[PATCH] selinux_restorecon: Do not exit on directory cycles

[PATCH] selinux_restorecon: Do not exit on directory cycles

[Johannes Segitz]

[-- Attachment #1: Type: text/plain, Size: 1199 bytes --]

All other failures are handled gracefully. Directory cycles can e.g.
happen on BTRFS filesystems with subvolumes. Skip them and continue
instead of exiting

Signed-off-by: Johannes Segitz <jsegitz@suse.de>
---
 libselinux/src/selinux_restorecon.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
index 7ef2d45d..33d315a2 100644
--- a/libselinux/src/selinux_restorecon.c
+++ b/libselinux/src/selinux_restorecon.c
@@ -883,13 +883,12 @@ loop_body:

                switch (ftsent->fts_info) {
                case FTS_DC:
-                       selinux_log(SELINUX_ERROR,
+                       selinux_log(SELINUX_WARNING,
                                    "Directory cycle on %s.\n",
                                    ftsent->fts_path);
                        errno = ELOOP;
-                       state->error = -1;
-                       state->abort = true;
-                       goto finish;
+                       fts_set(fts, ftsent, FTS_SKIP);
+                       continue;
                case FTS_DP:
                        continue;
                case FTS_DNR:
--
2.55.0

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 870 bytes --]

Re: [PATCH] selinux_restorecon: Do not exit on directory cycles

[Stephen Smalley]

On Tue, Jul 21, 2026 at 3:23 AM Johannes Segitz <jsegitz@suse.de> wrote:
>
> All other failures are handled gracefully. Directory cycles can e.g.
> happen on BTRFS filesystems with subvolumes. Skip them and continue
> instead of exiting
>
> Signed-off-by: Johannes Segitz <jsegitz@suse.de>

This doesn't apply on selinux/main.

> ---
>  libselinux/src/selinux_restorecon.c | 7 +++----
>  1 file changed, 3 insertions(+), 4 deletions(-)
>
> diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
> index 7ef2d45d..33d315a2 100644
> --- a/libselinux/src/selinux_restorecon.c
> +++ b/libselinux/src/selinux_restorecon.c
> @@ -883,13 +883,12 @@ loop_body:
>
>                 switch (ftsent->fts_info) {
>                 case FTS_DC:
> -                       selinux_log(SELINUX_ERROR,
> +                       selinux_log(SELINUX_WARNING,
>                                     "Directory cycle on %s.\n",
>                                     ftsent->fts_path);
>                         errno = ELOOP;
> -                       state->error = -1;
> -                       state->abort = true;
> -                       goto finish;
> +                       fts_set(fts, ftsent, FTS_SKIP);
> +                       continue;
>                 case FTS_DP:
>                         continue;
>                 case FTS_DNR:
> --
> 2.55.0

Re: [PATCH] selinux_restorecon: Do not exit on directory cycles

[Johannes Segitz]

[-- Attachment #1: Type: text/plain, Size: 856 bytes --]

On Tue, Jul 21, 2026 at 09:54:28AM -0400, Stephen Smalley wrote:
> On Tue, Jul 21, 2026 at 3:23 AM Johannes Segitz <jsegitz@suse.de> wrote:
> >
> > All other failures are handled gracefully. Directory cycles can e.g.
> > happen on BTRFS filesystems with subvolumes. Skip them and continue
> > instead of exiting
> >
> > Signed-off-by: Johannes Segitz <jsegitz@suse.de>
> 
> This doesn't apply on selinux/main.

Sorry, had a repo still with branch "master", will send both again tomorrow

Johannes
-- 
GPG Key                EE16 6BCE AD56 E034 BFB3  3ADD 7BF7 29D5 E7C8 1FA0
Subkey fingerprint:    250F 43F5 F7CE 6F1E 9C59  4F95 BC27 DD9D 2CC4 FD66
SUSE Software Solutions Germany GmbH, Frankenstr. 146, 90461 Nürnberg, Germany
www.suse.com, Geschäftsführer: Jochen Jaser, Andrew McDonald, Abhinav Puri, (HRB 36809, AG Nürnberg)


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 870 bytes --]

[PATCH] selinux_restorecon: Do not exit on directory cycles

[Johannes Segitz]

[-- Attachment #1: Type: text/plain, Size: 1553 bytes --]

All other failures are handled gracefully. Directory cycles can e.g.
happen on BTRFS filesystems with subvolumes. Skip them and continue
instead of exiting
---
 libselinux/src/selinux_restorecon.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
index 30f1b836..fdefc92c 100644
--- a/libselinux/src/selinux_restorecon.c
+++ b/libselinux/src/selinux_restorecon.c
@@ -1393,15 +1393,14 @@ static void *selinux_restorecon_thread(void *arg)
                if (is_dir) {
                        if (descend && walk_is_cycle(state, ent_sb.st_dev,
                                                     ent_sb.st_ino)) {
-                               selinux_log(SELINUX_ERROR,
+                               selinux_log(SELINUX_WARNING,
                                            "Directory cycle on %s.\n",
                                            ent_path);
                                close(ent_fd);
-                               close(rd_fd);
-                               errno = ELOOP;
-                               state->error = -1;
-                               state->abort = true;
-                               goto finish;
+                               if (rd_fd >= 0)
+                                       close(rd_fd);
+                               prune_pathbuf(state);
+                               continue;
                        }

                        if (state->sfsb.f_type == SYSFS_MAGIC &&
--
2.55.0

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 870 bytes --]

Re: [PATCH] selinux_restorecon: Do not exit on directory cycles

[Stephen Smalley]

On Thu, Jul 23, 2026 at 4:56 AM Johannes Segitz <jsegitz@suse.de> wrote:
>
> All other failures are handled gracefully. Directory cycles can e.g.
> happen on BTRFS filesystems with subvolumes. Skip them and continue
> instead of exiting

This is a user-visible behavior change so we should note it; restorecon -R
on a tree with a bind mount of an ancestor will now complete with rc 0 and
only a WARNING rather than aborting with ELOOP.

Missing Signed-off-by line and the patch still doesn't apply for me
(did you send it using git send-email and against current selinux/main?)
but also see comment below on the code.

> ---
>  libselinux/src/selinux_restorecon.c | 11 +++++------
>  1 file changed, 5 insertions(+), 6 deletions(-)
>
> diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
> index 30f1b836..fdefc92c 100644
> --- a/libselinux/src/selinux_restorecon.c
> +++ b/libselinux/src/selinux_restorecon.c
> @@ -1393,15 +1393,14 @@ static void *selinux_restorecon_thread(void *arg)
>                 if (is_dir) {
>                         if (descend && walk_is_cycle(state, ent_sb.st_dev,
>                                                      ent_sb.st_ino)) {
> -                               selinux_log(SELINUX_ERROR,
> +                               selinux_log(SELINUX_WARNING,
>                                             "Directory cycle on %s.\n",
>                                             ent_path);
>                                 close(ent_fd);
> -                               close(rd_fd);
> -                               errno = ELOOP;
> -                               state->error = -1;
> -                               state->abort = true;
> -                               goto finish;
> +                               if (rd_fd >= 0)
> +                                       close(rd_fd);

You don't need the if (rd_fd >= 0) guard here because this branch is only
executed if descend == true so that's always true.

> +                               prune_pathbuf(state);
> +                               continue;
>                         }
>
>                         if (state->sfsb.f_type == SYSFS_MAGIC &&
> --
> 2.55.0

Re: [PATCH] selinux_restorecon: Do not exit on directory cycles

[Johannes Segitz]

[-- Attachment #1.1: Type: text/plain, Size: 1806 bytes --]

On Thu, Jul 23, 2026 at 10:55:48AM -0400, Stephen Smalley wrote:
> On Thu, Jul 23, 2026 at 4:56 AM Johannes Segitz <jsegitz@suse.de> wrote:
> >
> > All other failures are handled gracefully. Directory cycles can e.g.
> > happen on BTRFS filesystems with subvolumes. Skip them and continue
> > instead of exiting
> 
> This is a user-visible behavior change so we should note it; restorecon -R
> on a tree with a bind mount of an ancestor will now complete with rc 0 and
> only a WARNING rather than aborting with ELOOP.

Okay, I can write something up. But in general you would be fine with the
behavior change?

> Missing Signed-off-by line and the patch still doesn't apply for me
> (did you send it using git send-email and against current selinux/main?)
> but also see comment below on the code.

I start feel like an idiot. The first time I used this old repo with the
wrong branch, but this time I made sure it applies, but didn't use
git send-mail.

I did
# git format-patch -1 HEAD
0001-selinux_restorecon-Do-not-exit-on-directory-cycles.patch

which for me then applies:
# git checkout main
Already on 'main'
Your branch is up to date with 'origin/main'.
# git rev-parse --short HEAD
84d424b8
# git am 0001-selinux_restorecon-Do-not-exit-on-directory-cycles.patch
Applying: selinux_restorecon: Do not exit on directory cycles

Maybe my manual inclusion in the mail breaks it? I attach it now to the
mail

Johannes
-- 
GPG Key                EE16 6BCE AD56 E034 BFB3  3ADD 7BF7 29D5 E7C8 1FA0
Subkey fingerprint:    250F 43F5 F7CE 6F1E 9C59  4F95 BC27 DD9D 2CC4 FD66
SUSE Software Solutions Germany GmbH, Frankenstr. 146, 90461 Nürnberg, Germany
www.suse.com, Geschäftsführer: Jochen Jaser, Andrew McDonald, Abhinav Puri, (HRB 36809, AG Nürnberg)


[-- Attachment #1.2: 0001-selinux_restorecon-Do-not-exit-on-directory-cycles.patch --]
[-- Type: text/x-patch, Size: 1302 bytes --]

From 9155f98c8dec5b275ee0429cc19c9b42d8c3c8b5 Mon Sep 17 00:00:00 2001
From: Johannes Segitz <jsegitz@suse.de>
Date: Thu, 23 Jul 2026 10:48:40 +0200
Subject: [PATCH] selinux_restorecon: Do not exit on directory cycles

All other failures are handled gracefully. Directory cycles can e.g.
happen on BTRFS filesystems with subvolumes. Skip them and continue
instead of exiting
---
 libselinux/src/selinux_restorecon.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
index 30f1b836..fdefc92c 100644
--- a/libselinux/src/selinux_restorecon.c
+++ b/libselinux/src/selinux_restorecon.c
@@ -1393,15 +1393,14 @@ static void *selinux_restorecon_thread(void *arg)
 		if (is_dir) {
 			if (descend && walk_is_cycle(state, ent_sb.st_dev,
 						     ent_sb.st_ino)) {
-				selinux_log(SELINUX_ERROR,
+				selinux_log(SELINUX_WARNING,
 					    "Directory cycle on %s.\n",
 					    ent_path);
 				close(ent_fd);
-				close(rd_fd);
-				errno = ELOOP;
-				state->error = -1;
-				state->abort = true;
-				goto finish;
+				if (rd_fd >= 0)
+					close(rd_fd);
+				prune_pathbuf(state);
+				continue;
 			}
 
 			if (state->sfsb.f_type == SYSFS_MAGIC &&
-- 
2.55.0


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 870 bytes --]

Re: [PATCH] selinux_restorecon: Do not exit on directory cycles

[Stephen Smalley]

On Thu, Jul 23, 2026 at 11:21 AM Johannes Segitz <jsegitz@suse.de> wrote:
>
> On Thu, Jul 23, 2026 at 10:55:48AM -0400, Stephen Smalley wrote:
> > On Thu, Jul 23, 2026 at 4:56 AM Johannes Segitz <jsegitz@suse.de> wrote:
> > >
> > > All other failures are handled gracefully. Directory cycles can e.g.
> > > happen on BTRFS filesystems with subvolumes. Skip them and continue
> > > instead of exiting
> >
> > This is a user-visible behavior change so we should note it; restorecon -R
> > on a tree with a bind mount of an ancestor will now complete with rc 0 and
> > only a WARNING rather than aborting with ELOOP.
>
> Okay, I can write something up. But in general you would be fine with the
> behavior change?

I am (although other maintainers are free to disagree).

> > Missing Signed-off-by line and the patch still doesn't apply for me
> > (did you send it using git send-email and against current selinux/main?)
> > but also see comment below on the code.
>
> I start feel like an idiot. The first time I used this old repo with the
> wrong branch, but this time I made sure it applies, but didn't use
> git send-mail.
>
> I did
> # git format-patch -1 HEAD
> 0001-selinux_restorecon-Do-not-exit-on-directory-cycles.patch
>
> which for me then applies:
> # git checkout main
> Already on 'main'
> Your branch is up to date with 'origin/main'.
> # git rev-parse --short HEAD
> 84d424b8
> # git am 0001-selinux_restorecon-Do-not-exit-on-directory-cycles.patch
> Applying: selinux_restorecon: Do not exit on directory cycles
>
> Maybe my manual inclusion in the mail breaks it? I attach it now to the
> mail

Yes, unfortunately mail clients are unforgiving of inline patches
these days so we recommend
using git send-email,
https://github.com/SELinuxProject/selinux/wiki/Contributing#contributing-code

We still prefer inline patches for ease of review and inline commenting.

Re: [PATCH] selinux_restorecon: Do not exit on directory cycles

[Johannes Segitz]

[-- Attachment #1: Type: text/plain, Size: 2588 bytes --]

On Thu, Jul 23, 2026 at 11:38:24AM -0400, Stephen Smalley wrote:
> On Thu, Jul 23, 2026 at 11:21 AM Johannes Segitz <jsegitz@suse.de> wrote:
> >
> > On Thu, Jul 23, 2026 at 10:55:48AM -0400, Stephen Smalley wrote:
> > > On Thu, Jul 23, 2026 at 4:56 AM Johannes Segitz <jsegitz@suse.de> wrote:
> > > >
> > > > All other failures are handled gracefully. Directory cycles can e.g.
> > > > happen on BTRFS filesystems with subvolumes. Skip them and continue
> > > > instead of exiting
> > >
> > > This is a user-visible behavior change so we should note it; restorecon -R
> > > on a tree with a bind mount of an ancestor will now complete with rc 0 and
> > > only a WARNING rather than aborting with ELOOP.
> >
> > Okay, I can write something up. But in general you would be fine with the
> > behavior change?
> 
> I am (although other maintainers are free to disagree).

okay, I'll prepare an updated version with wording that addresses this and
...

> > > Missing Signed-off-by line and the patch still doesn't apply for me
> > > (did you send it using git send-email and against current selinux/main?)
> > > but also see comment below on the code.
> >
> > I start feel like an idiot. The first time I used this old repo with the
> > wrong branch, but this time I made sure it applies, but didn't use
> > git send-mail.
> >
> > I did
> > # git format-patch -1 HEAD
> > 0001-selinux_restorecon-Do-not-exit-on-directory-cycles.patch
> >
> > which for me then applies:
> > # git checkout main
> > Already on 'main'
> > Your branch is up to date with 'origin/main'.
> > # git rev-parse --short HEAD
> > 84d424b8
> > # git am 0001-selinux_restorecon-Do-not-exit-on-directory-cycles.patch
> > Applying: selinux_restorecon: Do not exit on directory cycles
> >
> > Maybe my manual inclusion in the mail breaks it? I attach it now to the
> > mail
> 
> Yes, unfortunately mail clients are unforgiving of inline patches
> these days so we recommend
> using git send-email,
> https://github.com/SELinuxProject/selinux/wiki/Contributing#contributing-code

... will set this up. My mail setup is bit unusual, because of this I
avoided it until now, but I agree that it makes reviewing easier

Johannes
-- 
GPG Key                EE16 6BCE AD56 E034 BFB3  3ADD 7BF7 29D5 E7C8 1FA0
Subkey fingerprint:    250F 43F5 F7CE 6F1E 9C59  4F95 BC27 DD9D 2CC4 FD66
SUSE Software Solutions Germany GmbH, Frankenstr. 146, 90461 Nürnberg, Germany
www.suse.com, Geschäftsführer: Jochen Jaser, Andrew McDonald, Abhinav Puri, (HRB 36809, AG Nürnberg)


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 870 bytes --]