Re: [PATCH] libselinux: Ignore files removed during relabeling

["Rahul Sandhu" <nvraxn@gmail.com>]

On Thu Oct 16, 2025 at 7:08 PM BST, Vit Mojzis wrote:
> In case ignore_noent is specified, ignore files removed during
> relabeling (race condition between folder read, file read and label
> set).
>
> Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
> ---
>  libselinux/src/selinux_restorecon.c | 30 ++++++++++++++++++++++++-----
>  1 file changed, 25 insertions(+), 5 deletions(-)
>
> diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
> index 39eabeb9..7cad4c8d 100644
> --- a/libselinux/src/selinux_restorecon.c
> +++ b/libselinux/src/selinux_restorecon.c
> @@ -726,6 +726,14 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
>  			    pathname, newcon);
>  
>  	if (lgetfilecon_raw(pathname, &curcon) < 0) {
> +		/* Ignore files removed during relabeling if ignore_noent is set */
> +		if (flags->ignore_noent && errno == ENOENT){

Nit: there should be a space after the `(` and before the `{`, inline with the rest of the code style.

> +			if (flags->verbose)
> +				selinux_log(SELINUX_INFO,
> +					    "%s removed during relabeling\n",
> +					    pathname);
> +			goto out;
> +		}
>  		if (errno != ENODATA)
>  			goto err;
>  
> @@ -765,8 +773,19 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
>  		}
>  
>  		if (!flags->nochange) {
> -			if (lsetfilecon(pathname, newcon) < 0)
> -				goto err;
> +			if (lsetfilecon(pathname, newcon) < 0){

Same as above.

> +				/* Ignore files removed during relabeling if ignore_noent is set */
> +				if (flags->ignore_noent && errno == ENOENT){

And here too.

> +					if (flags->verbose)
> +						selinux_log(SELINUX_INFO,
> +							    "%s removed during relabeling\n",
> +							    pathname);
> +					goto out;
> +				}
> +				else
> +					goto err;
> +			}
> +
>  			updated = true;
>  		}
>  
> @@ -932,9 +951,10 @@ loop_body:
>  		case FTS_NS:
>  			error = errno;
>  			errno = ftsent->fts_errno;
> -			selinux_log(SELINUX_ERROR,
> -				    "Could not stat %s: %m.\n",
> -				    ftsent->fts_path);
> +			if (!state->flags.ignore_noent || errno != ENOENT)
> +				selinux_log(SELINUX_ERROR,
> +					    "Could not stat %s: %m.\n",
> +					    ftsent->fts_path);
>  			errno = error;
>  			fts_set(fts, ftsent, FTS_SKIP);
>  			continue;