topjohnwu/selinux
1
0
Fork 0
mirror of https://github.com/topjohnwu/selinux.git synced 2025-02-18 18:30:41 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Add restorecon -x option to not cross FS boundaries

Browse Source 
Fixes: https://github.com/SELinuxProject/selinux/issues/208

Signed-off-by: Peter Whittaker <pww@edgekeep.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
This commit is contained in:
Peter Whittaker 2020-06-08 09:20:09 -07:00 committed by Petr Lautrbach
parent f5ac1209f9
commit 7ad84e7c8d
2 changed files with 17 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
policycoreutils/setfiles/restorecon.8
View File

@ -13,6 +13,7 @@ restorecon \- restore file(s) default SELinux security contexts.
.RB [ \-F ]
.RB [ \-W ]
.RB [ \-I | \-D ]
.RB [ \-x ]
.RB [ \-e
.IR directory ]
.IR pathname \ ...
@ -31,6 +32,7 @@ restorecon \- restore file(s) default SELinux security contexts.
.RB [ \-F ]
.RB [ \-W ]
.RB [ \-I | \-D ]
.RB [ \-x ]
.SH "DESCRIPTION"
This manual page describes the
@ -153,6 +155,11 @@ option of GNU
.B find
produces input suitable for this mode.
.TP
.B \-x
prevent
.B restorecon
from crossing file system boundaries.
.TP
.SH "ARGUMENTS"
.IR pathname \ ...
The pathname for the file(s) to be relabeled.

13
policycoreutils/setfiles/setfiles.c
View File

@ -43,8 +43,8 @@ static __attribute__((__noreturn__)) void usage(const char *const name)
{
if (iamrestorecon) {
fprintf(stderr,
"usage: %s [-iIDFmnprRv0] [-e excludedir] pathname...\n"
"usage: %s [-iIDFmnprRv0] [-e excludedir] -f filename\n",
"usage: %s [-iIDFmnprRv0x] [-e excludedir] pathname...\n"
"usage: %s [-iIDFmnprRv0x] [-e excludedir] -f filename\n",
name, name);
} else {
fprintf(stderr,
@ -168,7 +168,7 @@ int main(int argc, char **argv)
size_t buf_len;
const char *base;
int errors = 0;
const char *ropts = "e:f:hiIDlmno:pqrsvFRW0";
const char *ropts = "e:f:hiIDlmno:pqrsvFRW0x";
const char *sopts = "c:de:f:hiIDlmno:pqr:svEFR:W0";
const char *opts;
union selinux_callback cb;
@ -386,6 +386,13 @@ int main(int argc, char **argv)
case '0':
null_terminated = 1;
break;
case 'x':
if (iamrestorecon) {
r_opts.xdev = SELINUX_RESTORECON_XDEV;
} else {
usage(argv[0]);
}
break;
case 'h':
case '?':
usage(argv[0]);