Skip to content

Commit

Permalink
Fix selinux_enabled function
Browse files Browse the repository at this point in the history
Prior to this fix the selinux_enabled function would always return true,
even if selinux was set to disabled or permissive.

Signed-off-by: ckyrouac <[email protected]>
  • Loading branch information
ckyrouac committed Feb 13, 2024
1 parent 406b905 commit f5e6a93
Showing 1 changed file with 1 addition and 2 deletions.
3 changes: 1 addition & 2 deletions lib/src/lsm.rs
Original file line number Diff line number Diff line change
Expand Up @@ -24,8 +24,7 @@ const SELF_CURRENT: &str = "/proc/self/attr/current";

#[context("Querying selinux availability")]
pub(crate) fn selinux_enabled() -> Result<bool> {
let filesystems = std::fs::read_to_string("/proc/filesystems")?;
Ok(filesystems.contains("selinuxfs\n"))
Path::new("/proc/1/root/sys/fs/selinux/enforce").try_exists().map_err(Into::into)
}

/// Get the current process SELinux security context
Expand Down

0 comments on commit f5e6a93

Please sign in to comment.