.h"
 #include "label.h"
 #include "macro.h"
 #include "selinux-util.h"
@@ -45,6 +46,27 @@ int symlink_label(const char *old_path, const char *new_path) {
         return mac_smack_fix(new_path, 0);
 }
 
+int symlink_atomic_label(const char *from, const char *to) {
+        int r;
+
+        assert(from);
+        assert(to);
+
+        r = mac_selinux_create_file_prepare(to, S_IFLNK);
+        if (r < 0)
+                return r;
+
+        if (symlink_atomic(from, to) < 0)
+                r = -errno;
+
+        mac_selinux_create_file_clear();
+
+        if (r < 0)
+                return r;
+
+        return mac_smack_fix(to, 0);
+}
+
 int mknod_label(const char *pathname, mode_t mode, dev_t dev) {
         int r;
 

diff --git a/src/basic/label.h b/src/basic/label.h
index 6dc0f710efcb5e904f5a29d64fff694571d40e02..d99d824b4af4c3f697e712b9909eeca49aa3063d 100644 (file)
--- a/src/basic/label.h
+++ b/src/basic/label.h
@@ -17,6 +17,7 @@ static inline int label_fix(const char *path, LabelFixFlags flags) {
 int mkdir_label(const char *path, mode_t mode);
 int mkdirat_label(int dirfd, const char *path, mode_t mode);
 int symlink_label(const char *old_path, const char *new_path);
+int symlink_atomic_label(const char *from, const char *to);
 int mknod_label(const char *pathname, mode_t mode, dev_t dev);
 
 int btrfs_subvol_make_label(const char *path);

diff --git a/src/core/unit.c b/src/core/unit.c
index 518a07f619f2166fdea2cc0fc615906293325990..302c82067f18835ee67bbff29cf3b221f59c7f20 100644 (file)
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -24,10 +24,10 @@
 #include "fileio-label.h"
 #include "fileio.h"
 #include "format-util.h"
-#include "fs-util.h"
 #include "id128-util.h"
 #include "io-util.h"
 #include "install.h"
+#include "label.h"
 #include "load-dropin.h"
 #include "load-fragment.h"
 #include "log.h"
@@ -5603,7 +5603,7 @@ static int unit_export_invocation_id(Unit *u) {
         if (r < 0)
                 return log_unit_debug_errno(u, r, "Failed to get invocation path: %m");
 
-        r = symlink_atomic(u->invocation_id_string, p);
+        r = symlink_atomic_label(u->invocation_id_string, p);
         if (r < 0)
                 return log_unit_debug_errno(u, r, "Failed to create invocation ID symlink %s: %m", p);