Re: [PATCH v2 1/3] libselinux: selinux_restorecon: use openat2 if defined

On Mon, Jul 6, 2026 at 10:37 AM Stephen Smalley
<[email protected]> wrote:
>
> Update selinux_restorecon()'s safe_open() helper to use openat2()
> if defined to optimize the lookup of the initial pathname. Fall
> back to the existing per-component lookup on ENOSYS/EINVAL so
> that pre-5.6 and seccomp-filtered environments are unaffected.
>
> Signed-off-by: Stephen Smalley <[email protected]>

For these three patches:
Acked-by: James Carter <[email protected]>

> ---
>  libselinux/src/selinux_restorecon.c | 23 +++++++++++++++++++++++
>  1 file changed, 23 insertions(+)
>
> diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
> index b34d8e60..30f1b836 100644
> --- a/libselinux/src/selinux_restorecon.c
> +++ b/libselinux/src/selinux_restorecon.c
> @@ -25,7 +25,11 @@
>  #include <sys/vfs.h>
>  #include <sys/statvfs.h>
>  #include <sys/utsname.h>
> +#include <sys/syscall.h>
>  #include <linux/magic.h>
> +#ifdef __NR_openat2
> +#include <linux/openat2.h>
> +#endif
>  #include <libgen.h>
>  #include <syslog.h>
>  #include <assert.h>
> @@ -1114,6 +1118,25 @@ static int safe_open(const char *path, struct stat *sb)
>                 return -1;
>         }
>
> +#ifdef __NR_openat2
> +       struct open_how how = {
> +               .flags = O_PATH | O_NOFOLLOW | O_CLOEXEC,
> +               .resolve = RESOLVE_NO_SYMLINKS | RESOLVE_NO_MAGICLINKS,
> +       };
> +
> +       nfd = syscall(__NR_openat2, AT_FDCWD, path, &how, sizeof(how));
> +       if (nfd >= 0) {
> +               if (fstat(nfd, sb) < 0) {
> +                       close(nfd);
> +                       return -1;
> +               }
> +               return nfd;
> +       }
> +
> +       if (errno != ENOSYS && errno != EINVAL)
> +               return -1;
> +#endif
> +
>         copy = strdup(path);
>         if (!copy)
>                 return -1;
> --
> 2.54.0
>