On Wed, 05.11.14 16:08, Przemyslaw Kedzierski (p.kedzier...@samsung.com) wrote:
> This patch adds a '--clone-smack-label' option to systemd-bus-proxyd.
> When dbus client connects to systemd-bus-proxyd through Unix domain socket
> and this option is enabled
> proxy takes client's smack label and sets for itself.
Why is this an option? Shouldn't this be the default behaviour?
> + if (arg_clone_smack_label) {
> +
> + if (!mac_smack_use()) {
> + log_warning("No SMACK found");
> + goto exit_clone_smack_label;
> + }
> +
> + if (!peersec) {
> + log_warning("Invalid SMACK label");
> + goto exit_clone_smack_label;
> + }
> +
> + r = have_effective_cap(CAP_MAC_ADMIN);
> + if (r <= 0) {
> + log_warning("No CAP_MAC_ADMIN capability");
> + goto exit_clone_smack_label;
> + }
Instead of checking the cap in userspace we should just try to update
the label right away and let the kernel decide whether it wants to
allow this or not...
> +
> @@ -33,3 +33,4 @@ int mac_smack_apply(const char *path, const char *label);
> int mac_smack_apply_fd(int fd, const char *label);
> int mac_smack_apply_ip_in_fd(int fd, const char *label);
> int mac_smack_apply_ip_out_fd(int fd, const char *label);
> +int mac_smack_set_current_label(char *label);
The selinux code has a code mac_selinux_get_our_label(). I figure we
should unify the naming scheme here...
I don't really like the word "current" in this context, since, well,
of course it's current, and we don't use the word "current" for any
other calls...
As a matter of fact I actually don't like the "our" bit in the
existing selinux call, since it's not clear why that's supposed to be
plural.
Maybe name the SMACK call:
int mac_smack_set_process_label(const char *label);
And then rename the the selinux call:
int mac_selinux_get_process_label(char **label);
(I'll make the selinux change, please just rename the SMACK call as
pointed out.)
Lennart
--
Lennart Poettering, Red Hat
_______________________________________________
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
http://lists.freedesktop.org/mailman/listinfo/systemd-devel
