Bruno Haible <[email protected]> writes: > Hi Collin, > >> 2026-11-10 Collin Funk <[email protected]> >> >> + selinux-at: Define functions that don't perform context translation. > > I had a hard time understanding what "context translation" means. The man > pages > don't say it. I suggest you add these URLs in comments: > > https://www.kernel.org/doc/man-pages/online/pages/man8/mcstransd.8.html > https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/using_selinux/using-multi-level-security-mls > https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/using_selinux/using-multi-category-security-mcs-for-data-confidentiality
Good idea. I ran into a similar issue with the lack of detail in the setfilecon, etc., man pages when trying to find out the difference between the raw and non-raw functions a while ago. I think I used some RHEL pages to figure it out, probably the ones you linked, but I forget. I pushed the attached v2 patch adding a note with those pages to the top of the header. Collin
>From dd5b313c3f640b76ea67994d0cc4f73bad178bac Mon Sep 17 00:00:00 2001 Message-ID: <dd5b313c3f640b76ea67994d0cc4f73bad178bac.1794427926.git.collin.fu...@gmail.com> From: Collin Funk <[email protected]> Date: Tue, 10 Nov 2026 20:25:15 -0800 Subject: [PATCH v2] selinux-at: Define functions that don't perform context translation. * lib/selinux-at.h (getfileconat_raw, lgetfileconat_raw) (setfileconat_raw, lsetfileconat_raw): Declare functions. * lib/selinux-at.c (getfileconat_raw, lgetfileconat_raw) (setfileconat_raw, lsetfileconat_raw): Define them using at-func.c. --- ChangeLog | 8 ++++++++ lib/selinux-at.c | 40 ++++++++++++++++++++++++++++++++++++++++ lib/selinux-at.h | 24 +++++++++++++++++++++++- 3 files changed, 71 insertions(+), 1 deletion(-) diff --git a/ChangeLog b/ChangeLog index 403ad72451..b19fd11383 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,11 @@ +2026-11-11 Collin Funk <[email protected]> + + selinux-at: Define functions that don't perform context translation. + * lib/selinux-at.h (getfileconat_raw, lgetfileconat_raw) + (setfileconat_raw, lsetfileconat_raw): Declare functions. + * lib/selinux-at.c (getfileconat_raw, lgetfileconat_raw) + (setfileconat_raw, lsetfileconat_raw): Define them using at-func.c. + 2026-11-10 Collin Funk <[email protected]> attribute: Fix optional size argument with access attributes. diff --git a/lib/selinux-at.c b/lib/selinux-at.c index 6544161dc6..91149ed5cd 100644 --- a/lib/selinux-at.c +++ b/lib/selinux-at.c @@ -40,6 +40,16 @@ #undef AT_FUNC_POST_FILE_PARAM_DECLS #undef AT_FUNC_POST_FILE_ARGS +#define AT_FUNC_NAME getfileconat_raw +#define AT_FUNC_F1 getfilecon_raw +#define AT_FUNC_POST_FILE_PARAM_DECLS , char **con +#define AT_FUNC_POST_FILE_ARGS , con +#include "at-func.c" +#undef AT_FUNC_NAME +#undef AT_FUNC_F1 +#undef AT_FUNC_POST_FILE_PARAM_DECLS +#undef AT_FUNC_POST_FILE_ARGS + #define AT_FUNC_NAME lgetfileconat #define AT_FUNC_F1 lgetfilecon #define AT_FUNC_POST_FILE_PARAM_DECLS , char **con @@ -50,6 +60,16 @@ #undef AT_FUNC_POST_FILE_PARAM_DECLS #undef AT_FUNC_POST_FILE_ARGS +#define AT_FUNC_NAME lgetfileconat_raw +#define AT_FUNC_F1 lgetfilecon_raw +#define AT_FUNC_POST_FILE_PARAM_DECLS , char **con +#define AT_FUNC_POST_FILE_ARGS , con +#include "at-func.c" +#undef AT_FUNC_NAME +#undef AT_FUNC_F1 +#undef AT_FUNC_POST_FILE_PARAM_DECLS +#undef AT_FUNC_POST_FILE_ARGS + #define AT_FUNC_NAME setfileconat #define AT_FUNC_F1 setfilecon #define AT_FUNC_POST_FILE_PARAM_DECLS , char const *con @@ -60,6 +80,16 @@ #undef AT_FUNC_POST_FILE_PARAM_DECLS #undef AT_FUNC_POST_FILE_ARGS +#define AT_FUNC_NAME setfileconat_raw +#define AT_FUNC_F1 setfilecon_raw +#define AT_FUNC_POST_FILE_PARAM_DECLS , char const *con +#define AT_FUNC_POST_FILE_ARGS , con +#include "at-func.c" +#undef AT_FUNC_NAME +#undef AT_FUNC_F1 +#undef AT_FUNC_POST_FILE_PARAM_DECLS +#undef AT_FUNC_POST_FILE_ARGS + #define AT_FUNC_NAME lsetfileconat #define AT_FUNC_F1 lsetfilecon #define AT_FUNC_POST_FILE_PARAM_DECLS , char const *con @@ -69,3 +99,13 @@ #undef AT_FUNC_F1 #undef AT_FUNC_POST_FILE_PARAM_DECLS #undef AT_FUNC_POST_FILE_ARGS + +#define AT_FUNC_NAME lsetfileconat_raw +#define AT_FUNC_F1 lsetfilecon_raw +#define AT_FUNC_POST_FILE_PARAM_DECLS , char const *con +#define AT_FUNC_POST_FILE_ARGS , con +#include "at-func.c" +#undef AT_FUNC_NAME +#undef AT_FUNC_F1 +#undef AT_FUNC_POST_FILE_PARAM_DECLS +#undef AT_FUNC_POST_FILE_ARGS diff --git a/lib/selinux-at.h b/lib/selinux-at.h index 0965d611ed..526cd7ff58 100644 --- a/lib/selinux-at.h +++ b/lib/selinux-at.h @@ -28,7 +28,14 @@ extern "C" { by first attempting getfilecon ("/proc/self/fd/DIR_FD/FILE", &c). Failing that, simulate it via save_cwd/fchdir/getfilecon/restore_cwd. If either the save_cwd or the restore_cwd fails (relatively unlikely), - then give a diagnostic and exit nonzero. */ + then give a diagnostic and exit nonzero. + + Functions with the suffix "_raw" do not perform context translation. + More information about context translation can be found on these pages: + <https://www.kernel.org/doc/man-pages/online/pages/man8/mcstransd.8.html> + <https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/using_selinux/using-multi-level-security-mls> + <https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/10/html/using_selinux/using-multi-category-security-mcs-for-data-confidentiality> + */ /* dir-fd-relative getfilecon. Set *CON to the SELinux security context of the file specified by DIR_FD and FILE and return the length of *CON. @@ -38,17 +45,29 @@ extern "C" { [*] with flags=0 here, with flags=AT_SYMLINK_NOFOLLOW for lgetfileconat */ int getfileconat (int dir_fd, char const *file, char **con); +/* The getfileconat_raw function is the same as getfileconat, except that + it does not perform context translation. */ +int getfileconat_raw (int dir_fd, char const *file, char **con); + /* dir-fd-relative lgetfilecon. This function is just like getfileconat, except when DIR_FD and FILE specify a symlink: lgetfileconat operates on the symlink, while getfileconat operates on the referent of the symlink. */ int lgetfileconat (int dir_fd, char const *file, char **con); +/* The lgetfileconat_raw function is the same as lgetfileconat, except that + it does not perform context translation. */ +int lgetfileconat_raw (int dir_fd, char const *file, char **con); + /* dir-fd-relative setfilecon. Set the SELinux security context of the file specified by DIR_FD and FILE to CON. DIR_FD and FILE are interpreted as for fstatat[*]. Upon success, return 0. Otherwise, return -1 and set errno. */ int setfileconat (int dir_fd, char const *file, char const *con); +/* The setfileconat_raw function is the same as setfileconat, except that + it does not perform context translation. */ +int setfileconat_raw (int dir_fd, char const *file, char const *con); + /* dir-fd-relative lsetfilecon. This function is just like setfileconat, except that rather than dereferencing a symlink, this function affects it. */ /* dir-fd-relative lsetfilecon. This function is just like setfileconat, @@ -56,6 +75,9 @@ int setfileconat (int dir_fd, char const *file, char const *con); the symlink, while setfileconat operates on the referent of the symlink. */ int lsetfileconat (int dir_fd, char const *file, char const *con); +/* The lsetfileconat_raw function is the same as lsetfileconat, except that + it does not perform context translation. */ +int lsetfileconat_raw (int dir_fd, char const *file, char const *con); #ifdef __cplusplus } -- 2.56.0
