Re: getfilecon return code

Steve,

Thanks for your quick reply.

Stephen Smalley <sds@tycho.nsa.gov> writes:

> On Mon, 2007-07-09 at 14:07 -0400, John D. Ramsdell wrote:
> > ... In fact, I wrote code that freecon'd a context whenever the
> > return value was not -1.
>
> freecon(NULL) is perfectly legal and harmless, like free(NULL), so
> that part is ok.

There is also the case of printing a security context. The getfilecon program that is part of the libselinux package thinks one can print a security context if the return code is non-negative, and thus prints:

/proc/sys/kernel/pid_max (null)

If some other program tried to use the second field of this output as a security context, it could spell trouble.

John

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.