[PATCH v2 2/3] restorecond: use openat2 if defined

Update restorecond's safe_open() helper to use openat2() if defined to
optimize the lookup of the initial pathname. Fall back to the existing
per-component lookup on ENOSYS/EINVAL so that pre-5.6 and
seccomp-filtered environments are unaffected.

Signed-off-by: Stephen Smalley <[email protected]>
---
 restorecond/watch.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/restorecond/watch.c b/restorecond/watch.c
index 25918fd5..18bd90db 100644
--- a/restorecond/watch.c
+++ b/restorecond/watch.c
@@ -12,6 +12,10 @@
 #include <glob.h>
 #include <libgen.h>
 #include <sys/stat.h>
+#include <sys/syscall.h>
+#ifdef __NR_openat2
+#include <linux/openat2.h>
+#endif
 #include <string.h>
 #include <stdio.h>
 #include <fcntl.h>
@@ -72,6 +76,25 @@ static int safe_open(const char *path, struct stat *sb)
 		return -1;
 	}
 
+#ifdef __NR_openat2
+	struct open_how how = {
+		.flags = O_PATH | O_NOFOLLOW | O_CLOEXEC,
+		.resolve = RESOLVE_NO_SYMLINKS | RESOLVE_NO_MAGICLINKS,
+	};
+
+	nfd = syscall(__NR_openat2, AT_FDCWD, path, &how, sizeof(how));
+	if (nfd >= 0) {
+		if (fstat(nfd, sb) < 0) {
+			close(nfd);
+			return -1;
+		}
+		return nfd;
+	}
+
+	if (errno != ENOSYS && errno != EINVAL)
+		return -1;
+#endif
+
 	copy = strdup(path);
 	if (!copy)
 		return -1;
-- 
2.54.0