meta-app-framework/recipes-core/systemd/systemd/0001-Switch-Smack-label-earlier.patch

   1 From 6cc74075797edb6f698cb7f312bb1c3d8cc6cb28 Mon Sep 17 00:00:00 2001
   2 From: =?UTF-8?q?Jos=C3=A9=20Bollo?= <jose.bollo@iot.bzh>
   3 Date: Thu, 12 Oct 2017 17:17:56 +0200
   4 Subject: [PATCH] Switch Smack label earlier
   5 MIME-Version: 1.0
   6 Content-Type: text/plain; charset=UTF-8
   7 Content-Transfer-Encoding: 8bit
   8
   9 Switching label after removing capability isn't
  10 possible.
  11
  12 Change-Id: Ib7dac8f071f36119520ed3205d743c1e3df3cd5e
  13 Signed-off-by: José Bollo <jose.bollo@iot.bzh>
  14 ---
  15  src/core/execute.c | 14 +++++++-------
  16  1 file changed, 7 insertions(+), 7 deletions(-)
  17
  18 diff --git a/src/core/execute.c b/src/core/execute.c
  19 index d72e5bf08..0abffd569 100644
  20 --- a/src/core/execute.c
  21 +++ b/src/core/execute.c
  22 @@ -2707,6 +2707,13 @@ static int exec_child(
  23                          }
  24                  }
  25
  26 +                r = setup_smack(context, command);
  27 +                if (r < 0) {
  28 +                        *exit_status = EXIT_SMACK_PROCESS_LABEL;
  29 +                        *error_message = strdup("Failed to set SMACK process label");
  30 +                        return r;
  31 +                }
  32 +
  33                  if (!cap_test_all(context->capability_bounding_set)) {
  34                          r = capability_bounding_set_drop(context->capability_bounding_set, false);
  35                          if (r < 0) {
  36 @@ -2775,13 +2782,6 @@ static int exec_child(
  37                  }
  38  #endif
  39
  40 -                r = setup_smack(context, command);
  41 -                if (r < 0) {
  42 -                        *exit_status = EXIT_SMACK_PROCESS_LABEL;
  43 -                        *error_message = strdup("Failed to set SMACK process label");
  44 -                        return r;
  45 -                }
  46 -
  47  #ifdef HAVE_APPARMOR
  48                  if (context->apparmor_profile && mac_apparmor_use()) {
  49                          r = aa_change_onexec(context->apparmor_profile);
  50 --
  51 2.14.3
  52