From: Luca Boccassi <bluca@debian.org>
Date: Mon, 13 Nov 2023 19:26:33 +0000 (+0000)
Subject: selinux: fix loading policy at early boot
X-Git-Tag: v255-rc2~19
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4ce6e7d158f4e135d0f70359a12eba4ce68ce170;p=thirdparty%2Fsystemd.git

selinux: fix loading policy at early boot

First, check for the cached enabled/disabled, as that's what all the
label functions used to do. Then, if initialization is not done yet,
do not cause the label functions to bail out, as it's expected to
happen at early boot.

Among other things, fixes:

systemd[1]: Failed to compute init label, ignoring.

Follow-up for: 0617da2edb91669a
---

diff --git a/src/shared/selinux-util.c b/src/shared/selinux-util.c
index fb7da12fb6b..cdad5e1ab0f 100644
--- a/src/shared/selinux-util.c
+++ b/src/shared/selinux-util.c
@@ -158,16 +158,17 @@ static int selinux_init(bool force) {
         };
         int r;
 
+        if (!mac_selinux_use())
+                return 0;
+
         if (initialized == INITIALIZED)
                 return 1;
 
         /* Internal call from this module? Unless we were explicitly configured to allow lazy initialization
-         * bail out immediately. */
+         * bail out immediately. Pretend all is good, we do not want callers to abort here, for example at
+         * early boot when the policy is being initialised. */
         if (!force && initialized != LAZY_INITIALIZED)
-                return 0;
-
-        if (!mac_selinux_use())
-                return 0;
+                return 1;
 
         r = selinux_status_open(/* netlink fallback */ 1);
         if (r < 0) {