From: HATAYAMA Daisuke <d.hatayama@jp.fujitsu.com>
Date: Wed, 24 Jun 2015 03:01:26 +0000 (+0900)
Subject: selinux: fix missing SELinux unit access check
X-Git-Tag: v223~14^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4938696301a914ec26bcfc60bb99a1e9624e3789;p=thirdparty%2Fsystemd.git

selinux: fix missing SELinux unit access check

Currently, SELinux unit access check is not performed if a given unit
file has not been registered in a hash table. This is because function
manager_get_unit() only tries to pick up a Unit object from a Unit
hash table. Instead, we use function manager_load_unit() searching
Unit file pathes for the given Unit file.
---

diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
index e9a9a020de7..50a90b0bace 100644
--- a/src/core/selinux-access.c
+++ b/src/core/selinux-access.c
@@ -302,12 +302,12 @@ int mac_selinux_unit_access_check_strv(
         int r;
 
         STRV_FOREACH(i, units) {
-                u = manager_get_unit(m, *i);
-                if (u) {
-                        r = mac_selinux_unit_access_check(u, message, permission, error);
-                        if (r < 0)
-                                return r;
-                }
+                r = manager_load_unit(m, *i, NULL, error, &u);
+                if (r < 0)
+                        return r;
+                r = mac_selinux_unit_access_check(u, message, permission, error);
+                if (r < 0)
+                        return r;
         }
 #endif
         return 0;