Revert "Revert "Depend on SmackProcessLabel= to set correct label instead of pam""

This reverts commit 31e9e250b73d3f9190a579b262af8bab1384727f.

The problem was in security-config package that removed the service
file during image creation stage.  The removal was caused by change
(SmackProcessLabel=) that didn't match its own "saved" policy.

Change-Id: I4702acf22690e91759edc2da77a6ac46f32fd188

diff --git a/data/tlm-default-login b/data/tlm-default-login
index 8138015..53d6173 100644 (file)
--- a/data/tlm-default-login
+++ b/data/tlm-default-login
@@ -10,4 +10,3 @@ session         required        pam_systemd.so
 session         required        pam_loginuid.so
 session         required        pam_namespace.so
 session         optional        pam_keyinit.so force revoke
-session         required        pam_smack.so

diff --git a/data/tlm-login b/data/tlm-login
index 0bc8045..c921924 100644 (file)
--- a/data/tlm-login
+++ b/data/tlm-login
@@ -11,4 +11,3 @@ session         required        pam_systemd.so
 session         required        pam_loginuid.so
 session         required        pam_namespace.so
 session         optional        pam_keyinit.so force revoke
-session         required        pam_smack.so
\ No newline at end of file

diff --git a/data/tlm-system-login b/data/tlm-system-login
index 2f7b518..8e247bc 100644 (file)
--- a/data/tlm-system-login
+++ b/data/tlm-system-login
@@ -8,4 +8,3 @@ session         include         system-auth
 session         required        pam_loginuid.so
 session         required        pam_namespace.so
 session         optional        pam_keyinit.so force revoke
-session         required        pam_smack.so

diff --git a/data/tlm.service b/data/tlm.service
index 94c5fe0..9001d33 100644 (file)
--- a/data/tlm.service
+++ b/data/tlm.service
@@ -4,7 +4,7 @@ After=systemd-user-sessions.service systemd-logind.service
 Requires=dbus.socket
 
 [Service]
-SmackProcessLabel=System
+SmackProcessLabel=User
 ExecStart=/usr/bin/tlm
 CapabilityBoundingSet=~CAP_MAC_ADMIN
 CapabilityBoundingSet=~CAP_MAC_OVERRIDE