| 1 | /* Prototypes for openat-style fd-relative SELinux functions
|
|---|
| 2 | Copyright (C) 2007, 2009-2016 Free Software Foundation, Inc.
|
|---|
| 3 |
|
|---|
| 4 | This program is free software: you can redistribute it and/or modify
|
|---|
| 5 | it under the terms of the GNU General Public License as published by
|
|---|
| 6 | the Free Software Foundation, either version 3 of the License, or
|
|---|
| 7 | (at your option) any later version.
|
|---|
| 8 |
|
|---|
| 9 | This program is distributed in the hope that it will be useful,
|
|---|
| 10 | but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|---|
| 11 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|---|
| 12 | GNU General Public License for more details.
|
|---|
| 13 |
|
|---|
| 14 | You should have received a copy of the GNU General Public License
|
|---|
| 15 | along with this program. If not, see <http://www.gnu.org/licenses/>. */
|
|---|
| 16 |
|
|---|
| 17 | #include <selinux/selinux.h>
|
|---|
| 18 | #include <selinux/context.h>
|
|---|
| 19 |
|
|---|
| 20 | /* These are the dir-fd-relative variants of the functions without the
|
|---|
| 21 | "at" suffix. For example, getfileconat (AT_FDCWD, file, &c) is usually
|
|---|
| 22 | equivalent to getfilecon (file, &c). The emulation is accomplished
|
|---|
| 23 | by first attempting getfilecon ("/proc/self/fd/DIR_FD/FILE", &c).
|
|---|
| 24 | Failing that, simulate it via save_cwd/fchdir/getfilecon/restore_cwd.
|
|---|
| 25 | If either the save_cwd or the restore_cwd fails (relatively unlikely),
|
|---|
| 26 | then give a diagnostic and exit nonzero. */
|
|---|
| 27 |
|
|---|
| 28 | /* dir-fd-relative getfilecon. Set *CON to the SELinux security context
|
|---|
| 29 | of the file specified by DIR_FD and FILE and return the length of *CON.
|
|---|
| 30 | DIR_FD and FILE are interpreted as for fstatat[*]. A non-NULL *CON
|
|---|
| 31 | must be freed with freecon. Upon error, set *CON to NULL, set errno
|
|---|
| 32 | and return -1.
|
|---|
| 33 | [*] with flags=0 here, with flags=AT_SYMLINK_NOFOLLOW for lgetfileconat */
|
|---|
| 34 | int getfileconat (int dir_fd, char const *file, security_context_t *con);
|
|---|
| 35 |
|
|---|
| 36 | /* dir-fd-relative lgetfilecon. This function is just like getfileconat,
|
|---|
| 37 | except when DIR_FD and FILE specify a symlink: lgetfileconat operates on
|
|---|
| 38 | the symlink, while getfileconat operates on the referent of the symlink. */
|
|---|
| 39 | int lgetfileconat (int dir_fd, char const *file, security_context_t *con);
|
|---|
| 40 |
|
|---|
| 41 | /* dir-fd-relative setfilecon. Set the SELinux security context of
|
|---|
| 42 | the file specified by DIR_FD and FILE to CON. DIR_FD and FILE are
|
|---|
| 43 | interpreted as for fstatat[*]. Upon success, return 0.
|
|---|
| 44 | Otherwise, return -1 and set errno. */
|
|---|
| 45 | int setfileconat (int dir_fd, char const *file, security_context_t con);
|
|---|
| 46 |
|
|---|
| 47 | /* dir-fd-relative lsetfilecon. This function is just like setfileconat,
|
|---|
| 48 | except that rather than dereferencing a symlink, this function affects it. */
|
|---|
| 49 | /* dir-fd-relative lsetfilecon. This function is just like setfileconat,
|
|---|
| 50 | except when DIR_FD and FILE specify a symlink: lsetfileconat operates on
|
|---|
| 51 | the symlink, while setfileconat operates on the referent of the symlink. */
|
|---|
| 52 | int lsetfileconat (int dir_fd, char const *file, security_context_t con);
|
|---|
