From 074b597dd904112b83d9cb1cfea016116aea1e14 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= Date: Wed, 18 Dec 2019 14:56:54 +0100 Subject: [PATCH 1/2] selinux-util: increase log severity `log_enforcing()` and `log_enforcing_errno()` are only used for important messages, which describe failures in enforced mode. They are guarded either by `!mac_selinux_use()` or `!label_hnd` checks, where the latter is itself guarded by the former. Only SELinux enabled systems print these logs. This helps to configure a system in permissive mode, without getting surprising failures when switching to enforced mode. --- src/basic/selinux-util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/basic/selinux-util.c b/src/basic/selinux-util.c index 2c6d407295b..1d209d03d56 100644 --- a/src/basic/selinux-util.c +++ b/src/basic/selinux-util.c @@ -37,8 +37,8 @@ DEFINE_TRIVIAL_CLEANUP_FUNC(context_t, context_free); static int cached_use = -1; static struct selabel_handle *label_hnd = NULL; -#define log_enforcing(...) log_full(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG, __VA_ARGS__) -#define log_enforcing_errno(r, ...) log_full_errno(security_getenforce() == 1 ? LOG_ERR : LOG_DEBUG, r, __VA_ARGS__) +#define log_enforcing(...) log_full(security_getenforce() == 1 ? LOG_ERR : LOG_WARNING, __VA_ARGS__) +#define log_enforcing_errno(r, ...) log_full_errno(security_getenforce() == 1 ? LOG_ERR : LOG_WARNING, r, __VA_ARGS__) #endif bool mac_selinux_use(void) { From 1648233dce34a7bc8d376ce551ce288db098e025 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Christian=20G=C3=B6ttsche?= Date: Wed, 18 Dec 2019 14:57:00 +0100 Subject: [PATCH 2/2] selinux-access: log warning on context acquisition failure Relevant when testing in permissive mode, where the function does not return a failure to the client. This helps to configure a system in permissive mode, without getting surprising failures when switching to enforced mode. --- src/core/selinux-access.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/core/selinux-access.c b/src/core/selinux-access.c index 9fd3099feab..4500e4452fa 100644 --- a/src/core/selinux-access.c +++ b/src/core/selinux-access.c @@ -223,6 +223,7 @@ int mac_selinux_generic_access_check( r = getfilecon_raw(path, &fcon); if (r < 0) { + log_warning_errno(errno, "SELinux getfilecon_raw on '%s' failed: %m (tclass=%s perm=%s)", path, tclass, permission); r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get file context on %s.", path); goto finish; } @@ -231,6 +232,7 @@ int mac_selinux_generic_access_check( } else { r = getcon_raw(&fcon); if (r < 0) { + log_warning_errno(errno, "SELinux getcon_raw failed: %m (tclass=%s perm=%s)", tclass, permission); r = sd_bus_error_setf(error, SD_BUS_ERROR_ACCESS_DENIED, "Failed to get current context."); goto finish; }