From: Ismo Puustinen <ismo.puustinen@intel.com>
Date: Tue, 2 Aug 2016 12:58:30 +0000 (+0300)
Subject: main: load Smack policy before IMA policy (#3859)
X-Git-Tag: v232~349
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=96694e998be1f631861c8c72de67c581a5306afa;p=thirdparty%2Fsystemd.git

main: load Smack policy before IMA policy (#3859)

IMA wiki says: "If the IMA policy contains LSM labels, then the LSM
policy must be loaded prior to the IMA policy." Right now, in case of
Smack, the IMA policy is loaded before the Smack policy. Move the order
around to allow Smack labels to be used in IMA policy.
---

diff --git a/src/core/main.c b/src/core/main.c
index 74b8ea139fe..c46d8866534 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -1414,12 +1414,12 @@ int main(int argc, char *argv[]) {
                         if (mac_selinux_setup(&loaded_policy) < 0) {
                                 error_message = "Failed to load SELinux policy";
                                 goto finish;
-                        } else if (ima_setup() < 0) {
-                                error_message = "Failed to load IMA policy";
-                                goto finish;
                         } else if (mac_smack_setup(&loaded_policy) < 0) {
                                 error_message = "Failed to load SMACK policy";
                                 goto finish;
+                        } else if (ima_setup() < 0) {
+                                error_message = "Failed to load IMA policy";
+                                goto finish;
                         }
                         dual_timestamp_get(&security_finish_timestamp);
                 }