selinux: make sure we never use /dev/null for making unit selinux access decisions

diff --git a/src/core/selinux-access.h b/src/core/selinux-access.h
index c5f5fb975e4aa57d014a3fd34c4419cfce66ff04..dd48d0654e93aba5bcc9fda71f07ec04dc9ca88f 100644 (file)
--- a/src/core/selinux-access.h
+++ b/src/core/selinux-access.h
@@ -33,10 +33,7 @@ int mac_selinux_generic_access_check(sd_bus_message *message, const char *path,
         mac_selinux_generic_access_check((message), NULL, (permission), (error))
 
 #define mac_selinux_unit_access_check(unit, message, permission, error) \
-        ({                                                              \
-                const Unit *_unit = (unit);                             \
-                mac_selinux_generic_access_check((message), _unit->source_path ?: _unit->fragment_path, (permission), (error)); \
-        })
+        mac_selinux_generic_access_check((message), unit_label_path(unit), (permission), (error))
 
 #else
 

diff --git a/src/core/unit.c b/src/core/unit.c
index 932f05baa2798987d9bc0e2f41cf116e69603eb1..54e298cae417515f4d90a90eeeee8178b4b821ac 100644 (file)
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -5375,6 +5375,23 @@ bool unit_needs_console(Unit *u) {
         return exec_context_may_touch_console(ec);
 }
 
+const char *unit_label_path(Unit *u) {
+        const char *p;
+
+        /* Returns the file system path to use for MAC access decisions, i.e. the file to read the SELinux label off
+         * when validating access checks. */
+
+        p = u->source_path ?: u->fragment_path;
+        if (!p)
+                return NULL;
+
+        /* If a unit is masked, then don't read the SELinux label of /dev/null, as that really makes no sense */
+        if (path_equal(p, "/dev/null"))
+                return NULL;
+
+        return p;
+}
+
 static const char* const collect_mode_table[_COLLECT_MODE_MAX] = {
         [COLLECT_INACTIVE] = "inactive",
         [COLLECT_INACTIVE_OR_FAILED] = "inactive-or-failed",

diff --git a/src/core/unit.h b/src/core/unit.h
index 8c79d4ed2eb4e0013585dc59b2d9e6e42699af00..32105830509c6f567f60478f487bb5c0056cb049 100644 (file)
--- a/src/core/unit.h
+++ b/src/core/unit.h
@@ -801,6 +801,8 @@ void unit_warn_leftover_processes(Unit *u);
 
 bool unit_needs_console(Unit *u);
 
+const char *unit_label_path(Unit *u);
+
 /* Macros which append UNIT= or USER_UNIT= to the message */
 
 #define log_unit_full(unit, level, error, ...)                          \