Re: [PATCH v2 1/3] libselinux: selinux_restorecon: use openat2 if defined

On Mon, Jul 6, 2026 at 11:39 AM James Carter <[email protected]> wrote:
>
> On Mon, Jul 6, 2026 at 10:37 AM Stephen Smalley
> <[email protected]> wrote:
> >
> > Update selinux_restorecon()'s safe_open() helper to use openat2()
> > if defined to optimize the lookup of the initial pathname. Fall
> > back to the existing per-component lookup on ENOSYS/EINVAL so
> > that pre-5.6 and seccomp-filtered environments are unaffected.
> >
> > Signed-off-by: Stephen Smalley <[email protected]>
>
> For these three patches:
> Acked-by: James Carter <[email protected]>
>

These three patches have been merged.
Thanks,
Jim

> > ---
> >  libselinux/src/selinux_restorecon.c | 23 +++++++++++++++++++++++
> >  1 file changed, 23 insertions(+)
> >
> > diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c
> > index b34d8e60..30f1b836 100644
> > --- a/libselinux/src/selinux_restorecon.c
> > +++ b/libselinux/src/selinux_restorecon.c
> > @@ -25,7 +25,11 @@
> >  #include <sys/vfs.h>
> >  #include <sys/statvfs.h>
> >  #include <sys/utsname.h>
> > +#include <sys/syscall.h>
> >  #include <linux/magic.h>
> > +#ifdef __NR_openat2
> > +#include <linux/openat2.h>
> > +#endif
> >  #include <libgen.h>
> >  #include <syslog.h>
> >  #include <assert.h>
> > @@ -1114,6 +1118,25 @@ static int safe_open(const char *path, struct stat *sb)
> >                 return -1;
> >         }
> >
> > +#ifdef __NR_openat2
> > +       struct open_how how = {
> > +               .flags = O_PATH | O_NOFOLLOW | O_CLOEXEC,
> > +               .resolve = RESOLVE_NO_SYMLINKS | RESOLVE_NO_MAGICLINKS,
> > +       };
> > +
> > +       nfd = syscall(__NR_openat2, AT_FDCWD, path, &how, sizeof(how));
> > +       if (nfd >= 0) {
> > +               if (fstat(nfd, sb) < 0) {
> > +                       close(nfd);
> > +                       return -1;
> > +               }
> > +               return nfd;
> > +       }
> > +
> > +       if (errno != ENOSYS && errno != EINVAL)
> > +               return -1;
> > +#endif
> > +
> >         copy = strdup(path);
> >         if (!copy)
> >                 return -1;
> > --
> > 2.54.0
> >