lib/selinux-at.h

   1 /* Prototypes for openat-style fd-relative SELinux functions
   2    Copyright (C) 2007, 2009-2024 Free Software Foundation, Inc.
   3
   4    This program is free software: you can redistribute it and/or modify
   5    it under the terms of the GNU General Public License as published by
   6    the Free Software Foundation, either version 3 of the License, or
   7    (at your option) any later version.
   8
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13
  14    You should have received a copy of the GNU General Public License
  15    along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
  16
  17 #include <selinux/selinux.h>
  18 #include <selinux/context.h>
  19
  20 #ifdef __cplusplus
  21 extern "C" {
  22 #endif
  23
  24
  25 /* These are the dir-fd-relative variants of the functions without the
  26    "at" suffix.  For example, getfileconat (AT_FDCWD, file, &c) is usually
  27    equivalent to getfilecon (file, &c).  The emulation is accomplished
  28    by first attempting getfilecon ("/proc/self/fd/DIR_FD/FILE", &c).
  29    Failing that, simulate it via save_cwd/fchdir/getfilecon/restore_cwd.
  30    If either the save_cwd or the restore_cwd fails (relatively unlikely),
  31    then give a diagnostic and exit nonzero.  */
  32
  33 /* dir-fd-relative getfilecon.  Set *CON to the SELinux security context
  34    of the file specified by DIR_FD and FILE and return the length of *CON.
  35    DIR_FD and FILE are interpreted as for fstatat[*].  A non-NULL *CON
  36    must be freed with freecon.  Upon error, set *CON to NULL, set errno
  37    and return -1.
  38    [*] with flags=0 here, with flags=AT_SYMLINK_NOFOLLOW for lgetfileconat  */
  39 int  getfileconat (int dir_fd, char const *file, char **con);
  40
  41 /* dir-fd-relative lgetfilecon.  This function is just like getfileconat,
  42    except when DIR_FD and FILE specify a symlink:  lgetfileconat operates on
  43    the symlink, while getfileconat operates on the referent of the symlink.  */
  44 int lgetfileconat (int dir_fd, char const *file, char **con);
  45
  46 /* dir-fd-relative setfilecon.  Set the SELinux security context of
  47    the file specified by DIR_FD and FILE to CON.  DIR_FD and FILE are
  48    interpreted as for fstatat[*].  Upon success, return 0.
  49    Otherwise, return -1 and set errno.  */
  50 int  setfileconat (int dir_fd, char const *file, char const *con);
  51
  52 /* dir-fd-relative lsetfilecon.  This function is just like setfileconat,
  53    except that rather than dereferencing a symlink, this function affects it. */
  54 /* dir-fd-relative lsetfilecon.  This function is just like setfileconat,
  55    except when DIR_FD and FILE specify a symlink:  lsetfileconat operates on
  56    the symlink, while setfileconat operates on the referent of the symlink.  */
  57 int lsetfileconat (int dir_fd, char const *file, char const *con);
  58
  59
  60 #ifdef __cplusplus
  61 }
  62 #endif