1  /* Prototypes for openat-style fd-relative SELinux functions
       2     Copyright (C) 2007, 2009-2023 Free Software Foundation, Inc.
       3  
       4     This program is free software: you can redistribute it and/or modify
       5     it under the terms of the GNU General Public License as published by
       6     the Free Software Foundation, either version 3 of the License, or
       7     (at your option) any later version.
       8  
       9     This program is distributed in the hope that it will be useful,
      10     but WITHOUT ANY WARRANTY; without even the implied warranty of
      11     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
      12     GNU General Public License for more details.
      13  
      14     You should have received a copy of the GNU General Public License
      15     along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
      16  
      17  #include <selinux/selinux.h>
      18  #include <selinux/context.h>
      19  
      20  /* These are the dir-fd-relative variants of the functions without the
      21     "at" suffix.  For example, getfileconat (AT_FDCWD, file, &c) is usually
      22     equivalent to getfilecon (file, &c).  The emulation is accomplished
      23     by first attempting getfilecon ("/proc/self/fd/DIR_FD/FILE", &c).
      24     Failing that, simulate it via save_cwd/fchdir/getfilecon/restore_cwd.
      25     If either the save_cwd or the restore_cwd fails (relatively unlikely),
      26     then give a diagnostic and exit nonzero.  */
      27  
      28  /* dir-fd-relative getfilecon.  Set *CON to the SELinux security context
      29     of the file specified by DIR_FD and FILE and return the length of *CON.
      30     DIR_FD and FILE are interpreted as for fstatat[*].  A non-NULL *CON
      31     must be freed with freecon.  Upon error, set *CON to NULL, set errno
      32     and return -1.
      33     [*] with flags=0 here, with flags=AT_SYMLINK_NOFOLLOW for lgetfileconat  */
      34  int  getfileconat (int dir_fd, char const *file, char **con);
      35  
      36  /* dir-fd-relative lgetfilecon.  This function is just like getfileconat,
      37     except when DIR_FD and FILE specify a symlink:  lgetfileconat operates on
      38     the symlink, while getfileconat operates on the referent of the symlink.  */
      39  int lgetfileconat (int dir_fd, char const *file, char **con);
      40  
      41  /* dir-fd-relative setfilecon.  Set the SELinux security context of
      42     the file specified by DIR_FD and FILE to CON.  DIR_FD and FILE are
      43     interpreted as for fstatat[*].  Upon success, return 0.
      44     Otherwise, return -1 and set errno.  */
      45  int  setfileconat (int dir_fd, char const *file, char const *con);
      46  
      47  /* dir-fd-relative lsetfilecon.  This function is just like setfileconat,
      48     except that rather than dereferencing a symlink, this function affects it. */
      49  /* dir-fd-relative lsetfilecon.  This function is just like setfileconat,
      50     except when DIR_FD and FILE specify a symlink:  lsetfileconat operates on
      51     the symlink, while setfileconat operates on the referent of the symlink.  */
      52  int lsetfileconat (int dir_fd, char const *file, char const *con);