SELinuxContextFromNet=
Takes a boolean argument. When true, systemd will attempt to
figure out the SELinux label used for the instantiated
service from the information handed by the peer over the
network. Note that only the security level is used from the
information provided by the peer. Other parts of the
resulting SELinux context originate from either the target
binary that is effectively triggered by socket unit or from
the value of the SELinuxContext= option. This configuration
option only affects sockets with Accept= mode set to "yes".
Also note that this option is useful only when MLS/MCS
SELinux policy is deployed. Defaults to "false".
Add:
One or more of the associated service files
StandardInput/StandardOutput/StandardError options should be set to
socket for this option to work.
>From execute.c:
if (context->std_input == EXEC_INPUT_SOCKET ||
context->std_output == EXEC_OUTPUT_SOCKET ||
context->std_error == EXEC_OUTPUT_SOCKET) {
if (params->n_fds != 1) {
log_unit_error(params->unit_id, "Got more than
one socket.");
return -EINVAL;
}
socket_fd = params->fds[0];
} else {
socket_fd = -1;
fds = params->fds;
n_fds = params->n_fds;
}
When socket_fd is -1 the SELinux context is not computed. Text like
this would have saved a lot of head scratching and code reading :(
Ted
_______________________________________________
systemd-devel mailing list
systemd-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/systemd-devel
