Function defaultcon

src/selinux.c:109–166

This function takes a handle, path and mode, it calls computecon_raw to get the label of the path object if the current process created it, then it calls selabel_lookup to get the default type for the object. It substitutes the default type into label. It tells the SELinux Kernel to label all new file system objects created by the current process with this label. Returns -1 on failure

  Returns -1 on failure.  errno will be set appropriately.
*/
int
defaultcon (struct selabel_handle *selabel_handle,
            char const *path, mode_t mode)
{
  int rc = -1;
  char *scon_raw = NULL;
  char *tcon_raw = NULL;
  context_t scontext = NULL, tcontext = NULL;
  char const *contype;
  char const *constr;
  char *newpath = NULL;

  if (! IS_ABSOLUTE_FILE_NAME (path))
    {
      /* Generate absolute name as required by subsequent selabel_lookup.  */
      newpath = canonicalize_filename_mode (path, CAN_MISSING);
      if (! newpath)
        goto quit;
      path = newpath;
    }

  if (selabel_lookup_raw (selabel_handle, &scon_raw, path, mode) < 0)
    {
      /* "No such file or directory" is a confusing error,
         when processing files, when in fact it was the
         associated default context that was not found.
         Therefore map the error to something more appropriate
         to the context in which we're using selabel_lookup().  */
      if (errno == ENOENT)
        errno = ENODATA;
      goto quit;
    }
  if (computecon_raw (path, mode, &tcon_raw) < 0)
    goto quit;
  if (!(scontext = context_new (scon_raw)))
    goto quit;
  if (!(tcontext = context_new (tcon_raw)))
    goto quit;

  if (!(contype = context_type_get (scontext)))
    goto quit;
  if (context_type_set (tcontext, contype))
    goto quit;
  if (!(constr = context_str (tcontext)))
    goto quit;

  rc = setfscreatecon_raw (constr);

 quit:;
  int err = errno;
  context_free (scontext);
  context_free (tcontext);
  freecon (scon_raw);
  freecon (tcon_raw);
  free (newpath);
  errno = err;
  return rc;
}