[PATCH] libselinux: Document thread caveat for security_compute_av.3

[PATCH] libselinux: Document thread caveat for security_compute_av.3

[Thiébaud Weksteen]

Move a similar paragraph for selinux_status_open.3 to a CAVEATS section.

See discussion at https://github.com/SELinuxProject/selinux/issues/287

Signed-off-by: Thiébaud Weksteen <tweek@google.com>
---
 libselinux/man/man3/security_compute_av.3 | 5 +++++
 libselinux/man/man3/selinux_status_open.3 | 9 +++++----
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/libselinux/man/man3/security_compute_av.3 b/libselinux/man/man3/security_compute_av.3
index 6c82eca5..af8797b5 100644
--- a/libselinux/man/man3/security_compute_av.3
+++ b/libselinux/man/man3/security_compute_av.3
@@ -181,6 +181,11 @@ function.
 .SH "RETURN VALUE"
 Returns zero on success or \-1 on error.
 .
+.SH "CAVEATS"
+.sp
+These functions are not thread-safe, you have to protect them from
+concurrent calls using exclusive locks when multiple threads are executing.
+.
 .SH "SEE ALSO"
 .BR string_to_security_class (3),
 .BR string_to_av_perm (3),
diff --git a/libselinux/man/man3/selinux_status_open.3 b/libselinux/man/man3/selinux_status_open.3
index 5c9da2f6..5592487f 100644
--- a/libselinux/man/man3/selinux_status_open.3
+++ b/libselinux/man/man3/selinux_status_open.3
@@ -82,10 +82,6 @@ Thus, don't use this value to know actual times of policy reloaded.
 .BR selinux_status_deny_unknown ()
 returns 0 if SELinux treats policy queries on undefined object classes or
 permissions as being allowed, 1 if such queries are denied, or \-1 on error.
-.sp
-Also note that these interfaces are not thread-safe, so you have to protect
-them from concurrent calls using exclusive locks when multiple threads are
-performing.
 .
 .SH "RETURN VALUE"
 .BR selinux_status_open ()
@@ -96,6 +92,11 @@ On error, \-1 shall be returned.
 Any other functions with a return value shall return its characteristic
 value as described above, or \-1 on errors.
 .
+.SH "CAVEATS"
+.sp
+These functions are not thread-safe, you have to protect them from
+concurrent calls using exclusive locks when multiple threads are executing.
+.
 .SH "SEE ALSO"
 .ad l
 .nh
-- 
2.50.0.rc0.642.g800a2b2222-goog

Re: [PATCH] libselinux: Document thread caveat for security_compute_av.3

[James Carter]

On Wed, Jun 11, 2025 at 3:04 AM Thiébaud Weksteen <tweek@google.com> wrote:
>
> Move a similar paragraph for selinux_status_open.3 to a CAVEATS section.
>
> See discussion at https://github.com/SELinuxProject/selinux/issues/287
>
> Signed-off-by: Thiébaud Weksteen <tweek@google.com>

Acked-by: James Carter <jwcart2@gmail.com>

> ---
>  libselinux/man/man3/security_compute_av.3 | 5 +++++
>  libselinux/man/man3/selinux_status_open.3 | 9 +++++----
>  2 files changed, 10 insertions(+), 4 deletions(-)
>
> diff --git a/libselinux/man/man3/security_compute_av.3 b/libselinux/man/man3/security_compute_av.3
> index 6c82eca5..af8797b5 100644
> --- a/libselinux/man/man3/security_compute_av.3
> +++ b/libselinux/man/man3/security_compute_av.3
> @@ -181,6 +181,11 @@ function.
>  .SH "RETURN VALUE"
>  Returns zero on success or \-1 on error.
>  .
> +.SH "CAVEATS"
> +.sp
> +These functions are not thread-safe, you have to protect them from
> +concurrent calls using exclusive locks when multiple threads are executing.
> +.
>  .SH "SEE ALSO"
>  .BR string_to_security_class (3),
>  .BR string_to_av_perm (3),
> diff --git a/libselinux/man/man3/selinux_status_open.3 b/libselinux/man/man3/selinux_status_open.3
> index 5c9da2f6..5592487f 100644
> --- a/libselinux/man/man3/selinux_status_open.3
> +++ b/libselinux/man/man3/selinux_status_open.3
> @@ -82,10 +82,6 @@ Thus, don't use this value to know actual times of policy reloaded.
>  .BR selinux_status_deny_unknown ()
>  returns 0 if SELinux treats policy queries on undefined object classes or
>  permissions as being allowed, 1 if such queries are denied, or \-1 on error.
> -.sp
> -Also note that these interfaces are not thread-safe, so you have to protect
> -them from concurrent calls using exclusive locks when multiple threads are
> -performing.
>  .
>  .SH "RETURN VALUE"
>  .BR selinux_status_open ()
> @@ -96,6 +92,11 @@ On error, \-1 shall be returned.
>  Any other functions with a return value shall return its characteristic
>  value as described above, or \-1 on errors.
>  .
> +.SH "CAVEATS"
> +.sp
> +These functions are not thread-safe, you have to protect them from
> +concurrent calls using exclusive locks when multiple threads are executing.
> +.
>  .SH "SEE ALSO"
>  .ad l
>  .nh
> --
> 2.50.0.rc0.642.g800a2b2222-goog
>
>

Re: [PATCH] libselinux: Document thread caveat for security_compute_av.3

[James Carter]

On Tue, Jun 24, 2025 at 11:10 AM James Carter <jwcart2@gmail.com> wrote:
>
> On Wed, Jun 11, 2025 at 3:04 AM Thiébaud Weksteen <tweek@google.com> wrote:
> >
> > Move a similar paragraph for selinux_status_open.3 to a CAVEATS section.
> >
> > See discussion at https://github.com/SELinuxProject/selinux/issues/287
> >
> > Signed-off-by: Thiébaud Weksteen <tweek@google.com>
>
> Acked-by: James Carter <jwcart2@gmail.com>

Merged.
Thanks,
Jim

>
> > ---
> >  libselinux/man/man3/security_compute_av.3 | 5 +++++
> >  libselinux/man/man3/selinux_status_open.3 | 9 +++++----
> >  2 files changed, 10 insertions(+), 4 deletions(-)
> >
> > diff --git a/libselinux/man/man3/security_compute_av.3 b/libselinux/man/man3/security_compute_av.3
> > index 6c82eca5..af8797b5 100644
> > --- a/libselinux/man/man3/security_compute_av.3
> > +++ b/libselinux/man/man3/security_compute_av.3
> > @@ -181,6 +181,11 @@ function.
> >  .SH "RETURN VALUE"
> >  Returns zero on success or \-1 on error.
> >  .
> > +.SH "CAVEATS"
> > +.sp
> > +These functions are not thread-safe, you have to protect them from
> > +concurrent calls using exclusive locks when multiple threads are executing.
> > +.
> >  .SH "SEE ALSO"
> >  .BR string_to_security_class (3),
> >  .BR string_to_av_perm (3),
> > diff --git a/libselinux/man/man3/selinux_status_open.3 b/libselinux/man/man3/selinux_status_open.3
> > index 5c9da2f6..5592487f 100644
> > --- a/libselinux/man/man3/selinux_status_open.3
> > +++ b/libselinux/man/man3/selinux_status_open.3
> > @@ -82,10 +82,6 @@ Thus, don't use this value to know actual times of policy reloaded.
> >  .BR selinux_status_deny_unknown ()
> >  returns 0 if SELinux treats policy queries on undefined object classes or
> >  permissions as being allowed, 1 if such queries are denied, or \-1 on error.
> > -.sp
> > -Also note that these interfaces are not thread-safe, so you have to protect
> > -them from concurrent calls using exclusive locks when multiple threads are
> > -performing.
> >  .
> >  .SH "RETURN VALUE"
> >  .BR selinux_status_open ()
> > @@ -96,6 +92,11 @@ On error, \-1 shall be returned.
> >  Any other functions with a return value shall return its characteristic
> >  value as described above, or \-1 on errors.
> >  .
> > +.SH "CAVEATS"
> > +.sp
> > +These functions are not thread-safe, you have to protect them from
> > +concurrent calls using exclusive locks when multiple threads are executing.
> > +.
> >  .SH "SEE ALSO"
> >  .ad l
> >  .nh
> > --
> > 2.50.0.rc0.642.g800a2b2222-goog
> >
> >