Fix selinux_enabled function

Prior to this fix the selinux_enabled function would always return true, even if selinux was set to disabled or permissive. Signed-off-by: ckyrouac <[email protected]>
containers · Feb 13, 2024 · 3f72760 · 3f72760
1 parent 406b905
commit 3f72760
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/lib/src/lsm.rs b/lib/src/lsm.rs
@@ -24,8 +24,13 @@ const SELF_CURRENT: &str = "/proc/self/attr/current";
 
 #[context("Querying selinux availability")]
 pub(crate) fn selinux_enabled() -> Result<bool> {
-    let filesystems = std::fs::read_to_string("/proc/filesystems")?;
-    Ok(filesystems.contains("selinuxfs\n"))
+    let path = "/proc/1/root/sys/fs/selinux/enforce";
+    if Path::new(path).exists() {
+        let enabled = std::fs::read_to_string(path)?;
+        return Ok(enabled.eq("1"));
+    } else {
+        return Ok(false);
+    }
 }
 
 /// Get the current process SELinux security context