Merge pull request #26969 from DaanDeMeyer/xopenat-label

fs-util: Add labelling support to xopenat()

src/shared/btrfs-util.c

@@ -223,7 +223,7 @@ int btrfs_get_block_device_at(int dir_fd, const char *path, dev_t *ret) {
         assert(path);
         assert(ret);
 
-        fd = xopenat(dir_fd, path, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY, 0);
+        fd = xopenat(dir_fd, path, O_RDONLY|O_CLOEXEC|O_NONBLOCK|O_NOCTTY, /* xopen_flags = */ 0, /* mode = */ 0);
         if (fd < 0)
                 return fd;
 

src/shared/dev-setup.c

@@ -6,7 +6,7 @@
 
 #include "alloc-util.h"
 #include "dev-setup.h"
-#include "label.h"
+#include "label-util.h"
 #include "log.h"
 #include "mkdir-label.h"
 #include "nulstr-util.h"

src/shared/hwdb-util.c

@@ -11,7 +11,7 @@
 #include "fs-util.h"
 #include "hwdb-internal.h"
 #include "hwdb-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "mkdir-label.h"
 #include "nulstr-util.h"
 #include "path-util.h"

src/shared/label-util.c

@@ -7,6 +7,7 @@
 #include "btrfs-util.h"
 #include "fs-util.h"
 #include "label.h"
+#include "label-util.h"
 #include "macro.h"
 #include "selinux-util.h"
 #include "smack-util.h"
@@ -115,3 +116,15 @@ int btrfs_subvol_make_label(const char *path) {
 
         return mac_smack_fix(path, 0);
 }
+
+int mac_init(void) {
+        int r;
+
+        assert(!(mac_selinux_use() && mac_smack_use()));
+
+        r = mac_selinux_init();
+        if (r < 0)
+                return r;
+
+        return mac_smack_init();
+}

src/shared/label-util.h

@@ -24,3 +24,5 @@ static inline int symlink_atomic_label(const char *from, const char *to) {
 int mknod_label(const char *pathname, mode_t mode, dev_t dev);
 
 int btrfs_subvol_make_label(const char *path);
+
+int mac_init(void);

src/shared/loop-util.c

@@ -677,9 +677,9 @@ int loop_device_make_by_path_at(
         direct_flags = FLAGS_SET(loop_flags, LO_FLAGS_DIRECT_IO) ? O_DIRECT : 0;
         rdwr_flags = open_flags >= 0 ? open_flags : O_RDWR;
 
-        fd = xopenat(dir_fd, path, basic_flags|direct_flags|rdwr_flags, 0);
+        fd = xopenat(dir_fd, path, basic_flags|direct_flags|rdwr_flags, /* xopen_flags = */ 0, /* mode = */ 0);
         if (fd < 0 && direct_flags != 0) /* If we had O_DIRECT on, and things failed with that, let's immediately try again without */
-                fd = xopenat(dir_fd, path, basic_flags|rdwr_flags, 0);
+                fd = xopenat(dir_fd, path, basic_flags|rdwr_flags, /* xopen_flags = */ 0, /* mode = */ 0);
         else
                 direct = direct_flags != 0;
         if (fd < 0) {
@@ -689,9 +689,9 @@ int loop_device_make_by_path_at(
                 if (open_flags >= 0 || !(ERRNO_IS_PRIVILEGE(r) || r == -EROFS))
                         return r;
 
-                fd = xopenat(dir_fd, path, basic_flags|direct_flags|O_RDONLY, 0);
+                fd = xopenat(dir_fd, path, basic_flags|direct_flags|O_RDONLY, /* xopen_flags = */ 0, /* mode = */ 0);
                 if (fd < 0 && direct_flags != 0) /* as above */
-                        fd = xopenat(dir_fd, path, basic_flags|O_RDONLY, 0);
+                        fd = xopenat(dir_fd, path, basic_flags|O_RDONLY, /* xopen_flags = */ 0, /* mode = */ 0);
                 else
                         direct = direct_flags != 0;
                 if (fd < 0)

src/shared/machine-pool.c

@@ -3,7 +3,7 @@
 #include <errno.h>
 
 #include "btrfs-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "machine-pool.h"
 #include "missing_magic.h"
 #include "stat-util.h"

src/shared/meson.build

@@ -96,7 +96,7 @@ shared_sources = files(
         'kernel-image.c',
         'keyring-util.c',
         'killall.c',
-        'label.c',
+        'label-util.c',
         'libcrypt-util.c',
         'libfido2-util.c',
         'libmount-util.c',

src/shared/mount-setup.c

@@ -17,7 +17,7 @@
 #include "fd-util.h"
 #include "fileio.h"
 #include "fs-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "log.h"
 #include "macro.h"
 #include "mkdir-label.h"

src/shared/mount-util.c

@@ -22,7 +22,7 @@
 #include "glyph-util.h"
 #include "hashmap.h"
 #include "initrd-util.h"
-#include "label.h"
+#include "label-util.h"
 #include "libmount-util.h"
 #include "missing_mount.h"
 #include "missing_syscall.h"

src/shared/selinux-util.c

@@ -20,6 +20,7 @@
 #include "alloc-util.h"
 #include "errno-util.h"
 #include "fd-util.h"
+#include "label.h"
 #include "log.h"
 #include "macro.h"
 #include "mallinfo-util.h"
@@ -54,6 +55,15 @@ static bool have_status_page = false;
                         : -ERRNO_VALUE(_e);                             \
                 _enforcing ? _r : 0;                                    \
         })
+
+static int mac_selinux_label_pre(int dir_fd, const char *path, mode_t mode) {
+        return mac_selinux_create_file_prepare_at(dir_fd, path, mode);
+}
+
+static int mac_selinux_label_post(int dir_fd, const char *path) {
+        mac_selinux_create_file_clear();
+        return 0;
+}
 #endif
 
 bool mac_selinux_use(void) {
@@ -128,6 +138,10 @@ static int open_label_db(void) {
 
 int mac_selinux_init(void) {
 #if HAVE_SELINUX
+        static const LabelOps label_ops = {
+                .pre = mac_selinux_label_pre,
+                .post = mac_selinux_label_post,
+        };
         int r;
 
         if (initialized)
@@ -152,6 +166,10 @@ int mac_selinux_init(void) {
                 return r;
         }
 
+        r = label_ops_set(&label_ops);
+        if (r < 0)
+                return r;
+
         /* Save the current policyload sequence number, so mac_selinux_maybe_reload() does not trigger on
          * first call without any actual change. */
         last_policyload = selinux_status_policyload();

src/shared/selinux-util.h

@@ -7,7 +7,7 @@
 #include <sys/types.h>
 
 #include "macro.h"
-#include "label.h"
+#include "label-util.h"
 
 #if HAVE_SELINUX
 #include <selinux/selinux.h>

src/shared/smack-util.c

@@ -15,6 +15,7 @@
 #include "errno-util.h"
 #include "fd-util.h"
 #include "fileio.h"
+#include "label.h"
 #include "log.h"
 #include "macro.h"
 #include "path-util.h"
@@ -288,3 +289,23 @@ int renameat_and_apply_smack_floor_label(int fdf, const char *from, int fdt, con
         return 0;
 #endif
 }
+
+static int mac_smack_label_pre(int dir_fd, const char *path, mode_t mode) {
+        return 0;
+}
+
+static int mac_smack_label_post(int dir_fd, const char *path) {
+        return mac_smack_fix_full(dir_fd, path, NULL, 0);
+}
+
+int mac_smack_init(void) {
+        static const LabelOps label_ops = {
+                .pre = mac_smack_label_pre,
+                .post = mac_smack_label_post,
+        };
+
+        if (!mac_smack_use())
+                return 0;
+
+        return label_ops_set(&label_ops);
+}

src/shared/smack-util.h

@@ -10,7 +10,7 @@
 #include <stdbool.h>
 #include <sys/types.h>
 
-#include "label.h"
+#include "label-util.h"
 #include "macro.h"
 
 #define SMACK_FLOOR_LABEL "_"
@@ -28,6 +28,7 @@ typedef enum SmackAttr {
 } SmackAttr;
 
 bool mac_smack_use(void);
+int mac_smack_init(void);
 
 int mac_smack_fix_full(int atfd, const char *inode_path, const char *label_path, LabelFixFlags flags);
 static inline int mac_smack_fix(const char *path, LabelFixFlags flags) {