* [PATCH] libselinux: Ignore files removed during relabeling
@ 2025-10-16 18:08 Vit Mojzis
2025-10-16 18:24 ` Rahul Sandhu
2025-10-16 19:38 ` Stephen Smalley
0 siblings, 2 replies; 6+ messages in thread
From: Vit Mojzis @ 2025-10-16 18:08 UTC (permalink / raw)
To: selinux
In case ignore_noent is specified, ignore files removed during
relabeling (race condition between folder read, file read and label
set).
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
---
libselinux/src/selinux_restorecon.c | 30 ++++++++++++++++++++++++-----
1 file changed, 25 insertions(+), 5 deletions(-)
diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
index 39eabeb9..7cad4c8d 100644
--- a/libselinux/src/selinux_restorecon.c
+++ b/libselinux/src/selinux_restorecon.c
@@ -726,6 +726,14 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
pathname, newcon);
if (lgetfilecon_raw(pathname, &curcon) < 0) {
+ /* Ignore files removed during relabeling if ignore_noent is set */
+ if (flags->ignore_noent && errno == ENOENT){
+ if (flags->verbose)
+ selinux_log(SELINUX_INFO,
+ "%s removed during relabeling\n",
+ pathname);
+ goto out;
+ }
if (errno != ENODATA)
goto err;
@@ -765,8 +773,19 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
}
if (!flags->nochange) {
- if (lsetfilecon(pathname, newcon) < 0)
- goto err;
+ if (lsetfilecon(pathname, newcon) < 0){
+ /* Ignore files removed during relabeling if ignore_noent is set */
+ if (flags->ignore_noent && errno == ENOENT){
+ if (flags->verbose)
+ selinux_log(SELINUX_INFO,
+ "%s removed during relabeling\n",
+ pathname);
+ goto out;
+ }
+ else
+ goto err;
+ }
+
updated = true;
}
@@ -932,9 +951,10 @@ loop_body:
case FTS_NS:
error = errno;
errno = ftsent->fts_errno;
- selinux_log(SELINUX_ERROR,
- "Could not stat %s: %m.\n",
- ftsent->fts_path);
+ if (!state->flags.ignore_noent || errno != ENOENT)
+ selinux_log(SELINUX_ERROR,
+ "Could not stat %s: %m.\n",
+ ftsent->fts_path);
errno = error;
fts_set(fts, ftsent, FTS_SKIP);
continue;
--
2.51.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH] libselinux: Ignore files removed during relabeling
2025-10-16 18:08 [PATCH] libselinux: Ignore files removed during relabeling Vit Mojzis
@ 2025-10-16 18:24 ` Rahul Sandhu
2025-10-16 19:38 ` Stephen Smalley
1 sibling, 0 replies; 6+ messages in thread
From: Rahul Sandhu @ 2025-10-16 18:24 UTC (permalink / raw)
To: Vit Mojzis, selinux
On Thu Oct 16, 2025 at 7:08 PM BST, Vit Mojzis wrote:
> In case ignore_noent is specified, ignore files removed during
> relabeling (race condition between folder read, file read and label
> set).
>
> Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
> ---
> libselinux/src/selinux_restorecon.c | 30 ++++++++++++++++++++++++-----
> 1 file changed, 25 insertions(+), 5 deletions(-)
>
> diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
> index 39eabeb9..7cad4c8d 100644
> --- a/libselinux/src/selinux_restorecon.c
> +++ b/libselinux/src/selinux_restorecon.c
> @@ -726,6 +726,14 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
> pathname, newcon);
>
> if (lgetfilecon_raw(pathname, &curcon) < 0) {
> + /* Ignore files removed during relabeling if ignore_noent is set */
> + if (flags->ignore_noent && errno == ENOENT){
Nit: there should be a space after the `(` and before the `{`, inline with the rest of the code style.
> + if (flags->verbose)
> + selinux_log(SELINUX_INFO,
> + "%s removed during relabeling\n",
> + pathname);
> + goto out;
> + }
> if (errno != ENODATA)
> goto err;
>
> @@ -765,8 +773,19 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
> }
>
> if (!flags->nochange) {
> - if (lsetfilecon(pathname, newcon) < 0)
> - goto err;
> + if (lsetfilecon(pathname, newcon) < 0){
Same as above.
> + /* Ignore files removed during relabeling if ignore_noent is set */
> + if (flags->ignore_noent && errno == ENOENT){
And here too.
> + if (flags->verbose)
> + selinux_log(SELINUX_INFO,
> + "%s removed during relabeling\n",
> + pathname);
> + goto out;
> + }
> + else
> + goto err;
> + }
> +
> updated = true;
> }
>
> @@ -932,9 +951,10 @@ loop_body:
> case FTS_NS:
> error = errno;
> errno = ftsent->fts_errno;
> - selinux_log(SELINUX_ERROR,
> - "Could not stat %s: %m.\n",
> - ftsent->fts_path);
> + if (!state->flags.ignore_noent || errno != ENOENT)
> + selinux_log(SELINUX_ERROR,
> + "Could not stat %s: %m.\n",
> + ftsent->fts_path);
> errno = error;
> fts_set(fts, ftsent, FTS_SKIP);
> continue;
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH] libselinux: Ignore files removed during relabeling
2025-10-16 18:08 [PATCH] libselinux: Ignore files removed during relabeling Vit Mojzis
2025-10-16 18:24 ` Rahul Sandhu
@ 2025-10-16 19:38 ` Stephen Smalley
2025-10-17 15:08 ` [PATCH v2] " Vit Mojzis
1 sibling, 1 reply; 6+ messages in thread
From: Stephen Smalley @ 2025-10-16 19:38 UTC (permalink / raw)
To: Vit Mojzis; +Cc: selinux
On Thu, Oct 16, 2025 at 2:09 PM Vit Mojzis <vmojzis@redhat.com> wrote:
>
> In case ignore_noent is specified, ignore files removed during
> relabeling (race condition between folder read, file read and label
> set).
>
> Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
> ---
> libselinux/src/selinux_restorecon.c | 30 ++++++++++++++++++++++++-----
> 1 file changed, 25 insertions(+), 5 deletions(-)
>
> diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
> index 39eabeb9..7cad4c8d 100644
> --- a/libselinux/src/selinux_restorecon.c
> +++ b/libselinux/src/selinux_restorecon.c
> @@ -726,6 +726,14 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
> pathname, newcon);
>
> if (lgetfilecon_raw(pathname, &curcon) < 0) {
> + /* Ignore files removed during relabeling if ignore_noent is set */
> + if (flags->ignore_noent && errno == ENOENT){
> + if (flags->verbose)
> + selinux_log(SELINUX_INFO,
> + "%s removed during relabeling\n",
> + pathname);
I wouldn't bother with these log messages.
> + goto out;
> + }
> if (errno != ENODATA)
> goto err;
>
> @@ -765,8 +773,19 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
> }
>
> if (!flags->nochange) {
> - if (lsetfilecon(pathname, newcon) < 0)
> - goto err;
> + if (lsetfilecon(pathname, newcon) < 0){
> + /* Ignore files removed during relabeling if ignore_noent is set */
> + if (flags->ignore_noent && errno == ENOENT){
> + if (flags->verbose)
> + selinux_log(SELINUX_INFO,
> + "%s removed during relabeling\n",
> + pathname);
Ditto.
> + goto out;
> + }
> + else
> + goto err;
> + }
> +
> updated = true;
> }
>
> @@ -932,9 +951,10 @@ loop_body:
> case FTS_NS:
> error = errno;
> errno = ftsent->fts_errno;
> - selinux_log(SELINUX_ERROR,
> - "Could not stat %s: %m.\n",
> - ftsent->fts_path);
> + if (!state->flags.ignore_noent || errno != ENOENT)
> + selinux_log(SELINUX_ERROR,
> + "Could not stat %s: %m.\n",
> + ftsent->fts_path);
> errno = error;
> fts_set(fts, ftsent, FTS_SKIP);
> continue;
> --
> 2.51.0
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2] libselinux: Ignore files removed during relabeling
2025-10-16 19:38 ` Stephen Smalley
@ 2025-10-17 15:08 ` Vit Mojzis
2025-10-20 12:46 ` Stephen Smalley
0 siblings, 1 reply; 6+ messages in thread
From: Vit Mojzis @ 2025-10-17 15:08 UTC (permalink / raw)
To: selinux
In case ignore_noent is specified, ignore files removed during
relabeling (race condition between folder read, file read and label
set).
Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
---
libselinux/src/selinux_restorecon.c | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
index 39eabeb9..681c69db 100644
--- a/libselinux/src/selinux_restorecon.c
+++ b/libselinux/src/selinux_restorecon.c
@@ -726,6 +726,9 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
pathname, newcon);
if (lgetfilecon_raw(pathname, &curcon) < 0) {
+ /* Ignore files removed during relabeling if ignore_noent is set */
+ if (flags->ignore_noent && errno == ENOENT)
+ goto out;
if (errno != ENODATA)
goto err;
@@ -765,8 +768,14 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
}
if (!flags->nochange) {
- if (lsetfilecon(pathname, newcon) < 0)
- goto err;
+ if (lsetfilecon(pathname, newcon) < 0) {
+ /* Ignore files removed during relabeling if ignore_noent is set */
+ if (flags->ignore_noent && errno == ENOENT)
+ goto out;
+ else
+ goto err;
+ }
+
updated = true;
}
@@ -932,9 +941,10 @@ loop_body:
case FTS_NS:
error = errno;
errno = ftsent->fts_errno;
- selinux_log(SELINUX_ERROR,
- "Could not stat %s: %m.\n",
- ftsent->fts_path);
+ if (!state->flags.ignore_noent || errno != ENOENT)
+ selinux_log(SELINUX_ERROR,
+ "Could not stat %s: %m.\n",
+ ftsent->fts_path);
errno = error;
fts_set(fts, ftsent, FTS_SKIP);
continue;
--
2.51.0
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] libselinux: Ignore files removed during relabeling
2025-10-17 15:08 ` [PATCH v2] " Vit Mojzis
@ 2025-10-20 12:46 ` Stephen Smalley
2025-10-21 13:46 ` Stephen Smalley
0 siblings, 1 reply; 6+ messages in thread
From: Stephen Smalley @ 2025-10-20 12:46 UTC (permalink / raw)
To: Vit Mojzis; +Cc: selinux
On Fri, Oct 17, 2025 at 11:19 AM Vit Mojzis <vmojzis@redhat.com> wrote:
>
> In case ignore_noent is specified, ignore files removed during
> relabeling (race condition between folder read, file read and label
> set).
>
> Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
> libselinux/src/selinux_restorecon.c | 20 +++++++++++++++-----
> 1 file changed, 15 insertions(+), 5 deletions(-)
>
> diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
> index 39eabeb9..681c69db 100644
> --- a/libselinux/src/selinux_restorecon.c
> +++ b/libselinux/src/selinux_restorecon.c
> @@ -726,6 +726,9 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
> pathname, newcon);
>
> if (lgetfilecon_raw(pathname, &curcon) < 0) {
> + /* Ignore files removed during relabeling if ignore_noent is set */
> + if (flags->ignore_noent && errno == ENOENT)
> + goto out;
> if (errno != ENODATA)
> goto err;
>
> @@ -765,8 +768,14 @@ static int restorecon_sb(const char *pathname, const struct stat *sb,
> }
>
> if (!flags->nochange) {
> - if (lsetfilecon(pathname, newcon) < 0)
> - goto err;
> + if (lsetfilecon(pathname, newcon) < 0) {
> + /* Ignore files removed during relabeling if ignore_noent is set */
> + if (flags->ignore_noent && errno == ENOENT)
> + goto out;
> + else
> + goto err;
> + }
> +
> updated = true;
> }
>
> @@ -932,9 +941,10 @@ loop_body:
> case FTS_NS:
> error = errno;
> errno = ftsent->fts_errno;
> - selinux_log(SELINUX_ERROR,
> - "Could not stat %s: %m.\n",
> - ftsent->fts_path);
> + if (!state->flags.ignore_noent || errno != ENOENT)
> + selinux_log(SELINUX_ERROR,
> + "Could not stat %s: %m.\n",
> + ftsent->fts_path);
> errno = error;
> fts_set(fts, ftsent, FTS_SKIP);
> continue;
> --
> 2.51.0
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] libselinux: Ignore files removed during relabeling
2025-10-20 12:46 ` Stephen Smalley
@ 2025-10-21 13:46 ` Stephen Smalley
0 siblings, 0 replies; 6+ messages in thread
From: Stephen Smalley @ 2025-10-21 13:46 UTC (permalink / raw)
To: Vit Mojzis; +Cc: selinux
On Mon, Oct 20, 2025 at 8:46 AM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Fri, Oct 17, 2025 at 11:19 AM Vit Mojzis <vmojzis@redhat.com> wrote:
> >
> > In case ignore_noent is specified, ignore files removed during
> > relabeling (race condition between folder read, file read and label
> > set).
> >
> > Signed-off-by: Vit Mojzis <vmojzis@redhat.com>
>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Thanks, merged.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2025-10-21 13:46 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-10-16 18:08 [PATCH] libselinux: Ignore files removed during relabeling Vit Mojzis
2025-10-16 18:24 ` Rahul Sandhu
2025-10-16 19:38 ` Stephen Smalley
2025-10-17 15:08 ` [PATCH v2] " Vit Mojzis
2025-10-20 12:46 ` Stephen Smalley
2025-10-21 13:46 ` Stephen Smalley
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).