Make failures of mac_selinux_init() fatal

diff --git a/src/basic/selinux-util.c b/src/basic/selinux-util.c
index 0d7a7e1fbed9d53c075dd616dca211218588b0d7..3b414e2d1ad4065612afbde42b21f74159cbc97f 100644 (file)
--- a/src/basic/selinux-util.c
+++ b/src/basic/selinux-util.c
@@ -122,7 +122,7 @@ int mac_selinux_init(void) {
 
         label_hnd = selabel_open(SELABEL_CTX_FILE, NULL, 0);
         if (!label_hnd)
-                return log_enforcing_errno(errno, "Failed to initialize SELinux context: %m");
+                return log_enforcing_errno(errno, "Failed to initialize SELinux labeling handle: %m");
 
         after_timestamp = now(CLOCK_MONOTONIC);
         after_mallinfo = mallinfo();

diff --git a/src/core/main.c b/src/core/main.c
index 4e1e443a2874a9502db9fed064000b0c9cb8158f..a2ff71fa71103736192034ddcd779216aa884d9e 100644 (file)
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -2559,7 +2559,7 @@ int main(int argc, char *argv[]) {
                         }
 
                         if (mac_selinux_init() < 0) {
-                                error_message = "Failed to initialize SELinux policy";
+                                error_message = "Failed to initialize SELinux support";
                                 goto finish;
                         }
 

diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
index e694a95a0411327e422b3001904f2f59c0904356..36229f3c9bb5a045cfac55c37af398f45ef0554d 100644 (file)
--- a/src/hostname/hostnamed.c
+++ b/src/hostname/hostnamed.c
@@ -801,7 +801,10 @@ static int run(int argc, char *argv[]) {
                 return r;
 
         umask(0022);
-        mac_selinux_init();
+
+        r = mac_selinux_init();
+        if (r < 0)
+                return r;
 
         assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
 

diff --git a/src/hwdb/hwdb.c b/src/hwdb/hwdb.c
index 651647b3f0dd95972187c549710258f6da2317bb..eb038a8b55ea8d833b4b5b6dd6cbee78d927f9fd 100644 (file)
--- a/src/hwdb/hwdb.c
+++ b/src/hwdb/hwdb.c
@@ -125,7 +125,9 @@ static int run(int argc, char *argv[]) {
         if (r <= 0)
                 return r;
 
-        mac_selinux_init();
+        r = mac_selinux_init();
+        if (r < 0)
+                return r;
 
         return hwdb_main(argc, argv);
 }

diff --git a/src/locale/localed.c b/src/locale/localed.c
index 8ffcf306b5b74aec4de5593f0ea8e86d2e403e5b..3e58487c744c8371f5e0e34a37354cc7676bbf55 100644 (file)
--- a/src/locale/localed.c
+++ b/src/locale/localed.c
@@ -788,7 +788,10 @@ static int run(int argc, char *argv[]) {
                 return r;
 
         umask(0022);
-        mac_selinux_init();
+
+        r = mac_selinux_init();
+        if (r < 0)
+                return r;
 
         assert_se(sigprocmask_many(SIG_BLOCK, NULL, SIGTERM, SIGINT, -1) >= 0);
 

diff --git a/src/login/logind.c b/src/login/logind.c
index dc746a2c9edef1ff39227809a6fcd9f09fa69bff..377fba25cfab8c33d058e5d6772aefe9c74c31ee 100644 (file)
--- a/src/login/logind.c
+++ b/src/login/logind.c
@@ -1173,7 +1173,7 @@ static int run(int argc, char *argv[]) {
 
         r = mac_selinux_init();
         if (r < 0)
-                return log_error_errno(r, "Could not initialize labelling: %m");
+                return r;
 
         /* Always create the directories people can create inotify watches in. Note that some applications might check
          * for the existence of /run/systemd/seats/ to determine whether logind is available, so please always make

diff --git a/src/login/user-runtime-dir.c b/src/login/user-runtime-dir.c
index fdf0124c4168f06331db6d0049b01a54c9edaa94..38058d7b2a3f918ff60c0cd039e3216cd44625d5 100644 (file)
--- a/src/login/user-runtime-dir.c
+++ b/src/login/user-runtime-dir.c
@@ -192,11 +192,11 @@ static int run(int argc, char *argv[]) {
                 return log_error_errno(SYNTHETIC_ERRNO(EINVAL),
                                        "First argument must be either \"start\" or \"stop\".");
 
+        umask(0022);
+
         r = mac_selinux_init();
         if (r < 0)
-                return log_error_errno(r, "Could not initialize labelling: %m\n");
-
-        umask(0022);
+                return r;
 
         if (streq(argv[1], "start"))
                 return do_mount(argv[2]);

diff --git a/src/resolve/resolved.c b/src/resolve/resolved.c
index 50989a6b0a33ff63f76ea36e0b0925606a010187..566b950a637a1f486bdc7f7f0a610d28fb5d37ae 100644 (file)
--- a/src/resolve/resolved.c
+++ b/src/resolve/resolved.c
@@ -40,7 +40,7 @@ static int run(int argc, char *argv[]) {
 
         r = mac_selinux_init();
         if (r < 0)
-                return log_error_errno(r, "SELinux setup failed: %m");
+                return r;
 
         /* Drop privileges, but only if we have been started as root. If we are not running as root we assume most
          * privileges are already dropped and we can't create our directory. */

diff --git a/src/sysusers/sysusers.c b/src/sysusers/sysusers.c
index 6fbd5985d365b3bb00b56502084d9c9f7ed966f9..b5e7e08eee969c34c4617b6599ff12e0ac921da2 100644 (file)
--- a/src/sysusers/sysusers.c
+++ b/src/sysusers/sysusers.c
@@ -1898,7 +1898,7 @@ static int run(int argc, char *argv[]) {
 
         r = mac_selinux_init();
         if (r < 0)
-                return log_error_errno(r, "SELinux setup failed: %m");
+                return r;
 
         /* If command line arguments are specified along with --replace, read all
          * configuration files and insert the positional arguments at the specified

diff --git a/src/timedate/timedated.c b/src/timedate/timedated.c
index da59dd33148601b412c4cf49e7673bcdbf340909..afe593ff64564387134c41f9b58ad82de1afbd73 100644 (file)
--- a/src/timedate/timedated.c
+++ b/src/timedate/timedated.c
@@ -377,7 +377,10 @@ static int context_write_data_local_rtc(Context *c) {
                 }
         }
 
-        mac_selinux_init();
+        r = mac_selinux_init();
+        if (r < 0)
+                return r;
+
         return write_string_file_atomic_label("/etc/adjtime", w);
 }
 

diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c
index e827de1b06159c20f717bf8d8a5c355c86cea9e2..8a0b8d3b844fa8fea26f8a2340b757b645e8256d 100644 (file)
--- a/src/tmpfiles/tmpfiles.c
+++ b/src/tmpfiles/tmpfiles.c
@@ -3262,7 +3262,9 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        mac_selinux_init();
+        r = mac_selinux_init();
+        if (r < 0)
+                return r;
 
         items = ordered_hashmap_new(&item_array_hash_ops);
         globs = ordered_hashmap_new(&item_array_hash_ops);

diff --git a/src/udev/udevadm.c b/src/udev/udevadm.c
index f1115bff7a3ebe3c09ad6e677a27e0bad444972c..e476f88f00812db5a3abc907493291683c737a0a 100644 (file)
--- a/src/udev/udevadm.c
+++ b/src/udev/udevadm.c
@@ -124,7 +124,10 @@ static int run(int argc, char *argv[]) {
 
         log_set_max_level_realm(LOG_REALM_SYSTEMD, log_get_max_level());
 
-        mac_selinux_init();
+        r = mac_selinux_init();
+        if (r < 0)
+                return r;
+
         return udevadm_main(argc, argv);
 }
 

diff --git a/src/udev/udevd.c b/src/udev/udevd.c
index d86c1484c3e925f1b80c4c45c2cf5c092b1fbc99..8db19e4f89ca80a60dba6a0eea0916e86b61f640 100644 (file)
--- a/src/udev/udevd.c
+++ b/src/udev/udevd.c
@@ -1863,7 +1863,7 @@ int run_udevd(int argc, char *argv[]) {
 
         r = mac_selinux_init();
         if (r < 0)
-                return log_error_errno(r, "Could not initialize labelling: %m");
+                return r;
 
         r = mkdir_errno_wrapper("/run/udev", 0755);
         if (r < 0 && r != -EEXIST)

diff --git a/src/update-done/update-done.c b/src/update-done/update-done.c
index bbd14165d5ad4b4199c5a554911bffdb81b58e9f..c001802dc910b93eb347ef51f39b7917ecf6559d 100644 (file)
--- a/src/update-done/update-done.c
+++ b/src/update-done/update-done.c
@@ -49,10 +49,8 @@ int main(int argc, char *argv[]) {
         }
 
         r = mac_selinux_init();
-        if (r < 0) {
-                log_error_errno(r, "SELinux setup failed: %m");
+        if (r < 0)
                 return EXIT_FAILURE;
-        }
 
         r = apply_timestamp("/etc/.updated", &st.st_mtim);
         q = apply_timestamp("/var/.updated", &st.st_mtim);

diff --git a/src/user-sessions/user-sessions.c b/src/user-sessions/user-sessions.c
index c24142951709eadd0e59606c03655f1f663a8f02..cd92b696c0c20733599deea4c37ecce3fa587f52 100644 (file)
--- a/src/user-sessions/user-sessions.c
+++ b/src/user-sessions/user-sessions.c
@@ -25,7 +25,9 @@ static int run(int argc, char *argv[]) {
 
         umask(0022);
 
-        mac_selinux_init();
+        r = mac_selinux_init();
+        if (r < 0)
+                return r;
 
         if (streq(argv[1], "start")) {
                 r = unlink_or_warn("/run/nologin");