Change group and Smack label on socket and service

Tef-simulator socket should have group connected with
tee.client privilege : priv_tee_client.
Also service process needs assigned additional label
System::TEF with socket using System IPIn label.

Change-Id: Ia5c85aaabdc221a84a8c47f8c5629b7491c7438c

diff --git a/packaging/tef-simulator.spec b/packaging/tef-simulator.spec
index 2171559..5f3eb17 100644 (file)
--- a/packaging/tef-simulator.spec
+++ b/packaging/tef-simulator.spec
@@ -40,8 +40,8 @@ Requires: tef-libteec
 %define build_data_dir %{buildroot}%{data_dir}
 %define build_unit_dir %{buildroot}%{_unitdir}
 
-%define smack_domain_name System
 %define tee_user_group_name priv_tee_client
+%define smack_domain_name System::TEF
 
 %description
 TEF Simulator provides a TrustZone simulated environment

diff --git a/systemd/tef-simulator.socket b/systemd/tef-simulator.socket
index bf0d590..ef10c25 100644 (file)
--- a/systemd/tef-simulator.socket
+++ b/systemd/tef-simulator.socket
@@ -1,7 +1,8 @@
 [Socket]
 ListenStream=/var/run/simdaemon
-SocketMode=0777
-SmackLabelIPIn=*
+SocketGroup=priv_tee_client
+SocketMode=0060
+SmackLabelIPIn=System
 SmackLabelIPOut=@
 
 [Socket]