selinux: improve debug log format

path might be NULL when checking against the system permissions, so wrap
with strna().

The command line might not be available over D-Bus and thus cl might be
empty. Print "n/a" instead of the empty string.

diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
index f6d4e7cc5082bd24565d95e6f48983c68be0dc5b..6afc64a7b16f15cc2ab217fd86dedec40956f89a 100644 (file)
--- a/src/core/selinux-access.c
+++ b/src/core/selinux-access.c
@@ -280,7 +280,7 @@ int mac_selinux_generic_access_check(
 
         log_full_errno_zerook(LOG_DEBUG, r,
                               "SELinux access check scon=%s tcon=%s tclass=%s perm=%s state=%s function=%s path=%s cmdline=%s: %m",
-                              scon, fcon, tclass, permission, enforce ? "enforcing" : "permissive", function, path, cl);
+                              scon, fcon, tclass, permission, enforce ? "enforcing" : "permissive", function, strna(path), isempty(cl) ? "n/a" : cl);
         return enforce ? r : 0;
 }