Re: [PATCH] selinux_restorecon: Do not exit on directory cycles

[Johannes Segitz <jsegitz@suse.de>]

[-- Attachment #1.1: Type: text/plain, Size: 1806 bytes --]

On Thu, Jul 23, 2026 at 10:55:48AM -0400, Stephen Smalley wrote:
> On Thu, Jul 23, 2026 at 4:56 AM Johannes Segitz <jsegitz@suse.de> wrote:
> >
> > All other failures are handled gracefully. Directory cycles can e.g.
> > happen on BTRFS filesystems with subvolumes. Skip them and continue
> > instead of exiting
> 
> This is a user-visible behavior change so we should note it; restorecon -R
> on a tree with a bind mount of an ancestor will now complete with rc 0 and
> only a WARNING rather than aborting with ELOOP.

Okay, I can write something up. But in general you would be fine with the
behavior change?

> Missing Signed-off-by line and the patch still doesn't apply for me
> (did you send it using git send-email and against current selinux/main?)
> but also see comment below on the code.

I start feel like an idiot. The first time I used this old repo with the
wrong branch, but this time I made sure it applies, but didn't use
git send-mail.

I did
# git format-patch -1 HEAD
0001-selinux_restorecon-Do-not-exit-on-directory-cycles.patch

which for me then applies:
# git checkout main
Already on 'main'
Your branch is up to date with 'origin/main'.
# git rev-parse --short HEAD
84d424b8
# git am 0001-selinux_restorecon-Do-not-exit-on-directory-cycles.patch
Applying: selinux_restorecon: Do not exit on directory cycles

Maybe my manual inclusion in the mail breaks it? I attach it now to the
mail

Johannes
-- 
GPG Key                EE16 6BCE AD56 E034 BFB3  3ADD 7BF7 29D5 E7C8 1FA0
Subkey fingerprint:    250F 43F5 F7CE 6F1E 9C59  4F95 BC27 DD9D 2CC4 FD66
SUSE Software Solutions Germany GmbH, Frankenstr. 146, 90461 Nürnberg, Germany
www.suse.com, Geschäftsführer: Jochen Jaser, Andrew McDonald, Abhinav Puri, (HRB 36809, AG Nürnberg)


[-- Attachment #1.2: 0001-selinux_restorecon-Do-not-exit-on-directory-cycles.patch --]
[-- Type: text/x-patch, Size: 1302 bytes --]

From 9155f98c8dec5b275ee0429cc19c9b42d8c3c8b5 Mon Sep 17 00:00:00 2001
From: Johannes Segitz <jsegitz@suse.de>
Date: Thu, 23 Jul 2026 10:48:40 +0200
Subject: [PATCH] selinux_restorecon: Do not exit on directory cycles

All other failures are handled gracefully. Directory cycles can e.g.
happen on BTRFS filesystems with subvolumes. Skip them and continue
instead of exiting
---
 libselinux/src/selinux_restorecon.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
index 30f1b836..fdefc92c 100644
--- a/libselinux/src/selinux_restorecon.c
+++ b/libselinux/src/selinux_restorecon.c
@@ -1393,15 +1393,14 @@ static void *selinux_restorecon_thread(void *arg)
 		if (is_dir) {
 			if (descend && walk_is_cycle(state, ent_sb.st_dev,
 						     ent_sb.st_ino)) {
-				selinux_log(SELINUX_ERROR,
+				selinux_log(SELINUX_WARNING,
 					    "Directory cycle on %s.\n",
 					    ent_path);
 				close(ent_fd);
-				close(rd_fd);
-				errno = ELOOP;
-				state->error = -1;
-				state->abort = true;
-				goto finish;
+				if (rd_fd >= 0)
+					close(rd_fd);
+				prune_pathbuf(state);
+				continue;
 			}
 
 			if (state->sfsb.f_type == SYSFS_MAGIC &&
-- 
2.55.0


[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 870 bytes --]