dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-03 22:50:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #14778 from cgzones/split_selinux_logging

Browse Source 
Improve SELinux logging in permissive mode
This commit is contained in:
Yu Watanabe
2020-02-05 15:20:50 +09:00
committed by GitHub
parent ea9bc14cd0 1648233dce
commit fae403f1dc
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/basic/selinux-util.c
View File

@@ -37,8 +37,8 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(context_t, context_free);
static int cached_use = -1;
static struct selabel_handle *label_hnd = NULL;
#define log_enforcing(...) log_full(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG, __VA_ARGS__)
#define log_enforcing_errno(r, ...) log_full_errno(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG, r, __VA_ARGS__)
#define log_enforcing(...) log_full(security_getenforce() == 1 ? LOG_ERR : LOG_WARNING, __VA_ARGS__)
#define log_enforcing_errno(r, ...) log_full_errno(security_getenforce() == 1 ? LOG_ERR : LOG_WARNING, r, __VA_ARGS__)
#endif
bool mac_selinux_use(void) {

2
src/core/selinux-access.c
View File

@@ -223,6 +223,7 @@ int mac_selinux_generic_access_check(
r = getfilecon_raw(path, &fcon);
if (r < 0) {
log_warning_errno(errno, "SELinux getfilecon_raw on '%s' failed: %m (tclass=%s perm=%s)", path, tclass, permission);
r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get file context on %s.", path);
goto finish;
}
@@ -231,6 +232,7 @@ int mac_selinux_generic_access_check(
} else {
r = getcon_raw(&fcon);
if (r < 0) {
log_warning_errno(errno, "SELinux getcon_raw failed: %m (tclass=%s perm=%s)", tclass, permission);
r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get current context.");
goto finish;
}