1 /* Prototypes for openat-style fd-relative SELinux functions 2 Copyright (C) 2007, 2009-2021 Free Software Foundation, Inc. 3 4 This program is free software: you can redistribute it and/or modify 5 it under the terms of the GNU General Public License as published by 6 the Free Software Foundation, either version 3 of the License, or 7 (at your option) any later version. 8 9 This program is distributed in the hope that it will be useful, 10 but WITHOUT ANY WARRANTY; without even the implied warranty of 11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 12 GNU General Public License for more details. 13 14 You should have received a copy of the GNU General Public License 15 along with this program. If not, see <https://www.gnu.org/licenses/>. */ 16 17 #include <selinux/selinux.h> 18 #include <selinux/context.h> 19 20 /* These are the dir-fd-relative variants of the functions without the 21 "at" suffix. For example, getfileconat (AT_FDCWD, file, &c) is usually 22 equivalent to getfilecon (file, &c). The emulation is accomplished 23 by first attempting getfilecon ("/proc/self/fd/DIR_FD/FILE", &c). 24 Failing that, simulate it via save_cwd/fchdir/getfilecon/restore_cwd. 25 If either the save_cwd or the restore_cwd fails (relatively unlikely), 26 then give a diagnostic and exit nonzero. */ 27 28 /* dir-fd-relative getfilecon. Set *CON to the SELinux security context 29 of the file specified by DIR_FD and FILE and return the length of *CON. 30 DIR_FD and FILE are interpreted as for fstatat[*]. A non-NULL *CON 31 must be freed with freecon. Upon error, set *CON to NULL, set errno 32 and return -1. 33 [*] with flags=0 here, with flags=AT_SYMLINK_NOFOLLOW for lgetfileconat */ 34 int getfileconat (int dir_fd, char const *file, char **con); 35 36 /* dir-fd-relative lgetfilecon. This function is just like getfileconat, 37 except when DIR_FD and FILE specify a symlink: lgetfileconat operates on 38 the symlink, while getfileconat operates on the referent of the symlink. */ 39 int lgetfileconat (int dir_fd, char const *file, char **con); 40 41 /* dir-fd-relative setfilecon. Set the SELinux security context of 42 the file specified by DIR_FD and FILE to CON. DIR_FD and FILE are 43 interpreted as for fstatat[*]. Upon success, return 0. 44 Otherwise, return -1 and set errno. */ 45 int setfileconat (int dir_fd, char const *file, char const *con); 46 47 /* dir-fd-relative lsetfilecon. This function is just like setfileconat, 48 except that rather than dereferencing a symlink, this function affects it. */ 49 /* dir-fd-relative lsetfilecon. This function is just like setfileconat, 50 except when DIR_FD and FILE specify a symlink: lsetfileconat operates on 51 the symlink, while setfileconat operates on the referent of the symlink. */ 52 int lsetfileconat (int dir_fd, char const *file, char const *con);