Re: [PATCH 01/24] libselinux/include: fix man page grammar, wording and consistency nits

On Tue, Jun 23, 2026 at 10:52 AM Stephen Smalley
<[email protected]> wrote:
>
> On Tue, Jun 23, 2026 at 9:44 AM Christian Göttsche
> <[email protected]> wrote:
> >
> > From: Christian Göttsche <[email protected]>
> >
> > Drop a duplicated "and" in the avc_add_callback() header comment.
> >
> > The selabel_handle pointer parameter was named inconsistently across the
> > public headers (handle, rec, hndl) and the man pages used hnd.
> > Standardize on "handle" in the headers; selabel_cmp keeps h1/h2 as it
> > compares two handles.
> >
> > Reword "allows to run/use" phrasing.
> >
> > Correct the selabel_cmp() @h2 kernel-doc (second, not first handle) and
> > the grammar of the selinux_set_mapping() comment.
> >
> > Fix RGB triple count in selinux_raw_context_to_color() comment; the
> > comment claimed "ten ten hex RGB triples" (a duplicated word and the
> > wrong count). The function returns eight triples: foreground and
> > background for each of the user, role, type and range components,
> > matching selinux_raw_context_to_color(3).
> >
> > Assisted-by: Claude:claude-4.8-opus
> > Signed-off-by: Christian Göttsche <[email protected]>
>
> Note that you didn't make the corresponding changes to the .c files,
> but that's not necessarily a problem.
>
> Acked-by: Stephen Smalley <[email protected]>

With the exception of the patches for audit2why that call free_bools()
(used before being defined) and any subsequent patches that would no
longer apply, this series has been merged.
In particular, patches 19, 20, 21, 22, and 23 were NOT applied for
this reason but feel free to re-submit once you resolve the ordering
issue.

>
> > ---
> >  libselinux/include/selinux/avc.h        |  2 +-
> >  libselinux/include/selinux/label.h      | 23 +++++++++++------------
> >  libselinux/include/selinux/restorecon.h |  6 +++---
> >  libselinux/include/selinux/selinux.h    |  6 +++---
> >  4 files changed, 18 insertions(+), 19 deletions(-)
> >
> > diff --git a/libselinux/include/selinux/avc.h b/libselinux/include/selinux/avc.h
> > index 1fefbf4e..6d728ce0 100644
> > --- a/libselinux/include/selinux/avc.h
> > +++ b/libselinux/include/selinux/avc.h
> > @@ -379,7 +379,7 @@ extern int avc_compute_member(security_id_t ssid, security_id_t tsid,
> >   *
> >   * Register a callback function for events in the set @events
> >   * related to the SID pair (@ssid, @tsid) and
> > - * and the permissions @perms, interpreting
> > + * the permissions @perms, interpreting
> >   * @perms based on @tclass.  Returns %0 on success or
> >   * -%1 if insufficient memory exists to add the callback.
> >   */
> > diff --git a/libselinux/include/selinux/label.h b/libselinux/include/selinux/label.h
> > index 05e1fd56..748b0db0 100644
> > --- a/libselinux/include/selinux/label.h
> > +++ b/libselinux/include/selinux/label.h
> > @@ -107,20 +107,19 @@ extern int selabel_lookup_raw(struct selabel_handle *handle, char **con,
> >  extern bool selabel_partial_match(struct selabel_handle *handle,
> >                                   const char *key);
> >
> > -extern bool selabel_get_digests_all_partial_matches(struct selabel_handle *rec,
> > -                                                   const char *key,
> > -                                                   uint8_t **calculated_digest,
> > -                                                   uint8_t **xattr_digest,
> > -                                                   size_t *digest_len);
> > -extern bool selabel_hash_all_partial_matches(struct selabel_handle *rec,
> > +extern bool selabel_get_digests_all_partial_matches(
> > +       struct selabel_handle *handle, const char *key,
> > +       uint8_t **calculated_digest, uint8_t **xattr_digest,
> > +       size_t *digest_len);
> > +extern bool selabel_hash_all_partial_matches(struct selabel_handle *handle,
> >                                              const char *key, uint8_t *digest);
> >
> > -extern int selabel_lookup_best_match(struct selabel_handle *rec, char **con,
> > +extern int selabel_lookup_best_match(struct selabel_handle *handle, char **con,
> >                                      const char *key, const char **aliases,
> >                                      int type);
> > -extern int selabel_lookup_best_match_raw(struct selabel_handle *rec, char **con,
> > -                                        const char *key, const char **aliases,
> > -                                        int type);
> > +extern int selabel_lookup_best_match_raw(struct selabel_handle *handle,
> > +                                        char **con, const char *key,
> > +                                        const char **aliases, int type);
> >
> >  /**
> >   * selabel_digest - Retrieve the SHA1 digest and the list of specfiles used to
> > @@ -135,7 +134,7 @@ extern int selabel_lookup_best_match_raw(struct selabel_handle *rec, char **con,
> >   *
> >   * Return %0 on success, -%1 with @errno set on failure.
> >   */
> > -extern int selabel_digest(struct selabel_handle *rec, unsigned char **digest,
> > +extern int selabel_digest(struct selabel_handle *handle, unsigned char **digest,
> >                           size_t *digest_len, char ***specfiles,
> >                           size_t *num_specfiles);
> >
> > @@ -149,7 +148,7 @@ enum selabel_cmp_result {
> >  /**
> >   * selabel_cmp - Compare two label configurations.
> >   * @h1: handle for the first label configuration
> > - * @h2: handle for the first label configuration
> > + * @h2: handle for the second label configuration
> >   *
> >   * Compare two label configurations.
> >   * Return %SELABEL_SUBSET if @h1 is a subset of @h2, %SELABEL_EQUAL
> > diff --git a/libselinux/include/selinux/restorecon.h b/libselinux/include/selinux/restorecon.h
> > index 6680589e..34ba0f43 100644
> > --- a/libselinux/include/selinux/restorecon.h
> > +++ b/libselinux/include/selinux/restorecon.h
> > @@ -33,7 +33,7 @@ extern int selinux_restorecon(const char *pathname,
> >   * @nthreads: specifies the number of threads to use (0 = use number of CPUs
> >   *            currently online)
> >   *
> > - * Same as selinux_restorecon(3), but allows to use multiple threads to do
> > + * Same as selinux_restorecon(3), but allows the use of multiple threads to do
> >   * the work.
> >   */
> >  extern int selinux_restorecon_parallel(const char *pathname,
> > @@ -146,13 +146,13 @@ extern int selinux_restorecon_parallel(const char *pathname,
> >
> >  /**
> >   * selinux_restorecon_set_sehandle - Set the global fc handle.
> > - * @hndl: specifies handle to set as the global fc handle.
> > + * @handle: specifies handle to set as the global fc handle.
> >   *
> >   * Called by a process that has already called selabel_open(3) with its
> >   * required parameters, or if selinux_restorecon_default_handle(3) has been
> >   * called to set the default selabel_open(3) parameters.
> >   */
> > -extern void selinux_restorecon_set_sehandle(struct selabel_handle *hndl);
> > +extern void selinux_restorecon_set_sehandle(struct selabel_handle *handle);
> >
> >  /**
> >   * selinux_restorecon_default_handle - Sets default selabel_open(3) parameters
> > diff --git a/libselinux/include/selinux/selinux.h b/libselinux/include/selinux/selinux.h
> > index de56b727..364f955d 100644
> > --- a/libselinux/include/selinux/selinux.h
> > +++ b/libselinux/include/selinux/selinux.h
> > @@ -387,7 +387,7 @@ struct security_class_mapping {
> >   * offsets for a particular policy.  However, that strongly ties the build of the userspace components to a particular policy.
> >   *
> >   * By using this function to map between integer offsets and security
> > - * class names, it's possible to replace a system policies that have
> > + * class names, it's possible to replace a system policy with one that has
> >   * at least the same set of security class names as used by the
> >   * userspace object managers.
> >   *
> > @@ -689,8 +689,8 @@ extern int selinux_trans_to_raw_context(const char *trans, char **rawp);
> >  extern int selinux_raw_to_trans_context(const char *raw, char **transp);
> >
> >  /* Perform context translation between security contexts
> > -   and display colors.  Returns a space-separated list of ten
> > -   ten hex RGB triples prefixed by hash marks, e.g. "#ff0000".
> > +   and display colors.  Returns a space-separated list of eight
> > +   hex RGB triples prefixed by hash marks, e.g. "#ff0000".
> >     Caller must free the resulting string via free.
> >     Returns -1 upon an error or 0 otherwise. */
> >  extern int selinux_raw_context_to_color(const char *raw, char **color_str);
> > --
> > 2.53.0
> >
> >