Re: [PATCH v3] Add support for UTF-8 in file context labels

[Petr Lautrbach <lautrbach@redhat.com>]

Stephen Smalley <stephen.smalley.work@gmail.com> writes:

> On Thu, Sep 3, 2026 at 12:00 PM Petr Lautrbach <lautrbach@redhat.com> wrote:
>>
>> - libselinux to be able to read UTF-8 spec entries
>> - libselinux to compile regexes with UTF strings
>> - initialize locales in setfiles, sefcontext_compile, semodule
>> - semanage_exec_prog to execute external programs with LC_CTYPE set to
>> the current environment
>> - disable UTF-8 support build time using DISABLE_UTF=y environment
>> variable
>>
>> Fixes:
>>     # cat unicode.cil
>>     (filecon "/opt/žluťoučký(/.*)?" any (system_u object_r user_home_t ((s0) (s0))))
>>
>>     # semodule -i unicode.cil
>>     /sbin/setfiles: /var/lib/selinux/final/targeted/contexts/files/file_contexts:  line 2145 error due to: Non-ASCII characters found
>>     /sbin/setfiles: /var/lib/selinux/final/targeted/contexts/files/file_contexts:  line 2145 error due to: Non-ASCII characters found
>>     /var/lib/selinux/final/targeted/contexts/files/file_contexts: Invalid argument
>>     libsemanage.semanage_validate_and_compile_fcontexts: setfiles returned error code 1.
>>     semodule:  Failed!
>>
>>     # semanage fcontext --add -t user_home_t "/opt/žluťoučký(/.*)?"
>>     /sbin/setfiles: /var/lib/selinux/final/targeted/contexts/files/file_contexts.local:  line 4 error due to: Non-ASCII characters found
>>     /sbin/setfiles: /var/lib/selinux/final/targeted/contexts/files/file_contexts.local:  line 4 error due to: Non-ASCII characters found
>>     /var/lib/selinux/final/targeted/contexts/files/file_contexts: Invalid argument
>>     libsemanage.semanage_validate_and_compile_fcontexts: setfiles returned error code 1.
>>     OSError: Error
>>
>> Signed-off-by: Petr Lautrbach <lautrbach@redhat.com>
>> ---
>
>> diff --git a/libselinux/src/regex.c b/libselinux/src/regex.c
>> index d6b5bf0252ba..f632a87275d4 100644
>> --- a/libselinux/src/regex.c
>> +++ b/libselinux/src/regex.c
>> @@ -96,7 +96,12 @@ int regex_prepare_data(struct regex_data **regex, char const *pattern_string,
>>                 return -1;
>>
>>         (*regex)->regex = pcre2_compile((PCRE2_SPTR)pattern_string,
>> -                                       PCRE2_ZERO_TERMINATED, PCRE2_DOTALL,
>> +                                       PCRE2_ZERO_TERMINATED,
>> +#ifdef NO_UTF
>> +                                       PCRE2_DOTALL,
>> +#else
>> +                                       PCRE2_DOTALL | PCRE2_UTF,
>> +#endif
>
> This causes pcre2_match() to validate the subject as UTF-8 on every
> call, which in addition to incurring
> overhead on every file
>

Would you prefer NO_UTF to be default so only distributions which
enabled this would be affected?


> would also cause regex_match() to return REGEX_ERROR and
> label_file.c:lookup_check_node() to fail the whole lookup with errno
> ENOENT. Thus, restorecon on a file
> whose name isn't UTF-8 will error out instead of falling back to
> matching /.* and labeling accordingly.
> If you add PCRE2_MATCH_INVALD_UTF to the flags, then pcre2_match()
> will instead treat invalid bytes
> as "cannot match anything" but can still match literals and character
> classes and will return REGEX_NO_MATCH
> instead of REGEX_ERROR.

I was not able to get it working correctly using filename with invalid
utf8 symbol even with PCRE2_MATCH_INVALID_UTF.

PCRE2_DOTALL without PCRE2_UTF matches anything on byte level for
'.'. The problematic are wildcards. e.g. '/opt/žluťoučký+'

I'm working in a patch which without PCRE2_UTF but which would allow to
use '(*UTF)' sequence directly in file spec:

# semanage fcontext -a -t etc_t '/opt/žluťoučkž+'
# matchpathcon /opt/žluťoučkžžž
/opt/žluťoučkžžž        system_u:object_r:usr_t:s0

vs

# semanage fcontext -a -t etc_t '(*UTF)/opt/žluťoučkž+'
# matchpathcon /opt/žluťoučkžžž
/opt/žluťoučkžžž        system_u:object_r:etc_t:s0


>> diff --git a/libselinux/utils/sefcontext_compile.c b/libselinux/utils/sefcontext_compile.c
>> index e504b5084c8d..04c86053b2c8 100644
>> --- a/libselinux/utils/sefcontext_compile.c
>> +++ b/libselinux/utils/sefcontext_compile.c
>> @@ -1,6 +1,7 @@
>>  #include <endian.h>
>>  #include <errno.h>
>>  #include <getopt.h>
>> +#include <locale.h>
>>  #include <stdint.h>
>>  #include <stdio.h>
>>  #include <string.h>
>> @@ -564,6 +565,10 @@ int main(int argc, char *argv[])
>>         struct spec_node *root = NULL;
>>         struct sidtab stab = {};
>>
>> +       /* Initialize locale for UTF-8 support */
>> +       setlocale(LC_ALL, "");
>> +
>> +
>
> This shouldn't be necessary with the dropping of mbrtowc() and using
> utf8_char_len(); what still needs locale to be set? Ditto for the other
> setlocale() changes.