Smack: add the execute lable to ldconfig

Since Tizen platform use the 3-domain Smack, even the init process (i.e.
systemd) has the specific Smack label called 'system'. When init updates
the ld.so.cache file, ld.so.cache file is labeled as 'system' because
ldconfig is executed by the init. However, app application need to
access that cache file to map the shared object but it doesn't. This
patch adds the execute label as "_" to ldconfig so that all files
created by ldconfig have the "_" label.

Change-Id: Ib58d26e1409f83685c5f4877bdf11696b26e7ca3
Signed-off-by: Sangjung Woo <sangjung.woo@samsung.com>

diff --git a/packaging/glibc.manifest b/packaging/glibc.manifest
index 017d22d..14b2780 100644 (file)
--- a/packaging/glibc.manifest
+++ b/packaging/glibc.manifest
@@ -2,4 +2,7 @@
  <request>
     <domain name="_"/>
  </request>
+ <assign>
+    <filesystem path="/sbin/ldconfig" exec_label="_" />
+ </assign>
 </manifest>