From: Yu Watanabe <watanabe.yu+github@gmail.com>
Date: Fri, 31 Jul 2026 03:49:14 +0000 (+0900)
Subject: selinux: relax error handling in permissive mode (#36929)
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=63e35ca3f99566095c84248e9eb41a3a6b32f2eb;p=thirdparty%2Fsystemd.git

selinux: relax error handling in permissive mode (#36929)

Error returned from security_compute_create_raw() means that kernel
couldn't compute target context. Very likely because file context is not
known to the policy, i.e. security.selinux xattr contains some garbage
value and we are running in permissive mode, otherwise returned context
would be "unlabeled_t" instead of getting an error.

mac_selinux_get_create_label_from_exe() is used to figure out create
label for socket units and we fail to start the socket if we can't
figure out that label.

However, it may be necessary to start some sockets in order to get to
the point when we launch the service that relabels (in permissive mode)
the entire filesystem and reboots.
---

63e35ca3f99566095c84248e9eb41a3a6b32f2eb