1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
|
#include <dirent.h>
#include <errno.h>
#include <fcntl.h>
#include <getopt.h>
#include <linux/magic.h>
#include <stdbool.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/stat.h>
#include <sys/types.h>
#include <sys/xattr.h>
#include <unistd.h>
#include <selinux/selinux.h>
#define XATTR_NAME_SELINUX "security.selinux"
static void usage(const char *progname)
{
fprintf(stderr, "usage: %s [-nrvx] <path>\n\n"
"Options:\n"
"\t-n\tdon't remove any file labels\n"
"\t-r\tremove labels recursive\n"
"\t-v\tbe verbose\n"
"\t-x\tdo not cross filesystem boundaries\n",
progname);
}
static void unset(int atfd, const char *path, const char *fullpath,
bool dry_run, bool recursive, bool verbose,
dev_t root_dev)
{
ssize_t ret;
int fd, rc;
DIR *dir;
ret = lgetxattr(fullpath, XATTR_NAME_SELINUX, NULL, 0);
if (ret <= 0) {
if (errno != ENODATA && errno != ENOTSUP)
fprintf(stderr, "Failed to get SELinux label of %s: %m\n", fullpath);
else if (verbose)
printf("Failed to get SELinux label of %s: %m\n", fullpath);
} else {
if (dry_run) {
printf("Would remove SELinux label of %s\n", fullpath);
} else {
if (verbose)
printf("Removing label of %s\n", fullpath);
rc = lremovexattr(fullpath, XATTR_NAME_SELINUX);
if (rc < 0)
fprintf(stderr, "Failed to remove SELinux label of %s: %m\n", fullpath);
}
}
if (!recursive)
return;
fd = openat(atfd, path, O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
if (fd < 0) {
if (errno != ENOTDIR)
fprintf(stderr, "Failed to open %s: %m\n", fullpath);
return;
}
if (root_dev != (dev_t)-1) {
struct stat sb;
rc = fstat(fd, &sb);
if (rc == -1) {
fprintf(stderr, "Failed to stat directory %s: %m\n", fullpath);
close(fd);
return;
}
if (sb.st_dev != root_dev) {
if (verbose)
printf("Skipping directory %s due to filesystem boundary\n", fullpath);
close(fd);
return;
}
}
dir = fdopendir(fd);
if (!dir) {
fprintf(stderr, "Failed to open directory %s: %m\n", fullpath);
close(fd);
return;
}
while (true) {
const struct dirent *entry;
char *nextfullpath;
errno = 0;
entry = readdir(dir);
if (!entry) {
if (errno)
fprintf(stderr, "Failed to iterate directory %s: %m\n", fullpath);
break;
}
if (entry->d_name[0] == '.' && (entry->d_name[1] == '\0' || (entry->d_name[1] == '.' && entry->d_name[2] == '\0')))
continue;
rc = asprintf(&nextfullpath, "%s/%s", strcmp(fullpath, "/") == 0 ? "" : fullpath, entry->d_name);
if (rc < 0) {
fprintf(stderr, "Out of memory!\n");
closedir(dir);
return;
}
unset(dirfd(dir), entry->d_name, nextfullpath, dry_run, recursive, verbose, root_dev);
free(nextfullpath);
}
closedir(dir);
}
int main(int argc, char *argv[])
{
bool dry_run = false, recursive = false, verbose = false, same_dev = false;
int c;
while ((c = getopt(argc, argv, "hnrvx")) != -1) {
switch (c) {
case 'h':
usage(argv[0]);
return EXIT_SUCCESS;
case 'n':
dry_run = true;
break;
case 'r':
recursive = true;
break;
case 'v':
verbose = true;
break;
case 'x':
same_dev = true;
break;
default:
usage(argv[0]);
return EXIT_FAILURE;
}
}
if (optind >= argc) {
usage(argv[0]);
return EXIT_FAILURE;
}
if (is_selinux_enabled()) {
fprintf(stderr, "Removing SELinux attributes on a SELinux enabled system is not supported!\n");
return EXIT_FAILURE;
}
for (int index = optind; index < argc; index++) {
dev_t root_dev = (dev_t)-1;
if (same_dev) {
struct stat sb;
int rc;
rc = stat(argv[index], &sb);
if (rc == -1) {
fprintf(stderr, "Failed to stat %s: %m\n", argv[index]);
continue;
}
root_dev = sb.st_dev;
}
unset(AT_FDCWD, argv[index], argv[index], dry_run, recursive, verbose, root_dev);
}
return EXIT_SUCCESS;
}
|
