From: Christian Göttsche <cgzones@googlemail.com>
Date: Tue, 13 Apr 2021 12:13:11 +0000 (+0200)
Subject: selinux: only open selabel database once
X-Git-Tag: v4.9~26^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F323%2Fhead;p=thirdparty%2Fshadow.git

selinux: only open selabel database once

Once opened, keep the selabel database open for further lookups.
Register an exit handler to close the database.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: James Carter <jwcart2@gmail.com>
---

diff --git a/lib/selinux.c b/lib/selinux.c
index 719acda31..28ca5fff5 100644
--- a/lib/selinux.c
+++ b/lib/selinux.c
@@ -40,6 +40,15 @@
 
 static bool selinux_checked = false;
 static bool selinux_enabled;
+static /*@null@*/struct selabel_handle *selabel_hnd = NULL;
+
+static void cleanup(void)
+{
+	if (selabel_hnd) {
+		selabel_close(selabel_hnd);
+		selabel_hnd = NULL;
+	}
+}
 
 /*
  * set_selinux_file_context - Set the security context before any file or
@@ -62,16 +71,17 @@ int set_selinux_file_context (const char *dst_name, mode_t mode)
 		/* Get the default security context for this file */
 
 		/*@null@*/char *fcontext_raw = NULL;
-		struct selabel_handle *hnd;
 		int r;
 
-		hnd = selabel_open(SELABEL_CTX_FILE, NULL, 0);
-		if (hnd == NULL) {
-			return security_getenforce () != 0;
+		if (selabel_hnd == NULL) {
+			selabel_hnd = selabel_open(SELABEL_CTX_FILE, NULL, 0);
+			if (selabel_hnd == NULL) {
+				return security_getenforce () != 0;
+			}
+			(void) atexit(cleanup);
 		}
 
-		r = selabel_lookup_raw(hnd, &fcontext_raw, dst_name, mode);
-		selabel_close(hnd);
+		r = selabel_lookup_raw(selabel_hnd, &fcontext_raw, dst_name, mode);
 		if (r < 0) {
 			/* No context specified for the searched path */
 			if (errno == ENOENT) {