From a3fee627074e030b4c32e0205818657381e5ae46 Mon Sep 17 00:00:00 2001 From: Michal Sekletar Date: Tue, 1 Apr 2025 10:38:14 +0200 Subject: [PATCH 1/2] core/service: ignore SELinux label errors in permissive mode Return -ENODATA instead of the raw error when SELinux is permissive, so the caller falls back to the default label. This is needed to allow relabeling service to start on systems where file contexts maybe invalid. --- src/core/service.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/src/core/service.c b/src/core/service.c index 012336b47a0..8950eed5396 100644 --- a/src/core/service.c +++ b/src/core/service.c @@ -6307,9 +6307,13 @@ int service_determine_exec_selinux_label(Service *s, char **ret) { log_unit_debug_errno(UNIT(s), r, "Can't read SELinux label off binary '%s', due to privileges, ignoring.", path); return -ENODATA; } - if (r < 0) - return log_unit_debug_errno(UNIT(s), r, "Failed to read SELinux label off binary '%s': %m", path); + if (r < 0) { + if (mac_selinux_enforcing()) + return log_unit_debug_errno(UNIT(s), r, "Failed to read SELinux label off binary '%s': %m", path); + log_unit_debug_errno(UNIT(s), r, "Failed to read SELinux label off binary '%s', SELinux in permissive mode, ignoring: %m", path); + return -ENODATA; + } return 0; } From 3abe380d042ed11262606ddedb976be0a11b4a5e Mon Sep 17 00:00:00 2001 From: Yu Watanabe Date: Fri, 31 Jul 2026 11:25:24 +0900 Subject: [PATCH 2/2] core/service: append the original error cause in the debugging logs --- src/core/service.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/core/service.c b/src/core/service.c index 8950eed5396..1c8460b1364 100644 --- a/src/core/service.c +++ b/src/core/service.c @@ -6294,17 +6294,17 @@ int service_determine_exec_selinux_label(Service *s, char **ret) { else r = chase(c->path, s->exec_context.root_directory, CHASE_PREFIX_ROOT|CHASE_TRIGGER_AUTOFS, &path, NULL); if (r < 0) { - log_unit_debug_errno(UNIT(s), r, "Failed to resolve service binary '%s', ignoring.", c->path); + log_unit_debug_errno(UNIT(s), r, "Failed to resolve service binary '%s', ignoring: %m", c->path); return -ENODATA; } r = mac_selinux_get_create_label_from_exe(path, ret); if (ERRNO_IS_NEG_NOT_SUPPORTED(r)) { - log_unit_debug_errno(UNIT(s), r, "Reading SELinux label off binary '%s' is not supported, ignoring.", path); + log_unit_debug_errno(UNIT(s), r, "Reading SELinux label off binary '%s' is not supported, ignoring: %m", path); return -ENODATA; } if (ERRNO_IS_NEG_PRIVILEGE(r)) { - log_unit_debug_errno(UNIT(s), r, "Can't read SELinux label off binary '%s', due to privileges, ignoring.", path); + log_unit_debug_errno(UNIT(s), r, "Can't read SELinux label off binary '%s', due to privileges, ignoring: %m", path); return -ENODATA; } if (r < 0) {