Re: matchfilecon (the program) vs matchfilecon (the libselinux1 fn)

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

On Tue, Aug 03, 2004 at 07:11:32AM -0400, Stephen Smalley wrote:
> On Mon, 2004-08-02 at 17:12, Luke Kenneth Casson Leighton wrote:
> >  okay, quick question: if i use setfscreatecon(), is it a "one-time"
> >  create, or is it effective on all creates up until the time that
> >  freecon() is called?
> 
> Once set, the fscreate context remains set for all file creations until
> the program explicitly resets it (via another setfscreatecon() call) or
> the program performs an execve (in which case the context is reset so
> that all programs start in a known state, defaulting to the
> policy-defined labeling behavior).  

 eek okay so i should use getcon() and restore the context afterwards.


> The freecon() is irrelevant to the
> "lifetime" of the fscreate context, as it just frees the context in the
> application's memory; it doesn't affect the saved value for the task in
> the kernel.
 
  ack.

> >  [because if it's "up until freecon() is called", then the bug that
> >   the selinux patch to udev was suffering from was that free(scontext)
> >   was being used instead of freecon().]
> 
> While it is preferable to use freecon() for encapsulation, it is
> presently true that freecon(x) = free(x).
> 
> With regard to your patch, please pass the actual mode to matchpathcon,
> not 0, as the second parameter.  This allows the matching to take into
> account the file type, e.g. whether it is a character device or a block
> device.

 oh yeah i forgot.

 l.



-------------------------------------------------------
This SF.Net email is sponsored by OSTG. Have you noticed the changes on
Linux.com, ITManagersJournal and NewsForge in the past few weeks? Now,
one more big change to announce. We are now OSTG- Open Source Technology
Group. Come see the changes on the new OSTG site. www.ostg.com
_______________________________________________
Linux-hotplug-devel mailing list  http://linux-hotplug.sourceforge.net
Linux-hotplug-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/linux-hotplug-devel