shaba/libvirt
1
0
Fork 0
mirror of https://gitlab.com/libvirt/libvirt.git synced 2025-02-09 13:57:27 +03:00
Code Releases Activity

selinux: avoid memory overhead of matchpathcon

Browse Source 
https://bugzilla.redhat.com/show_bug.cgi?id=658657

* src/security/security_selinux.c
(SELinuxRestoreSecurityFileLabel): Use selabel_lookup instead of
matchpathcon.
Suggested by Daniel Walsh.
This commit is contained in:
Eric Blake 2010-11-30 18:22:54 -07:00
parent 6e9a29c887
commit 6679943f94
1 changed files with 8 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/security/security_selinux.c
View File

@ -14,6 +14,7 @@
*/
#include <config.h>
#include <selinux/selinux.h>
#include <selinux/label.h>
#include <selinux/context.h>
#include <sys/types.h>
#include <sys/stat.h>
@ -362,6 +363,7 @@ SELinuxRestoreSecurityFileLabel(const char *path)
{
struct stat buf;
security_context_t fcon = NULL;
struct selabel_handle *handle = NULL;
int rc = -1;
char *newpath = NULL;
char ebuf[1024];
@ -380,14 +382,16 @@ SELinuxRestoreSecurityFileLabel(const char *path)
goto err;
}
if (matchpathcon(newpath, buf.st_mode, &fcon) == 0) {
rc = SELinuxSetFilecon(newpath, fcon);
if ((handle = selabel_open(SELABEL_CTX_FILE, NULL, 0)) == NULL ||
selabel_lookup(handle, &fcon, newpath, buf.st_mode) < 0) {
VIR_WARN("cannot lookup default selinux label for %s", newpath);
} else {
VIR_WARN("cannot lookup default selinux label for %s",
newpath);
rc = SELinuxSetFilecon(newpath, fcon);
}
err:
if (handle)
selabel_close(handle);
freecon(fcon);
VIR_FREE(newpath);
return rc;