Simon de Vlieger
6b0e3ea222
SELinux labeling with --root/--image needs per-call context to carry an alternate policy database and root prefix. The current LabelOps interface has no way to pass this, forcing any solution to rely on global state. Add a LabelContext *label_context to the label_ops callbacks and all intermediate layers. Generic filesystem functions that most callers use (xopenat_full, write_string_file_full, etc.) get a _label variant carrying the extra parameter, with inline wrappers preserving the original signatures so the vast majority of call sites remain untouched. Signed-off-by: Simon de Vlieger <cmdr@supakeen.com>
31 lines
709 B
C
31 lines
709 B
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
|
|
|
#include <sys/stat.h>
|
|
|
|
#include "selinux-util.h"
|
|
#include "tmpfile-util.h"
|
|
|
|
int fopen_temporary_at_label(
|
|
int dir_fd,
|
|
const char *target,
|
|
const char *path,
|
|
FILE **f,
|
|
char **temp_path,
|
|
LabelContext *label_context) {
|
|
|
|
int r;
|
|
|
|
assert(dir_fd >= 0 || dir_fd == AT_FDCWD);
|
|
assert(path);
|
|
|
|
r = mac_selinux_create_file_prepare_at(dir_fd, target, S_IFREG, label_context);
|
|
if (r < 0)
|
|
return r;
|
|
|
|
r = fopen_temporary_at(dir_fd, path, f, temp_path);
|
|
|
|
mac_selinux_create_file_clear();
|
|
|
|
return r;
|
|
}
|