Re: getfilecon return code

[ramsdell@mitre.org (John D. Ramsdell)]

Steve, 

Thanks for your quick reply.

Stephen Smalley <sds@tycho.nsa.gov> writes:

> On Mon, 2007-07-09 at 14:07 -0400, John D. Ramsdell wrote:
> > ... In fact, I wrote code that freecon'd a context whenever the
> > return value was not -1.
> 
> freecon(NULL) is perfectly legal and harmless, like free(NULL), so
> that part is ok.

There is also the case of printing a security context.  The getfilecon
program that is part of the libselinux package thinks one can print a
security context if the return code is non-negative, and thus prints:

/proc/sys/kernel/pid_max	(null)

If some other program tried to use the second field of this output as
a security context, it could spell trouble.

John


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.