From: Michal Sekletar <msekleta@redhat.com>
Date: Tue, 1 Apr 2025 08:38:14 +0000 (+0200)
Subject: core/service: ignore SELinux label errors in permissive mode
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=a3fee627074e030b4c32e0205818657381e5ae46;p=thirdparty%2Fsystemd.git

core/service: ignore SELinux label errors in permissive mode

Return -ENODATA instead of the raw error when SELinux is permissive, so
the caller falls back to the default label. This is needed to allow
relabeling service to start on systems where file contexts maybe
invalid.
---

diff --git a/src/core/service.c b/src/core/service.c
index 012336b47a0..8950eed5396 100644
--- a/src/core/service.c
+++ b/src/core/service.c
@@ -6307,9 +6307,13 @@ int service_determine_exec_selinux_label(Service *s, char **ret) {
                 log_unit_debug_errno(UNIT(s), r, "Can't read SELinux label off binary '%s', due to privileges, ignoring.", path);
                 return -ENODATA;
         }
-        if (r < 0)
-                return log_unit_debug_errno(UNIT(s), r, "Failed to read SELinux label off binary '%s': %m", path);
+        if (r < 0) {
+                if (mac_selinux_enforcing())
+                        return log_unit_debug_errno(UNIT(s), r, "Failed to read SELinux label off binary '%s': %m", path);
 
+                log_unit_debug_errno(UNIT(s), r, "Failed to read SELinux label off binary '%s', SELinux in permissive mode, ignoring: %m", path);
+                return -ENODATA;
+        }
         return 0;
 }