Bug 103489 - /bin/ls fails on reiserfs with WITH_SELINUX (also performance issue)
/bin/ls fails on reiserfs with WITH_SELINUX (also performance issue)
Product: Red Hat Raw Hide
Classification: Retired
Component: coreutils (Show other bugs)
All Linux
medium Severity medium
: ---
: ---
Assigned To: Daniel Walsh
Depends On:
  Show dependency treegraph
Reported: 2003-09-01 01:25 EDT by Valdis Kletnieks
Modified: 2007-04-18 12:57 EDT (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2003-09-02 14:18:39 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Patch to only use getfilecon() if actually needed (706 bytes, patch)
2003-09-01 01:26 EDT, Valdis Kletnieks
no flags Details | Diff

  None (edit)
Description Valdis Kletnieks 2003-09-01 01:25:08 EDT
Description of problem:
In ls.c, function gobble_file(), there are 2 #ifdefs for SELINUX that include
cals for getfilecon() and lgetfilecon() respectively.  The problem is that
although the global variable format_needs_stat is correctly set up, the code in
gobble_file() will call the ?getfilecon() functions on *ANY* needs_stat file,
even if we're doing just an 'ls -l' and did *not* ask for one of the selinux
extensions.  This has two implications:

a) We're doing (probably expensive) calls every time, even when not needed. 
This is a performance issue.

b) It's quite possible to try to 'ls' a directory on a filesystem that doesn't
support extended attributes (Reiserfs, JFS, or XFS, for example).  This will get
an 'op not supported' error on the getfilecon() and kill the ls while we're
retrieving data the user didn't even ask for.

Version-Release number of selected component (if applicable):

How reproducible:
Build with WITH_SELINUX, then try to 'ls' a filesystem that doesn't support
extended attributes.  

Steps to Reproduce:
Actual results:

Expected results:

Additional info:
Totally untested, but "looks right" patch attached.
Comment 1 Valdis Kletnieks 2003-09-01 01:26:55 EDT
Created attachment 94109 [details]
Patch to only use getfilecon() if actually needed
Comment 2 Valdis Kletnieks 2003-09-01 01:29:34 EDT
Blech.  Somebody check the precidence rules - that 'format == security_format'
might need another set of parens around it.
Comment 3 Daniel Walsh 2003-09-02 14:18:39 EDT
This has been fixed in the latest release.


Basically the security context will say none if the file system does not support
extended attributes.


Note You need to log in before you can comment on or make changes to this bug.