Re: [PATCH 1/2] libselinux: selinux_restorecon: fix error message on intermediate symlinks

On Mon, Aug 17, 2026 at 11:04 AM James Carter <[email protected]> wrote:
>
> On Fri, Aug 14, 2026 at 9:35 AM Stephen Smalley
> <[email protected]> wrote:
> >
> > selinux_restorecon(3) was changed by commit 67bc978bfaf9 ("libselinux:
> > restorecon: revisit pinning files to avoid TOCTOU issues") to avoid
> > following intermediate symlinks on the caller-supplied pathname unless
> > the SELINUX_RESTORECON_REALPATH flag was set in the restorecon_flags
> > parameter. However, because it calls openat(2) with both O_NOFOLLOW
> > and O_DIRECTORY, the errno was being set to ENOTDIR and a message was
> > logged with the pathname being "Not a directory" even if the terminal
> > node of the path was in fact a directory. Fix the error handling logic
> > and log message to correctly reflect the intermediate symlink-induced
> > failure.
> >
> > Reported-by: Krzesimir Nowak <[email protected]>
> > Fixes: 67bc978bfaf9 ("libselinux: restorecon: revisit pinning files to avoid TOCTOU issues")
> > Fixes: https://github.com/SELinuxProject/selinux/issues/540
> > Signed-off-by: Stephen Smalley <[email protected]>
>
> For these two patches:
> Acked-by: James Carter <[email protected]>

Thanks, merged.