Pádraig Brady <[email protected]> writes:
> Yes good observations.
> However this would couple the implementation to /proc unnecessarily I think.
> Also isn't the libselinux /proc usage observation only the fast path.
> So it seems better to use the more abstract interfaces IMHO.
> I've attached code for what I was thinking.
Looks good to me. I pushed that with you listed as co-author [1]. I made
two tiny changes to your patch, though.
> @@ -145,22 +146,52 @@ change_file_context (char const *file_full_name, int
> fd, char const *file,
[...]
> +#ifdef O_PATH
> + /* Pin the file while deriving and applying a partial context.
> + O_PATH also works for symlinks and unreadable files. */
> + file_fd = openat (fd, file,
> + (O_PATH | O_CLOEXEC
> + | (affect_symlink_referent ? 0 : O_NOFOLLOW)));
I changed FD to DIRFD, since I associate FD with the file itself.
I also removed O_CLOEXEC. It is harmless, but we only use it in 'sort'
where it is needed:
$ git grep -Fl 'O_CLOEXEC'
src/sort.c
I also changed the tests slightly to block the xattr system calls in the
partial context case. That should make them pass on systems with older
libselinux versions.
Thanks for the help,
Collin
[1]
https://github.com/coreutils/coreutils/commit/e018661bd90a718689d97472f9c231d8bd669d47
