These functions should allow me to resolve OSS scanner bug ANT-2026-XB6SGSHL in coreutils.
-- 8< -- * lib/selinux-at.h (getfileconat_raw, lgetfileconat_raw) (setfileconat_raw, lsetfileconat_raw): Declare functions. * lib/selinux-at.c (getfileconat_raw, lgetfileconat_raw) (setfileconat_raw, lsetfileconat_raw): Define them using at-func.c. --- ChangeLog | 6 ++++++ lib/selinux-at.c | 40 ++++++++++++++++++++++++++++++++++++++++ lib/selinux-at.h | 15 +++++++++++++++ 3 files changed, 61 insertions(+) diff --git a/ChangeLog b/ChangeLog index 403ad72451..9ae52e2672 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,5 +1,11 @@ 2026-11-10 Collin Funk <[email protected]> + selinux-at: Define functions that don't perform context translation. + * lib/selinux-at.h (getfileconat_raw, lgetfileconat_raw) + (setfileconat_raw, lsetfileconat_raw): Declare functions. + * lib/selinux-at.c (getfileconat_raw, lgetfileconat_raw) + (setfileconat_raw, lsetfileconat_raw): Define them using at-func.c. + attribute: Fix optional size argument with access attributes. Reported by Basil L. Contovounesios <[email protected]> in: <https://lists.gnu.org/r/bug-gnulib/2026-11/msg00046.html> diff --git a/lib/selinux-at.c b/lib/selinux-at.c index 6544161dc6..91149ed5cd 100644 --- a/lib/selinux-at.c +++ b/lib/selinux-at.c @@ -40,6 +40,16 @@ #undef AT_FUNC_POST_FILE_PARAM_DECLS #undef AT_FUNC_POST_FILE_ARGS +#define AT_FUNC_NAME getfileconat_raw +#define AT_FUNC_F1 getfilecon_raw +#define AT_FUNC_POST_FILE_PARAM_DECLS , char **con +#define AT_FUNC_POST_FILE_ARGS , con +#include "at-func.c" +#undef AT_FUNC_NAME +#undef AT_FUNC_F1 +#undef AT_FUNC_POST_FILE_PARAM_DECLS +#undef AT_FUNC_POST_FILE_ARGS + #define AT_FUNC_NAME lgetfileconat #define AT_FUNC_F1 lgetfilecon #define AT_FUNC_POST_FILE_PARAM_DECLS , char **con @@ -50,6 +60,16 @@ #undef AT_FUNC_POST_FILE_PARAM_DECLS #undef AT_FUNC_POST_FILE_ARGS +#define AT_FUNC_NAME lgetfileconat_raw +#define AT_FUNC_F1 lgetfilecon_raw +#define AT_FUNC_POST_FILE_PARAM_DECLS , char **con +#define AT_FUNC_POST_FILE_ARGS , con +#include "at-func.c" +#undef AT_FUNC_NAME +#undef AT_FUNC_F1 +#undef AT_FUNC_POST_FILE_PARAM_DECLS +#undef AT_FUNC_POST_FILE_ARGS + #define AT_FUNC_NAME setfileconat #define AT_FUNC_F1 setfilecon #define AT_FUNC_POST_FILE_PARAM_DECLS , char const *con @@ -60,6 +80,16 @@ #undef AT_FUNC_POST_FILE_PARAM_DECLS #undef AT_FUNC_POST_FILE_ARGS +#define AT_FUNC_NAME setfileconat_raw +#define AT_FUNC_F1 setfilecon_raw +#define AT_FUNC_POST_FILE_PARAM_DECLS , char const *con +#define AT_FUNC_POST_FILE_ARGS , con +#include "at-func.c" +#undef AT_FUNC_NAME +#undef AT_FUNC_F1 +#undef AT_FUNC_POST_FILE_PARAM_DECLS +#undef AT_FUNC_POST_FILE_ARGS + #define AT_FUNC_NAME lsetfileconat #define AT_FUNC_F1 lsetfilecon #define AT_FUNC_POST_FILE_PARAM_DECLS , char const *con @@ -69,3 +99,13 @@ #undef AT_FUNC_F1 #undef AT_FUNC_POST_FILE_PARAM_DECLS #undef AT_FUNC_POST_FILE_ARGS + +#define AT_FUNC_NAME lsetfileconat_raw +#define AT_FUNC_F1 lsetfilecon_raw +#define AT_FUNC_POST_FILE_PARAM_DECLS , char const *con +#define AT_FUNC_POST_FILE_ARGS , con +#include "at-func.c" +#undef AT_FUNC_NAME +#undef AT_FUNC_F1 +#undef AT_FUNC_POST_FILE_PARAM_DECLS +#undef AT_FUNC_POST_FILE_ARGS diff --git a/lib/selinux-at.h b/lib/selinux-at.h index 0965d611ed..3d72fa4606 100644 --- a/lib/selinux-at.h +++ b/lib/selinux-at.h @@ -38,17 +38,29 @@ extern "C" { [*] with flags=0 here, with flags=AT_SYMLINK_NOFOLLOW for lgetfileconat */ int getfileconat (int dir_fd, char const *file, char **con); +/* The getfileconat_raw function is the same as getfileconat, except that + it does not perform context translation. */ +int getfileconat_raw (int dir_fd, char const *file, char **con); + /* dir-fd-relative lgetfilecon. This function is just like getfileconat, except when DIR_FD and FILE specify a symlink: lgetfileconat operates on the symlink, while getfileconat operates on the referent of the symlink. */ int lgetfileconat (int dir_fd, char const *file, char **con); +/* The lgetfileconat_raw function is the same as lgetfileconat, except that + it does not perform context translation. */ +int lgetfileconat_raw (int dir_fd, char const *file, char **con); + /* dir-fd-relative setfilecon. Set the SELinux security context of the file specified by DIR_FD and FILE to CON. DIR_FD and FILE are interpreted as for fstatat[*]. Upon success, return 0. Otherwise, return -1 and set errno. */ int setfileconat (int dir_fd, char const *file, char const *con); +/* The setfileconat_raw function is the same as setfileconat, except that + it does not perform context translation. */ +int setfileconat_raw (int dir_fd, char const *file, char const *con); + /* dir-fd-relative lsetfilecon. This function is just like setfileconat, except that rather than dereferencing a symlink, this function affects it. */ /* dir-fd-relative lsetfilecon. This function is just like setfileconat, @@ -56,6 +68,9 @@ int setfileconat (int dir_fd, char const *file, char const *con); the symlink, while setfileconat operates on the referent of the symlink. */ int lsetfileconat (int dir_fd, char const *file, char const *con); +/* The lsetfileconat_raw function is the same as lsetfileconat, except that + it does not perform context translation. */ +int lsetfileconat_raw (int dir_fd, char const *file, char const *con); #ifdef __cplusplus } -- 2.56.0
