mirror of
https://gitlab.com/buildroot.org/buildroot.git
synced 2026-09-09 16:01:54 -09:00
package/audit/S02auditd: fix SELinux label issues
"mkdir -Z" tries to create the directory with the default type context
and does not accept any parameter, leading to mkdir creating a
directory by the name of "system_u:object_r:auditd_log_t" (or failing
to, with a read-only rootfs). Use "--context=" instead to specify the
context.
Letting start-stop-daemon create the auditd PID file leads to an
incorrect label, with type "initrc_runtime_t" instead of
"auditd_runtime_t", which would prevent auditd from writing or
deleting it. Auditd manages its own PID file and daemonizes by
default, so simply drop the --background and --make-pidfile options
from start-stop-daemon.
Signed-off-by: Fiona Klute <fiona.klute@gmx.de>
Signed-off-by: Julien Olivain <ju.o@free.fr>
(cherry picked from commit 3fdce24647)
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
committed by
Arnout Vandecappelle
parent
10af6326d8
commit
b80d90654a
@@ -18,13 +18,13 @@ start(){
|
||||
# the directory with SELinux permissions if possible
|
||||
if command -v selabel_lookup >/dev/null 2>&1; then
|
||||
audit_log_selable="$(selabel_lookup -b file -k /var/log/audit | cut -d ' ' -f 3)"
|
||||
mkdir -p /var/log/audit -Z "${audit_log_selable}"
|
||||
mkdir -p --context="${audit_log_selable}" /var/log/audit
|
||||
else
|
||||
mkdir -p /var/log/audit
|
||||
fi
|
||||
|
||||
start-stop-daemon --start --background --make-pidfile \
|
||||
--pidfile "${PIDFILE}" --exec "/usr/sbin/${DAEMON}"
|
||||
start-stop-daemon --start --pidfile "${PIDFILE}" \
|
||||
--exec "/usr/sbin/${DAEMON}"
|
||||
status=$?
|
||||
if [ "${status}" -eq 0 ]; then
|
||||
# Load the default rules
|
||||
|
||||
Reference in New Issue
Block a user