core: correct SELinux label of service credential directory

Label the service root credential directory so write_credential() will
create entries with the label of their parent directory.

Resolves: #21134

diff --git a/src/core/execute.c b/src/core/execute.c
index 9d100889018da4e7311607ab6ea46e9fad2ea88c..0c1e2e0563ba487024ee82dfca268d9c0ac5df69 100644 (file)
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -2819,6 +2819,8 @@ static int setup_credentials_internal(
         assert(!must_mount || workspace_mounted > 0);
         where = workspace_mounted ? workspace : final;
 
+        (void) label_fix_container(where, final, 0);
+
         r = acquire_credentials(context, params, unit, where, uid, workspace_mounted);
         if (r < 0)
                 return r;