systemd - selinux: relax error handling in permissive mode

systemd - selinux: relax error handling in permissive mode

[Petr Lautrbach]

Hi,

there's a pull request on systemd [1] which tries to fix systemd so it
does not fail to run services in permissive mode when the filesystem is
mislabeled, see the commit message bellow. If you are interested, please
take a look

[1] https://github.com/systemd/systemd/pull/36929

@msekletar selinux: relax error handling in permissive mode

Error returned from security_compute_create_raw() means that kernel
couldn't compute target context. Very likely because file context is not
known to the policy, i.e. security.selinux xattr contains some garbage
value and we are running in permissive mode, otherwise returned context
would be "unlabeled_t" instead of getting an error.

mac_selinux_get_create_label_from_exe() is used to figure out create
label for socket units and we fail to start the socket if we can't
figure out that label.

However, it may be necessary to start some sockets in order to get to
the point when we launch the service that relabels (in permissive mode)
the entire filesystem and reboots.