From: Christian Göttsche <cgzones@googlemail.com>
Date: Wed, 18 Dec 2019 13:57:00 +0000 (+0100)
Subject: selinux-access: log warning on context acquisition failure
X-Git-Tag: v245-rc1~9^2
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=refs%2Fpull%2F14778%2Fhead;p=thirdparty%2Fsystemd.git

selinux-access: log warning on context acquisition failure

Relevant when testing in permissive mode, where the function does not return a failure to the client.
This helps to configure a system in permissive mode, without getting surprising failures when switching to enforced mode.
---

diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c
index 9fd3099feab..4500e4452fa 100644
--- a/src/core/selinux-access.c
+++ b/src/core/selinux-access.c
@@ -223,6 +223,7 @@ int mac_selinux_generic_access_check(
 
                 r = getfilecon_raw(path, &fcon);
                 if (r < 0) {
+                        log_warning_errno(errno, "SELinux getfilecon_raw on '%s' failed: %m (tclass=%s perm=%s)", path, tclass, permission);
                         r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get file context on %s.", path);
                         goto finish;
                 }
@@ -231,6 +232,7 @@ int mac_selinux_generic_access_check(
         } else {
                 r = getcon_raw(&fcon);
                 if (r < 0) {
+                        log_warning_errno(errno, "SELinux getcon_raw failed: %m (tclass=%s perm=%s)", tclass, permission);
                         r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get current context.");
                         goto finish;
                 }