core: reload SELinux label cache on daemon-reload

Reloading the SELinux label cache here enables a light-wight follow-up of a SELinux policy change, e.g. adding a label for a RuntimeDirectory.

Closes: #13363

diff --git a/src/basic/selinux-util.c b/src/basic/selinux-util.c
index f35e760233be51f4bc872aa2f03483cdc8b7415d..2c6d407295b5a308bd194f3440e05ea6fe703394 100644 (file)
--- a/src/basic/selinux-util.c
+++ b/src/basic/selinux-util.c
@@ -107,6 +107,26 @@ void mac_selinux_finish(void) {
 #endif
 }
 
+void mac_selinux_reload(void) {
+
+#if HAVE_SELINUX
+        struct selabel_handle *backup_label_hnd;
+
+        if (!label_hnd)
+                return;
+
+        backup_label_hnd = TAKE_PTR(label_hnd);
+
+        /* try to initialize new handle
+         *    on success close backup
+         *    on failure restore backup */
+        if (mac_selinux_init() == 0)
+                selabel_close(backup_label_hnd);
+        else
+                label_hnd = backup_label_hnd;
+#endif
+}
+
 int mac_selinux_fix(const char *path, LabelFixFlags flags) {
 
 #if HAVE_SELINUX

diff --git a/src/basic/selinux-util.h b/src/basic/selinux-util.h
index bd5207c318349730164a7995f90c54ab106ce433..639c35b687b786787260184e93d189d7b464f976 100644 (file)
--- a/src/basic/selinux-util.h
+++ b/src/basic/selinux-util.h
@@ -13,6 +13,7 @@ void mac_selinux_retest(void);
 
 int mac_selinux_init(void);
 void mac_selinux_finish(void);
+void mac_selinux_reload(void);
 
 int mac_selinux_fix(const char *path, LabelFixFlags flags);
 int mac_selinux_apply(const char *path, const char *label);

diff --git a/src/core/main.c b/src/core/main.c
index b0a55f8cb8e3daf00db9f633e53d5bdcc432f887..40ac88fbb4f3f31a1ef38aa91d78573348dcdd37 100644 (file)
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -1747,6 +1747,8 @@ static int invoke_main_loop(
                         saved_log_level = m->log_level_overridden ? log_get_max_level() : -1;
                         saved_log_target = m->log_target_overridden ? log_get_target() : _LOG_TARGET_INVALID;
 
+                        mac_selinux_reload();
+
                         (void) parse_configuration(saved_rlimit_nofile, saved_rlimit_memlock);
 
                         set_manager_defaults(m);