[PATCH] policycoreutils/setfiles: introduce -j for skip_multilink

Introduce a new -j option to setfiles and restorecon to enable the
recently introduced SELINUX_RESTORECON_SKIP_MULTILINK flag to
selinux_restorecon(3) to detect files with multiple hard links and
skip them when relabeling to avoid unintended mislabeling of such
files. This option is recommended when relabeling user-writable
directory trees.

Signed-off-by: Stephen Smalley <[email protected]>
---
 policycoreutils/setfiles/restore.c    | 2 +-
 policycoreutils/setfiles/restore.h    | 1 +
 policycoreutils/setfiles/restorecon.8 | 6 ++++++
 policycoreutils/setfiles/setfiles.8   | 5 +++++
 policycoreutils/setfiles/setfiles.c   | 8 ++++++--
 5 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/policycoreutils/setfiles/restore.c b/policycoreutils/setfiles/restore.c
index 1e3644f5..edce44b5 100644
--- a/policycoreutils/setfiles/restore.c
+++ b/policycoreutils/setfiles/restore.c
@@ -42,7 +42,7 @@ void restore_init(struct restore_opts *opts)
 		opts->xdev | opts->abort_on_error | opts->syslog_changes |
 		opts->log_matches | opts->ignore_noent | opts->ignore_mounts |
 		opts->mass_relabel | opts->conflict_error | opts->count_errors |
-		opts->count_relabeled;
+		opts->count_relabeled | opts->skip_multilink;
 
 	/* Use setfiles, restorecon and restorecond own handles */
 	selinux_restorecon_set_sehandle(opts->hnd);
diff --git a/policycoreutils/setfiles/restore.h b/policycoreutils/setfiles/restore.h
index 36f73059..bf3979f1 100644
--- a/policycoreutils/setfiles/restore.h
+++ b/policycoreutils/setfiles/restore.h
@@ -38,6 +38,7 @@ struct restore_opts {
 	unsigned int conflict_error;
 	unsigned int count_errors;
 	unsigned int count_relabeled;
+	unsigned int skip_multilink;
 	/* restorecon_flags holds | of above for restore_init() */
 	unsigned int restorecon_flags;
 	char *rootpath;
diff --git a/policycoreutils/setfiles/restorecon.8 b/policycoreutils/setfiles/restorecon.8
index b7ff9715..982701c2 100644
--- a/policycoreutils/setfiles/restorecon.8
+++ b/policycoreutils/setfiles/restorecon.8
@@ -10,6 +10,7 @@ restorecon \- restore file(s) default SELinux security contexts.
 .RB [ \-p ]
 .RB [ \-v ]
 .RB [ \-i ]
+.RB [ \-j ]
 .RB [ \-F ]
 .RB [ \-U ]
 .RB [ \-W ]
@@ -30,6 +31,7 @@ restorecon \- restore file(s) default SELinux security contexts.
 .RB [ \-p ]
 .RB [ \-v ]
 .RB [ \-i ]
+.RB [ \-j ]
 .RB [ \-F ]
 .RB [ \-U ]
 .RB [ \-W ]
@@ -88,6 +90,10 @@ contains a list of files to be processed. Use
 for
 .BR stdin .
 .TP
+.B \-j
+skip files with multiple hard links to avoid unintentional mislabeling,
+particularly when relabeling user-writable directories.
+.TP
 .B \-F
 Force reset of context to match file_context for customizable files, and the
 default file context, changing the user, role, range portion as well as the type.
diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
index d43e4ad2..d55b42db 100644
--- a/policycoreutils/setfiles/setfiles.8
+++ b/policycoreutils/setfiles/setfiles.8
@@ -8,6 +8,7 @@ setfiles \- set SELinux file security contexts.
 .IR policy ]
 .RB [ \-C ]
 .RB [ \-d ]
+.RB [ \-j ]
 .RB [ \-l ]
 .RB [ \-m ]
 .RB [ \-n ]
@@ -117,6 +118,10 @@ enable usage of the
 .IR security.sehash
 extended attribute.
 .TP
+.B \-j
+skip files with multiple hard links to avoid unintentional mislabeling,
+particularly when relabeling user-writable directories.
+.TP
 .B \-l
 log changes in file labels to syslog.
 .TP
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
index 2d38ea8f..567d519f 100644
--- a/policycoreutils/setfiles/setfiles.c
+++ b/policycoreutils/setfiles/setfiles.c
@@ -145,8 +145,8 @@ int main(int argc, char **argv)
 	size_t buf_len, nthreads = 1;
 	const char *base;
 	int errors = 0;
-	const char *ropts = "ce:f:hiIDlmno:pqrsvFURW0xT:";
-	const char *sopts = "c:de:f:hiIDlmno:pqr:svACEFUR:W0T:";
+	const char *ropts = "ce:f:hijIDlmno:pqrsvFURW0xT:";
+	const char *sopts = "c:de:f:hijIDlmno:pqr:svACEFUR:W0T:";
 	const char *opts;
 	union selinux_callback cb;
 	long unsigned skipped_errors;
@@ -276,6 +276,10 @@ int main(int argc, char **argv)
 		case 'i':
 			r_opts.ignore_noent = SELINUX_RESTORECON_IGNORE_NOENTRY;
 			break;
+		case 'j':
+			r_opts.skip_multilink =
+				SELINUX_RESTORECON_SKIP_MULTILINK;
+			break;
 		case 'I': /* Force label check by ignoring directory digest. */
 			r_opts.ignore_digest = SELINUX_RESTORECON_IGNORE_DIGEST;
 			request_digest = 1;
-- 
2.55.0