label: Introduce LabelOps to do pre/post labelling operations

By default, label_ops is initialized with a NULL pointer which translates
to noop labelling operations. In mac_selinux_init() and the new mac_smack_init(),
we initialize label_ops with a MAC specific LabelOps pointer.

We also introduce mac_init() to initialize any configured MACs and replace all
usages of mac_selinux_init() with mac_init().

diff --git a/src/basic/label.c b/src/basic/label.c
new file mode 100644 (file)
index 0000000..f134e77
--- /dev/null
+++ b/src/basic/label.c
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+
+#include <errno.h>
+#include <stddef.h>
+
+#include "label.h"
+
+static const LabelOps *label_ops = NULL;
+
+int label_ops_set(const LabelOps *ops) {
+        if (label_ops)
+                return -EBUSY;
+
+        label_ops = ops;
+        return 0;
+}
+
+int label_ops_pre(int dir_fd, const char *path, mode_t mode) {
+        if (!label_ops || !label_ops->pre)
+                return 0;
+
+        return label_ops->pre(dir_fd, path, mode);
+}
+
+int label_ops_post(int dir_fd, const char *path) {
+        if (!label_ops || !label_ops->post)
+                return 0;
+
+        return label_ops->post(dir_fd, path);
+}

diff --git a/src/basic/label.h b/src/basic/label.h
new file mode 100644 (file)
index 0000000..9644e43
--- /dev/null
+++ b/src/basic/label.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include <sys/types.h>
+
+typedef struct LabelOps {
+        int (*pre)(int dir_fd, const char *path, mode_t mode);
+        int (*post)(int dir_fd, const char *path);
+} LabelOps;
+
+int label_ops_set(const LabelOps *label_ops);
+
+int label_ops_pre(int dir_fd, const char *path, mode_t mode);
+int label_ops_post(int dir_fd, const char *path);

diff --git a/src/basic/meson.build b/src/basic/meson.build
index ee9433714019bf65226ce766b4463ce985902be1..9358a400014d4e214738c7eadaf9290e268f9330 100644 (file)
--- a/src/basic/meson.build
+++ b/src/basic/meson.build
@@ -44,6 +44,7 @@ basic_sources = files(
         'inotify-util.c',
         'io-util.c',
         'ioprio-util.c',
+        'label.c',
         'limits-util.c',
         'locale-util.c',
         'lock-util.c',

diff --git a/src/core/main.c b/src/core/main.c
index 08d416bc14949d36b1c9658d0427c666f9f471da..c69f9b9afeed8e5dfb139196df7b5f8db19fa83a 100644 (file)
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -2849,8 +2849,8 @@ int main(int argc, char *argv[]) {
                                         goto finish;
                         }
 
-                        if (mac_selinux_init() < 0) {
-                                error_message = "Failed to initialize SELinux support";
+                        if (mac_init() < 0) {
+                                error_message = "Failed to initialize MAC support";
                                 goto finish;
                         }
 
@@ -2922,8 +2922,8 @@ int main(int argc, char *argv[]) {
                  * operate. */
                 capability_ambient_set_apply(0, /* also_inherit= */ false);
 
-                if (mac_selinux_init() < 0) {
-                        error_message = "Failed to initialize SELinux support";
+                if (mac_init() < 0) {
+                        error_message = "Failed to initialize MAC support";
                         goto finish;
                 }
         }

diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
index 36ab0148b9bc4c584906ff7b078a247a984bbc01..97b1c61748ae7ada7622a4375b28bf139575fb8e 100644 (file)
--- a/src/hostname/hostnamed.c
+++ b/src/hostname/hostnamed.c
@@ -1524,7 +1524,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/hwdb/hwdb.c b/src/hwdb/hwdb.c
index edc5dfc1f5fc798c417ef9bdfabf90140c17a39f..4287b1f066015c11d5a3eccc3b437afe7600094d 100644 (file)
--- a/src/hwdb/hwdb.c
+++ b/src/hwdb/hwdb.c
@@ -124,7 +124,7 @@ static int run(int argc, char *argv[]) {
         if (r <= 0)
                 return r;
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/locale/localed.c b/src/locale/localed.c
index 63ff69d7d3f749f8df83fbe4b0c4248008876357..9e5b7b03c031ee1bf46e891ed79035e6d54c4a30 100644 (file)
--- a/src/locale/localed.c
+++ b/src/locale/localed.c
@@ -657,7 +657,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/login/logind.c b/src/login/logind.c
index cfb3ef500c6060190d8dbc4118e5538081313907..8323bcc0cb25553dab7948f05b2517728e1efc54 100644 (file)
--- a/src/login/logind.c
+++ b/src/login/logind.c
@@ -1194,7 +1194,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/login/user-runtime-dir.c b/src/login/user-runtime-dir.c
index 7513f6575689bea194619f97f609048188caa47b..ed8a80e6ed5042934a103a108bbc5f3b46d89e71 100644 (file)
--- a/src/login/user-runtime-dir.c
+++ b/src/login/user-runtime-dir.c
@@ -202,7 +202,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/machine/machinectl.c b/src/machine/machinectl.c
index 197d0cfa1c214b180b1183a08f18d1bac6c1b1fc..8d7d464a4a23e372da9603a715c1b7a1807b8fdc 100644 (file)
--- a/src/machine/machinectl.c
+++ b/src/machine/machinectl.c
@@ -1462,7 +1462,7 @@ static int edit_settings(int argc, char *argv[], void *userdata) {
                 return log_error_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
                                        "Edit is only supported on the host machine.");
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c
index f9d3281509d60f4a9aa7294778c3f13898b14c77..1625c5189d0e95ef8e244b5420bf13b1afd45c73 100644 (file)
--- a/src/resolve/resolved.c
+++ b/src/resolve/resolved.c
@@ -38,7 +38,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/shared/label-util.c b/src/shared/label-util.c
index c0639e3a888c763f78bf23d1c2d4d408c432faac..3316c9ed37b5384265caaffac4ee62493d4316ed 100644 (file)
--- a/src/shared/label-util.c
+++ b/src/shared/label-util.c
@@ -6,6 +6,7 @@
 
 #include "btrfs-util.h"
 #include "fs-util.h"
+#include "label.h"
 #include "label-util.h"
 #include "macro.h"
 #include "selinux-util.h"
@@ -115,3 +116,15 @@ int btrfs_subvol_make_label(const char *path) {
 
         return mac_smack_fix(path, 0);
 }
+
+int mac_init(void) {
+        int r;
+
+        assert(!(mac_selinux_use() && mac_smack_use()));
+
+        r = mac_selinux_init();
+        if (r < 0)
+                return r;
+
+        return mac_smack_init();
+}

diff --git a/src/shared/label-util.h b/src/shared/label-util.h
index 2f899e2bddc88ce0a21f0560874dd3eb8171f7b4..2f8c539618979ee4700e3039d7c5d8e7e334c604 100644 (file)
--- a/src/shared/label-util.h
+++ b/src/shared/label-util.h
@@ -24,3 +24,5 @@ static inline int symlink_atomic_label(const char *from, const char *to) {
 int mknod_label(const char *pathname, mode_t mode, dev_t dev);
 
 int btrfs_subvol_make_label(const char *path);
+
+int mac_init(void);

diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c
index cc00a85952c4d4146db49a64c1b15bb2e4be87da..a38a56f43496e905f7d38c9057e1c54b45c542a0 100644 (file)
--- a/src/shared/selinux-util.c
+++ b/src/shared/selinux-util.c
@@ -20,6 +20,7 @@
 #include "alloc-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
+#include "label.h"
 #include "log.h"
 #include "macro.h"
 #include "mallinfo-util.h"
@@ -54,6 +55,15 @@ static bool have_status_page = false;
                         : -ERRNO_VALUE(_e);                             \
                 _enforcing ? _r : 0;                                    \
         })
+
+static int mac_selinux_label_pre(int dir_fd, const char *path, mode_t mode) {
+        return mac_selinux_create_file_prepare_at(dir_fd, path, mode);
+}
+
+static int mac_selinux_label_post(int dir_fd, const char *path) {
+        mac_selinux_create_file_clear();
+        return 0;
+}
 #endif
 
 bool mac_selinux_use(void) {
@@ -128,6 +138,10 @@ static int open_label_db(void) {
 
 int mac_selinux_init(void) {
 #if HAVE_SELINUX
+        static const LabelOps label_ops = {
+                .pre = mac_selinux_label_pre,
+                .post = mac_selinux_label_post,
+        };
         int r;
 
         if (initialized)
@@ -152,6 +166,10 @@ int mac_selinux_init(void) {
                 return r;
         }
 
+        r = label_ops_set(&label_ops);
+        if (r < 0)
+                return r;
+
         /* Save the current policyload sequence number, so mac_selinux_maybe_reload() does not trigger on
          * first call without any actual change. */
         last_policyload = selinux_status_policyload();

diff --git a/src/shared/smack-util.c b/src/shared/smack-util.c
index 8c28dd91d75b882be79763f0c400799963dd2395..1f88e724d007dd63790b8c64d460fcc35c79f95a 100644 (file)
--- a/src/shared/smack-util.c
+++ b/src/shared/smack-util.c
@@ -15,6 +15,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "label.h"
 #include "log.h"
 #include "macro.h"
 #include "path-util.h"
@@ -288,3 +289,23 @@ int renameat_and_apply_smack_floor_label(int fdf, const char *from, int fdt, con
         return 0;
 #endif
 }
+
+static int mac_smack_label_pre(int dir_fd, const char *path, mode_t mode) {
+        return 0;
+}
+
+static int mac_smack_label_post(int dir_fd, const char *path) {
+        return mac_smack_fix_full(dir_fd, path, NULL, 0);
+}
+
+int mac_smack_init(void) {
+        static const LabelOps label_ops = {
+                .pre = mac_smack_label_pre,
+                .post = mac_smack_label_post,
+        };
+
+        if (!mac_smack_use())
+                return 0;
+
+        return label_ops_set(&label_ops);
+}

diff --git a/src/shared/smack-util.h b/src/shared/smack-util.h
index 953bf9135834b7e96a6b7cdcedd7fa8c211b6322..f6ed2ece38a4b07e05b3b40488fa4ad04ac105b8 100644 (file)
--- a/src/shared/smack-util.h
+++ b/src/shared/smack-util.h
@@ -28,6 +28,7 @@ typedef enum SmackAttr {
 } SmackAttr;
 
 bool mac_smack_use(void);
+int mac_smack_init(void);
 
 int mac_smack_fix_full(int atfd, const char *inode_path, const char *label_path, LabelFixFlags flags);
 static inline int mac_smack_fix(const char *path, LabelFixFlags flags) {

diff --git a/src/systemctl/systemctl-edit.c b/src/systemctl/systemctl-edit.c
index 561b01a67a46730cdeaa8d23f42be12ab05da7c6..aff823d773d627952413f3357d8a08396dcf9713 100644 (file)
--- a/src/systemctl/systemctl-edit.c
+++ b/src/systemctl/systemctl-edit.c
@@ -333,7 +333,7 @@ int verb_edit(int argc, char *argv[], void *userdata) {
         if (r < 0)
                 return r;
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/sysusers/sysusers.c b/src/sysusers/sysusers.c
index 12adad516e9f02df97fc2f1bf8acb3bf03ef30b8..cfa4823df718ccb5dcb14c341ca7c893661c0a30 100644 (file)
--- a/src/sysusers/sysusers.c
+++ b/src/sysusers/sysusers.c
@@ -2178,7 +2178,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/test/udev-rule-runner.c b/src/test/udev-rule-runner.c
index 0b5938802a5a37b54ee5ec8ca6155d847207e3b1..f7ba143325a1c4e53d7f0a994088e124d0a606d4 100644 (file)
--- a/src/test/udev-rule-runner.c
+++ b/src/test/udev-rule-runner.c
@@ -117,7 +117,7 @@ static int run(int argc, char *argv[]) {
 
         log_debug("version %s", GIT_VERSION);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
index ad483301ef14d348d5ab036f762ea4328588e328..ad1d492d6bb89e7bb5d14f664b5d023a8cc45e75 100644 (file)
--- a/src/timedate/timedated.c
+++ b/src/timedate/timedated.c
@@ -392,7 +392,7 @@ static int context_write_data_local_rtc(Context *c) {
                 }
         }
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index add3f07cb27775e597621cbaaf2279a538bc7e72..b58c595e6b0cbcb5cb2051edb2d7bd838ae686b3 100644 (file)
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -4326,7 +4326,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/udev/udevadm.c b/src/udev/udevadm.c
index b803f7bb0f5f0e29e020739bf49237174e788313..51dc041a29c39133c865e0f4fcf9051ef7ac37e3 100644 (file)
--- a/src/udev/udevadm.c
+++ b/src/udev/udevadm.c
@@ -130,7 +130,7 @@ static int run(int argc, char *argv[]) {
         if (r <= 0)
                 return r;
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/udev/udevd.c b/src/udev/udevd.c
index b3aabcaa1f13cb25af53038d0d0813a9929d8c59..cf00576cfbe12bc9b83f1bbb26708c08fa6e876e 100644 (file)
--- a/src/udev/udevd.c
+++ b/src/udev/udevd.c
@@ -2019,7 +2019,7 @@ int run_udevd(int argc, char *argv[]) {
         /* set umask before creating any file/directory */
         umask(022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;
 

diff --git a/src/update-done/update-done.c b/src/update-done/update-done.c
index 6518830717ecc0967db685f9c68ca26e286cec62..f448b3b1d173fd75c5d49599b8718bbb273cd637 100644 (file)
--- a/src/update-done/update-done.c
+++ b/src/update-done/update-done.c
@@ -48,7 +48,7 @@ int main(int argc, char *argv[]) {
                 return EXIT_FAILURE;
         }
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return EXIT_FAILURE;
 

diff --git a/src/user-sessions/user-sessions.c b/src/user-sessions/user-sessions.c
index 37867ee3ed1d8f975899d1e90f75b40071ef7cba..58054f89fb33759a21e024a835e7c616660fdf98 100644 (file)
--- a/src/user-sessions/user-sessions.c
+++ b/src/user-sessions/user-sessions.c
@@ -25,7 +25,7 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        r = mac_selinux_init();
+        r = mac_init();
         if (r < 0)
                 return r;