If I understand the patch description correctly, we are checking for smack before /sys is mounted, i.e. before our test for smack actually works. This is not good, because it means that something depends on smack being enabled, and we'd be taking the wrong branch even with your patch, and only afterwards taking the proper branch. Is this patch trying to fix some concrete problem? Can you describe the behaviour you're seeing more closely?

I'd prefer if we added a retest_smack() call akin to the existing retest_selinux() we already have, that simply resets the cached bool after enabling smack.

When systemd do is first "use_smack" ?

-At the begining of systemd (main at src/core/main.c), mount_setup_early is execute.

-mount_setup_early mount each entry of the "mount_table" thow function mount_one.

-mount_one use mkdir_p_label.

-mkdir_p_label use label_mkdir.

-label_mkdir use use_smack.

So At the first mount of the first entry of "mount_table" ("/proc"), the return value of use_smack is cached.

Add a funct "retest_smack()" seems to be heavy to me.

-------------------------------------------------------------------
For me, a cleaner way is to mount "/sys" first (before "/proc").

static const MountPoint mount_table[] = {
        { "sysfs",      "/sys",                      "sysfs",      NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
          NULL,       MNT_FATAL|MNT_IN_CONTAINER },
        { "proc",       "/proc",                     "proc",       NULL, MS_NOSUID|MS_NOEXEC|MS_NODEV,
          NULL,       MNT_FATAL|MNT_IN_CONTAINER },
...

Created attachment 97732 [details]
new patch submit

mount /sys before /proc to avoid cache corrupt.

Currently, I'm porting Tizen to yocto, and one of the first steep is to activate smack security.

 Currently, I'm test the first image with qemu.

OK, looks OK. Let's hope that this won't turn into a game of whack-a-mole where some things need /proc first, and others /sys...

Applied. Thanks.