diff --git a/SOURCES/0007-libselinux-Ignore-files-removed-during-relabeling.patch b/SOURCES/0007-libselinux-Ignore-files-removed-during-relabeling.patch new file mode 100644 index 0000000..5ed8644 --- /dev/null +++ b/SOURCES/0007-libselinux-Ignore-files-removed-during-relabeling.patch @@ -0,0 +1,63 @@ +From 25721e379bc2544ad8b0f2cadcd9b3dce87a8422 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 17 Oct 2025 17:08:34 +0200 +Subject: [PATCH] libselinux: Ignore files removed during relabeling + +In case ignore_noent is specified, ignore files removed during +relabeling (race condition between folder read, file read and label +set). + +Signed-off-by: Vit Mojzis +Acked-by: Stephen Smalley +--- + libselinux/src/selinux_restorecon.c | 20 +++++++++++++++----- + 1 file changed, 15 insertions(+), 5 deletions(-) + +diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c +index 1664514a..d32b75fb 100644 +--- a/libselinux/src/selinux_restorecon.c ++++ b/libselinux/src/selinux_restorecon.c +@@ -702,6 +702,9 @@ static int restorecon_sb(const char *pathname, const struct stat *sb, + pathname, newcon); + + if (lgetfilecon_raw(pathname, &curcon) < 0) { ++ /* Ignore files removed during relabeling if ignore_noent is set */ ++ if (flags->ignore_noent && errno == ENOENT) ++ goto out; + if (errno != ENODATA) + goto err; + +@@ -736,8 +739,14 @@ static int restorecon_sb(const char *pathname, const struct stat *sb, + } + + if (!flags->nochange) { +- if (lsetfilecon(pathname, newcon) < 0) +- goto err; ++ if (lsetfilecon(pathname, newcon) < 0) { ++ /* Ignore files removed during relabeling if ignore_noent is set */ ++ if (flags->ignore_noent && errno == ENOENT) ++ goto out; ++ else ++ goto err; ++ } ++ + updated = true; + } + +@@ -903,9 +912,10 @@ loop_body: + case FTS_NS: + error = errno; + errno = ftsent->fts_errno; +- selinux_log(SELINUX_ERROR, +- "Could not stat %s: %m.\n", +- ftsent->fts_path); ++ if (!state->flags.ignore_noent || errno != ENOENT) ++ selinux_log(SELINUX_ERROR, ++ "Could not stat %s: %m.\n", ++ ftsent->fts_path); + errno = error; + fts_set(fts, ftsent, FTS_SKIP); + continue; +-- +2.53.0 + diff --git a/SOURCES/0008-libselinux-Ignore-directories-removed-during-relabel.patch b/SOURCES/0008-libselinux-Ignore-directories-removed-during-relabel.patch new file mode 100644 index 0000000..f192470 --- /dev/null +++ b/SOURCES/0008-libselinux-Ignore-directories-removed-during-relabel.patch @@ -0,0 +1,39 @@ +From 064f355902f1e9b976af3b7468d7a1b84fbc1158 Mon Sep 17 00:00:00 2001 +From: Vit Mojzis +Date: Fri, 30 Jan 2026 16:32:10 +0100 +Subject: [PATCH] libselinux: Ignore directories removed during relabeling + +Extend 54c79a74f5b9154762abaadf8194665598b24115 to directories, since +users will expect them to be ignored as well. + +In case ignore_noent is specified, ignore directories removed during +relabeling (race condition between directory read and removal after +parent directory read). + +Signed-off-by: Vit Mojzis +Acked-by: Stephen Smalley +--- + libselinux/src/selinux_restorecon.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c +index d32b75fb..51850099 100644 +--- a/libselinux/src/selinux_restorecon.c ++++ b/libselinux/src/selinux_restorecon.c +@@ -903,9 +903,10 @@ loop_body: + case FTS_DNR: + error = errno; + errno = ftsent->fts_errno; +- selinux_log(SELINUX_ERROR, +- "Could not read %s: %m.\n", +- ftsent->fts_path); ++ if (!state->flags.ignore_noent || errno != ENOENT) ++ selinux_log(SELINUX_ERROR, ++ "Could not read %s: %m.\n", ++ ftsent->fts_path); + errno = error; + fts_set(fts, ftsent, FTS_SKIP); + continue; +-- +2.53.0 + diff --git a/SPECS/libselinux.spec b/SPECS/libselinux.spec index 76e067a..10896dd 100644 --- a/SPECS/libselinux.spec +++ b/SPECS/libselinux.spec @@ -4,7 +4,7 @@ Summary: SELinux library and simple utilities Name: libselinux Version: 3.6 -Release: 3%{?dist} +Release: 4%{?dist} License: Public Domain # https://github.com/SELinuxProject/selinux/wiki/Releases Source0: https://github.com/SELinuxProject/selinux/releases/download/3.6/libselinux-3.6.tar.gz @@ -22,6 +22,8 @@ Patch0003: 0003-Revert-libselinux-Remove-the-Russian-translations.patch Patch0004: 0004-Revert-libselinux-Remove-the-Russian-translations.patch Patch0005: 0005-libselinux-restorecon-Include-selinux-label.h.patch Patch0006: 0006-libselinux-Close-old-selabel-handle-when-setting-a-n.patch +Patch0007: 0007-libselinux-Ignore-files-removed-during-relabeling.patch +Patch0008: 0008-libselinux-Ignore-directories-removed-during-relabel.patch # Patch list end BuildRequires: gcc make BuildRequires: ruby-devel ruby libsepol-static >= %{libsepolver} swig pcre2-devel xz-devel @@ -220,6 +222,10 @@ rm -f %{buildroot}%{_mandir}/man8/togglesebool* %{ruby_vendorarchdir}/selinux.so %changelog +* Tue May 05 2026 Vit Mojzis - 3.6-4 +- Ignore files removed during relabeling (RHEL-123884) +- Ignore directories removed during relabeling (RHEL-123884) + * Tue Jan 28 2025 Petr Lautrbach - 3.6-3 - Close old selabel handle when setting a new one (RHEL-76472)