[PATCH 2/2] policycoreutils/setfiles: enable SELINUX_RESTORECON_REALPATH by default

restorecon enables SELINUX_RESTORECON_REALPATH by default for
selinux_restorecon(3) calls on its command-line arguments; do the same
for setfiles. The command-line interface is not a trust boundary
and we always want to label files based on their canonical pathname.

Reported-by: Krzesimir Nowak <[email protected]>
Fixes: 67bc978bfaf9 ("libselinux: restorecon: revisit pinning files to avoid TOCTOU issues")
Fixes: https://github.com/SELinuxProject/selinux/issues/540
Signed-off-by: Stephen Smalley <[email protected]>
---
 policycoreutils/setfiles/setfiles.8 | 4 +++-
 policycoreutils/setfiles/setfiles.c | 7 +++----
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/policycoreutils/setfiles/setfiles.8 b/policycoreutils/setfiles/setfiles.8
index 17cabe37..b521df22 100644
--- a/policycoreutils/setfiles/setfiles.8
+++ b/policycoreutils/setfiles/setfiles.8
@@ -264,7 +264,9 @@ otherwise.
 .IP "1." 4
 .B setfiles
 operates recursively on directories. Paths leading up the final
-component of the file(s) are not canonicalized before labeling.
+component of the file(s) are canonicalized using
+.BR realpath (3)
+before labeling.
 .IP "2." 4
 If the
 .I pathname
diff --git a/policycoreutils/setfiles/setfiles.c b/policycoreutils/setfiles/setfiles.c
index 07f0b5fc..da5d2024 100644
--- a/policycoreutils/setfiles/setfiles.c
+++ b/policycoreutils/setfiles/setfiles.c
@@ -173,18 +173,19 @@ int main(int argc, char **argv)
 	}
 	base = basename(r_opts.progname);
 
+	/* Common to setfiles and restorecon */
+	r_opts.userealpath = SELINUX_RESTORECON_REALPATH;
+
 	if (!strcmp(base, SETFILES)) {
 		/*
 		 * setfiles:
 		 * Recursive descent,
-		 * Does not expand paths via realpath,
 		 * Try to track inode associations for conflict detection,
 		 * Does not follow mounts (sets SELINUX_RESTORECON_XDEV),
 		 * Validates all file contexts at init time.
 		 */
 		iamrestorecon = false;
 		r_opts.recurse = SELINUX_RESTORECON_RECURSE;
-		r_opts.userealpath = 0; /* SELINUX_RESTORECON_REALPATH */
 		r_opts.add_assoc = SELINUX_RESTORECON_ADD_ASSOC;
 		/* FTS_PHYSICAL and FTS_NOCHDIR are always set by selinux_restorecon(3) */
 		r_opts.xdev = SELINUX_RESTORECON_XDEV;
@@ -195,7 +196,6 @@ int main(int argc, char **argv)
 		/*
 		 * restorecon:
 		 * No recursive descent unless -r/-R,
-		 * Expands paths via realpath,
 		 * Do not try to track inode associations for conflict detection,
 		 * Follows mounts,
 		 * Does lazy validation of contexts upon use.
@@ -207,7 +207,6 @@ int main(int argc, char **argv)
 
 		iamrestorecon = true;
 		r_opts.recurse = 0;
-		r_opts.userealpath = SELINUX_RESTORECON_REALPATH;
 		r_opts.add_assoc = 0;
 		r_opts.xdev = 0;
 		r_opts.ignore_mounts = 0;
-- 
2.55.0