core/exec: Restore SmackProcessLabel setting #7378
Conversation
|
LGTM, but systemd does not take Change-Id and Signe-off-by. Remove them. |
|
Done: I removed the 2 lines and rebased on master |
|
I am not sure we should move more than the SMACK stuff. I mean, the SMACK stuff broke because we didn't really understand the effects of moving it down in the first place because SMACK is not tested regularly upstream (and isn't part of the CI either). Now, the other MACs aren't tested like that either, hence we should learn from that and not touch them for now, otherwise we might break them too... Hence, let#s leave Selinux/AA stuff where it is, and only move SMACK up |
poettering
added
the
reviewed/needs-rework 🔨
Smack LSM needs the capability CAP_MAC_ADMIN to allow setting of the current Smack exec label. Consequently, dropping capabilities must be done after changing the current exec label. This is only related to Smack LSM. But for clarity and regularity, all setting of security context moved before dropping capabilities. See Issue 7108
keszybz
added
good-to-merge/waiting-for-ci 👍
|
I'll restart s390x. |
|
The below snip from service file was working earlier (Systemd229), recently moved to systemd234 . Now it throws error "failed to set SMACK process label: Operation not permitted". Is this the root cause ? PermissionsStartOnly=true |
|
@KumarShrawan I guess yes and this patch is supposed to fix the error feedback welcome obviously |
Smack LSM needs the capability CAP_MAC_ADMIN to allow
setting of the current Smack exec label. Consequently,
dropping capabilities must be done after changing the
current exec label.
This is only related to Smack LSM. But for clarity and
regularity, all setting of security context moved before
dropping capabilities.
See Issue #7108