--- coreutils-6.7/tests/help-version.selinux	2007-01-09 18:47:03.000000000 +0000

+++ coreutils-6.7/tests/help-version	2007-01-09 18:47:04.000000000 +0000

@@ -72,6 +72,8 @@

     # Skip `test'; it doesn't accept --help or --version.

     test $i = test && continue;

+    test $i = chcon && continue;

+    test $i = runcon && continue;

     # false fails even when invoked with --help or --version.

     if test $i = false; then

@@ -198,7 +200,7 @@

 for i in $all_programs; do

   # Skip these.

-  case $i in chroot|stty|tty|false) continue;; esac

+  case $i in chroot|stty|tty|false|chcon|runcon) continue;; esac

   rm -rf $tmp_in $tmp_in2 $tmp_dir $tmp_out

   echo > $tmp_in

--- coreutils-6.7/src/ls.c.selinux	2006-11-27 10:25:51.000000000 +0000

+++ coreutils-6.7/src/ls.c	2007-01-10 14:01:08.000000000 +0000

@@ -110,6 +110,18 @@

 #define AUTHORS "Richard Stallman", "David MacKenzie"

+#ifdef WITH_SELINUX

+#include <selinux/selinux.h>

+

+static int print_scontext       = 0;

+

+

+

+

+

+

+#endif

+

 #define obstack_chunk_alloc malloc

 #define obstack_chunk_free free

@@ -132,7 +144,8 @@

     symbolic_link,

     sock,

     whiteout,

-    arg_directory

+    arg_directory,

+    command_line

   };

 /* Display letters and indicators for each filetype.

@@ -175,6 +188,10 @@

     /* For long listings, true if the file has an access control list.  */

     bool have_acl;

 #endif

+

+#ifdef WITH_SELINUX

+    security_context_t scontext;

+#endif

   };

 #if USE_ACL

@@ -245,6 +262,9 @@

 static void sort_files (void);

 static void parse_ls_color (void);

 void usage (int status);

+#ifdef WITH_SELINUX

+static void print_scontext_format (const struct fileinfo *f);

+#endif

 /* The name this program was run with.  */

 char *program_name;

@@ -353,7 +373,11 @@

     one_per_line,		/* -1 */

     many_per_line,		/* -C */

     horizontal,			/* -x */

-    with_commas			/* -m */

+    with_commas,	        /* -m */

+#ifdef WITH_SELINUX

+    security_format,		/* -Z */

+#endif

+    invalid_format

   };

 static enum format format;

@@ -734,6 +758,11 @@

   SHOW_CONTROL_CHARS_OPTION,

   SI_OPTION,

   SORT_OPTION,

+#ifdef WITH_SELINUX

+  CONTEXT_OPTION,

+  LCONTEXT_OPTION,

+  SCONTEXT_OPTION,

+#endif

   TIME_OPTION,

   TIME_STYLE_OPTION

 };

@@ -780,6 +809,11 @@

   {"time-style", required_argument, NULL, TIME_STYLE_OPTION},

   {"color", optional_argument, NULL, COLOR_OPTION},

   {"block-size", required_argument, NULL, BLOCK_SIZE_OPTION},

+#ifdef WITH_SELINUX

+  {"context", no_argument, 0, CONTEXT_OPTION},

+  {"lcontext", no_argument, 0, LCONTEXT_OPTION},

+  {"scontext", no_argument, 0, SCONTEXT_OPTION},

+#endif

   {"author", no_argument, NULL, AUTHOR_OPTION},

   {GETOPT_HELP_OPTION_DECL},

   {GETOPT_VERSION_OPTION_DECL},

@@ -789,12 +823,19 @@

 static char const *const format_args[] =

 {

   "verbose", "long", "commas", "horizontal", "across",

-  "vertical", "single-column", NULL

+  "vertical", "single-column",

+#ifdef WITH_SELINUX

+  "context",

+#endif

+  NULL

 };

 static enum format const format_types[] =

 {

   long_format, long_format, with_commas, horizontal, horizontal,

   many_per_line, one_per_line

+#ifdef WITH_SELINUX

+  , security_format

+#endif

 };

 ARGMATCH_VERIFY (format_args, format_types);

@@ -1218,6 +1259,9 @@

   format_needs_stat = sort_type == sort_time || sort_type == sort_size

     || format == long_format

+#ifdef WITH_SELINUX

+    || format == security_format || print_scontext

+#endif

     || print_block_size;

   format_needs_type = (! format_needs_stat

 		       && (recursive

@@ -1248,7 +1292,7 @@

     }

   else

     do

-      gobble_file (argv[i++], unknown, NOT_AN_INODE_NUMBER, true, "");

+      gobble_file (argv[i++], command_line, NOT_AN_INODE_NUMBER, true, "");

     while (i < argc);

   if (files_index)

@@ -1411,6 +1455,9 @@

   ignore_mode = IGNORE_DEFAULT;

   ignore_patterns = NULL;

   hide_patterns = NULL;

+#ifdef WITH_SELINUX

+  print_scontext       = 0;

+#endif

   /* FIXME: put this in a function.  */

   {

@@ -1486,7 +1533,7 @@

   }

   while ((c = getopt_long (argc, argv,

-			   "abcdfghiklmnopqrstuvw:xABCDFGHI:LNQRST:UX1",

+			   "abcdfghiklmnopqrstuvw:xABCDFGHI:LNQRST:UX1Z",

 			   long_options, NULL)) != -1)

     {

       switch (c)

@@ -1609,6 +1656,13 @@

 	  format = horizontal;

 	  break;

+#ifdef WITH_SELINUX

+	case 'Z':

+

+	  print_scontext = 1;

+	  format = security_format;

+	  break;

+#endif

 	case 'A':

 	  if (ignore_mode == IGNORE_DEFAULT)

 	    ignore_mode = IGNORE_DOT_AND_DOTDOT;

@@ -1789,6 +1843,25 @@

 	case_GETOPT_VERSION_CHAR (PROGRAM_NAME, AUTHORS);

+#ifdef WITH_SELINUX

+

+	case CONTEXT_OPTION: /* new security format */

+

+		print_scontext = 1;

+		format = security_format;

+		break;

+	case LCONTEXT_OPTION: /* long format plus security context */

+

+		print_scontext = 1;

+		format = long_format;

+		break;

+	case SCONTEXT_OPTION: /* short form of new security format */

+

+		print_scontext = 0;

+		format = security_format;

+		break;

+#endif

+

 	default:

 	  usage (LS_FAILURE);

 	}

@@ -2485,6 +2558,12 @@

     {

       free (files[i].name);

       free (files[i].linkname);

+#ifdef WITH_SELINUX

+      if (files[i].scontext) {

+	freecon (files[i].scontext);

+	files[i].scontext=NULL;

+      }

+#endif

     }

   files_index = 0;

@@ -2527,6 +2606,9 @@

   memset (f, '\0', sizeof *f);

   f->stat.st_ino = inode;

   f->filetype = type;

+#ifdef WITH_SELINUX

+  f->scontext = NULL;

+#endif

   if (command_line_arg

       || format_needs_stat

@@ -2574,6 +2656,11 @@

 	{

 	case DEREF_ALWAYS:

 	  err = stat (absolute_name, &f->stat);

+#ifdef WITH_SELINUX

+	  if (err>=0) 

+	    if (format == security_format || print_scontext)

+	      getfilecon(absolute_name, &f->scontext);

+#endif

 	  break;

 	case DEREF_COMMAND_LINE_ARGUMENTS:

@@ -2582,6 +2669,11 @@

 	    {

 	      bool need_lstat;

 	      err = stat (absolute_name, &f->stat);

+#ifdef WITH_SELINUX

+	      if (err>=0) 

+		if (format == security_format || print_scontext)

+		  getfilecon(absolute_name, &f->scontext);

+#endif

 	      if (dereference == DEREF_COMMAND_LINE_ARGUMENTS)

 		break;

@@ -2600,6 +2692,11 @@

 	default: /* DEREF_NEVER */

 	  err = lstat (absolute_name, &f->stat);

+#ifdef WITH_SELINUX

+	  if (err == 0)

+	    if (format == security_format || print_scontext)

+	      lgetfilecon(absolute_name, &f->scontext);

+#endif

 	  break;

 	}

@@ -2622,7 +2719,11 @@

       f->stat_ok = true;

 #if USE_ACL

-      if (format == long_format)

+      if (format == long_format

+#ifdef WITH_SELINUX

+	  || format == security_format

+#endif

+	  )

 	{

 	  int n = file_has_acl (absolute_name, &f->stat);

 	  f->have_acl = (0 < n);

@@ -3158,6 +3259,16 @@

 	  DIRED_PUTCHAR ('\n');

 	}

       break;

+

+#ifdef WITH_SELINUX

+    case security_format:

+      for (i = 0; i < files_index; i++)

+      {

+        print_scontext_format (files + i);

+        DIRED_PUTCHAR ('\n');

+      }

+      break;

+#endif

     }

 }

@@ -3412,6 +3523,15 @@

      The latter is wrong when nlink_width is zero.  */

   p += strlen (p);

+#ifdef WITH_SELINUX

+

+  if (print_scontext)

+    {

+      sprintf (p, "%-32s ", f->scontext ? f->scontext : "");

+      p += strlen (p);

+    }

+#endif

+

   DIRED_INDENT ();

   if (print_owner | print_group | print_author)

@@ -4351,6 +4471,16 @@

   -X                         sort alphabetically by entry extension\n\

   -1                         list one file per line\n\

 "), stdout);

+#ifdef WITH_SELINUX

+printf(_("\nSELINUX options:\n\n\

+      --lcontext             Display security context.   Enable -l. Lines\n\

+                               will probably be too wide for most displays.\n\

+      -Z, --context          Display security context so it fits on most\n\

+                               displays.  Displays only mode, user, group,\n\

+                               security context and file name.\n\

+      --scontext             Display only security context and file name.\n\

+\n\n"));

+#endif

       fputs (HELP_OPTION_DESCRIPTION, stdout);

       fputs (VERSION_OPTION_DESCRIPTION, stdout);

       fputs (_("\n\

@@ -4374,3 +4504,70 @@

     }

   exit (status);

 }

+

+#ifdef WITH_SELINUX

+

+static void

+print_scontext_format (const struct fileinfo *f)

+{

+  char modebuf[12];

+

+  /* 7 fields that may require LONGEST_HUMAN_READABLE bytes,

+     1 10-byte mode string,

+     9 spaces, one following each of these fields, and

+     1 trailing NUL byte.  */

+

+  char init_bigbuf[7 * LONGEST_HUMAN_READABLE + 10  + 9 + 1];

+  char *buf = init_bigbuf;

+  size_t bufsize = sizeof (init_bigbuf);

+  size_t s;

+  char *p;

+  const char *fmt;

+  char *user_name;

+  char *group_name;

+  int rv;

+  char *scontext;

+

+  p = buf;

+

+  if ( print_scontext ) { /* zero means terse listing */

+    filemodestring (&f->stat, modebuf);

+    modebuf[10] = (FILE_HAS_ACL (f) ? '+' : ' ');

+    modebuf[11] = '\0';

+

+    /* print mode */

+

+    (void) sprintf (p, "%s ", modebuf);

+    p += strlen (p);

+

+    /* print standard user and group */

+

+    DIRED_FPUTS (buf, stdout, p - buf);

+    format_user (f->stat.st_uid, owner_width, f->stat_ok);

+    format_group (f->stat.st_gid, group_width, f->stat_ok);

+    p = buf;

+  }

+

+  (void) sprintf (p, "%-32s ", f->scontext ?: "");

+  p += strlen (p);

+ 

+  DIRED_INDENT ();

+  DIRED_FPUTS (buf, stdout, p - buf);

+  print_name_with_quoting (f->name, f->stat.st_mode, f->linkok,

+			   f->stat_ok, f->filetype, &dired_obstack);

+ 

+  if (f->filetype == symbolic_link) {

+      if (f->linkname) {

+	  DIRED_FPUTS_LITERAL (" -> ", stdout);

+	  print_name_with_quoting (f->linkname, f->linkmode, f->linkok - 1,

+				   f->stat_ok, f->filetype, NULL);

+	  if (indicator_style != none)

+	    print_type_indicator (f->stat_ok, f->linkmode, f->filetype);

+      }

+  }

+  else {

+    if (indicator_style != none)

+      print_type_indicator (f->stat_ok, f->stat.st_mode, f->filetype);

+  }

+}

+#endif

--- coreutils-6.7/src/cp.c.selinux	2006-12-06 11:04:22.000000000 +0000

+++ coreutils-6.7/src/cp.c	2007-01-09 18:47:04.000000000 +0000

@@ -51,6 +51,11 @@

 #define AUTHORS "Torbjorn Granlund", "David MacKenzie", "Jim Meyering"

+#ifdef WITH_SELINUX

+#include <selinux/selinux.h>          /* for is_selinux_enabled() */

+int selinux_enabled=0;

+#endif

+

 /* Used by do_copy, make_dir_parents_private, and re_protect

    to keep a list of leading directories whose protections

    need to be fixed after copying. */

@@ -141,6 +146,9 @@

   {"target-directory", required_argument, NULL, 't'},

   {"update", no_argument, NULL, 'u'},

   {"verbose", no_argument, NULL, 'v'},

+#ifdef WITH_SELINUX

+  {"context", required_argument, NULL, 'Z'},

+#endif

   {GETOPT_HELP_OPTION_DECL},

   {GETOPT_VERSION_OPTION_DECL},

   {NULL, 0, NULL, 0}

@@ -194,6 +202,9 @@

                                  additional attributes: links, all\n\

 "), stdout);

       fputs (_("\

+  -c                           same as --preserve=context\n\

+"), stdout);

+      fputs (_("\

       --no-preserve=ATTR_LIST  don't preserve the specified attributes\n\

       --parents                use full source file name under DIRECTORY\n\

 "), stdout);

@@ -219,6 +230,7 @@

                                  destination file is missing\n\

   -v, --verbose                explain what is being done\n\

   -x, --one-file-system        stay on this file system\n\

+  -Z, --context=CONTEXT        set security context of copy to CONTEXT\n\

 "), stdout);

       fputs (HELP_OPTION_DESCRIPTION, stdout);

       fputs (VERSION_OPTION_DESCRIPTION, stdout);

@@ -736,6 +748,11 @@

   x->preserve_mode = false;

   x->preserve_timestamps = false;

+#ifdef WITH_SELINUX

+  x->preserve_security_context = false;

+  x->set_security_context = false;

+#endif

+

   x->require_preserve = false;

   x->recursive = false;

   x->sparse_mode = SPARSE_AUTO;

@@ -763,18 +780,19 @@

       PRESERVE_TIMESTAMPS,

       PRESERVE_OWNERSHIP,

       PRESERVE_LINK,

+      PRESERVE_CONTEXT,

       PRESERVE_ALL

     };

   static enum File_attribute const preserve_vals[] =

     {

       PRESERVE_MODE, PRESERVE_TIMESTAMPS,

-      PRESERVE_OWNERSHIP, PRESERVE_LINK, PRESERVE_ALL

+      PRESERVE_OWNERSHIP, PRESERVE_LINK, PRESERVE_CONTEXT, PRESERVE_ALL

     };

   /* Valid arguments to the `--preserve' option. */

   static char const* const preserve_args[] =

     {

       "mode", "timestamps",

-      "ownership", "links", "all", NULL

+      "ownership", "links", "context", "all", NULL

     };

   ARGMATCH_VERIFY (preserve_args, preserve_vals);

@@ -810,11 +828,16 @@

 	  x->preserve_links = on_off;

 	  break;

+	case PRESERVE_CONTEXT:

+	  x->preserve_security_context = on_off;

+	  break;

+

 	case PRESERVE_ALL:

 	  x->preserve_mode = on_off;

 	  x->preserve_timestamps = on_off;

 	  x->preserve_ownership = on_off;

 	  x->preserve_links = on_off;

+	  x->preserve_security_context = on_off;

 	  break;

 	default:

@@ -839,6 +862,9 @@

   bool copy_contents = false;

   char *target_directory = NULL;

   bool no_target_directory = false;

+#ifdef WITH_SELINUX

+  selinux_enabled= (is_selinux_enabled()>0);

+#endif

   initialize_main (&argc, &argv);

   program_name = argv[0];

@@ -854,7 +880,11 @@

      we'll actually use backup_suffix_string.  */

   backup_suffix_string = getenv ("SIMPLE_BACKUP_SUFFIX");

+#ifdef WITH_SELINUX

+  while ((c = getopt_long (argc, argv, "abcdfHilLprst:uvxPRS:TZ:",

+#else

   while ((c = getopt_long (argc, argv, "abdfHilLprst:uvxPRS:T",

+#endif

 			   long_opts, NULL))

 	 != -1)

     {

@@ -865,12 +895,13 @@

 				     sparse_type_string, sparse_type);

 	  break;

-	case 'a':		/* Like -dpPR. */

+	case 'a':		/* Like -dpPRc. */

 	  x.dereference = DEREF_NEVER;

 	  x.preserve_links = true;

 	  x.preserve_ownership = true;

 	  x.preserve_mode = true;

 	  x.preserve_timestamps = true;

+	  x.preserve_security_context = true;

 	  x.require_preserve = true;

 	  x.recursive = true;

 	  break;

@@ -945,6 +976,36 @@

 	case 'R':

 	  x.recursive = true;

 	  break;

+#ifdef WITH_SELINUX

+	case 'c':

+	  if ( x.set_security_context ) { 

+	      (void) fprintf(stderr, "%s: cannot force target context and preserve it\n", argv[0]);

+	    exit( 1 );

+	  }

+	  else if (selinux_enabled) 

+	    x.preserve_security_context = true;

+	  break;

+

+	case 'Z':

+	  /* politely decline if we're not on a selinux-enabled kernel. */

+	  if( !selinux_enabled ) {

+	    fprintf( stderr, "Warning:  ignoring --context (-Z). "

+		             "It requires a SELinux enabled kernel.\n" );

+	    break;

+	  }

+	  if ( x.preserve_security_context ) {

+	    (void) fprintf(stderr, "%s: cannot force target context to '%s' and preserve it\n", argv[0], optarg);

+	    exit( 1 );

+	  }

+	  x.set_security_context = true;

+	  /* if there's a security_context given set new path 

+	     components to that context, too */

+	  if ( setfscreatecon(optarg) < 0 ) {

+	    (void) fprintf(stderr, _("cannot set default security context %s\n"), optarg);

+	    exit( 1 );

+	  }

+	  break;

+#endif

 	case REPLY_OPTION: /* Deprecated */

 	  x.interactive = XARGMATCH ("--reply", optarg,

--- coreutils-6.7/src/Makefile.am.selinux	2007-01-09 18:47:04.000000000 +0000

+++ coreutils-6.7/src/Makefile.am	2007-01-09 18:47:04.000000000 +0000

@@ -20,14 +20,14 @@

 EXTRA_PROGRAMS = chroot df hostid nice pinky stty su runuser uname uptime users who

 bin_SCRIPTS = groups

-bin_PROGRAMS = [ chgrp chown chmod cp dd dircolors du \

+bin_PROGRAMS = [ chcon chgrp chown chmod cp dd dircolors du \

   ginstall link ln dir vdir ls mkdir \

   mkfifo mknod mv nohup readlink rm rmdir shred stat sync touch unlink \

   cat cksum comm csplit cut expand fmt fold head join md5sum \

   nl od paste pr ptx sha1sum sha224sum sha256sum sha384sum sha512sum \

   shuf sort split sum tac tail tr tsort unexpand uniq wc \

   basename date dirname echo env expr factor false \

-  hostname id kill logname pathchk printenv printf pwd seq sleep tee \

+  hostname id kill logname pathchk printenv printf pwd runcon seq sleep tee \

   test true tty whoami yes \

   base64 \

   $(OPTIONAL_BIN_PROGS) $(DF_PROG)

@@ -61,9 +61,9 @@

 LDADD = ../lib/libcoreutils.a $(LIBINTL) ../lib/libcoreutils.a

 # for eaccess in lib/euidaccess.c.

-cp_LDADD = $(LDADD) $(LIB_EACCESS)

-ginstall_LDADD = $(LDADD) $(LIB_EACCESS)

-mv_LDADD = $(LDADD) $(LIB_EACCESS)

+cp_LDADD = $(LDADD) $(LIB_EACCESS) @LIB_SELINUX@

+ginstall_LDADD = $(LDADD) $(LIB_EACCESS) @LIB_SELINUX@

+mv_LDADD = $(LDADD) $(LIB_EACCESS) @LIB_SELINUX@

 pathchk_LDADD = $(LDADD) $(LIB_EACCESS)

 rm_LDADD = $(LDADD) $(LIB_EACCESS)

 test_LDADD = $(LDADD) $(LIB_EACCESS)

@@ -72,12 +72,19 @@

 # for clock_gettime and fdatasync

 dd_LDADD = $(LDADD) $(LIB_GETHRXTIME) $(LIB_FDATASYNC)

-dir_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME)

-ls_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME)

+dir_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME) @LIB_SELINUX@

+ls_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME) @LIB_SELINUX@

 pr_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME)

 shred_LDADD = $(LDADD) $(LIB_GETHRXTIME) $(LIB_FDATASYNC)

 shuf_LDADD = $(LDADD) $(LIB_GETHRXTIME)

-vdir_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME)

+vdir_LDADD = $(LDADD) $(LIB_CLOCK_GETTIME) @LIB_SELINUX@

+chcon_LDADD = $(LDADD) @LIB_SELINUX@

+id_LDADD = $(LDADD) @LIB_SELINUX@

+mkdir_LDADD = $(LDADD) @LIB_SELINUX@

+mkfifo_LDADD = $(LDADD) @LIB_SELINUX@

+mknod_LDADD = $(LDADD) @LIB_SELINUX@

+stat_LDADD = $(LDADD) @LIB_SELINUX@

+runcon_LDADD = $(LDADD) @LIB_SELINUX@

 ## If necessary, add -lm to resolve use of pow in lib/strtod.c.

 sort_LDADD = $(LDADD) $(POW_LIB) $(LIB_GETHRXTIME)

--- coreutils-6.7/src/copy.h.selinux	2006-12-06 11:04:22.000000000 +0000

+++ coreutils-6.7/src/copy.h	2007-01-09 18:47:05.000000000 +0000

@@ -127,6 +127,10 @@

   bool preserve_ownership;

   bool preserve_mode;

   bool preserve_timestamps;

+#ifdef WITH_SELINUX

+  bool preserve_security_context;

+  bool set_security_context;

+#endif

   /* Enabled for mv, and for cp by the --preserve=links option.

      If true, attempt to preserve in the destination files any

--- /dev/null	2007-01-10 09:33:30.042789464 +0000

+++ coreutils-6.7/src/chcon.c	2007-01-09 18:47:05.000000000 +0000

@@ -0,0 +1,421 @@

+/* chcontext -- change security context of a pathname */

+

+#include <config.h>

+#include <stdio.h>

+#include <sys/types.h>

+#include <grp.h>

+#include <getopt.h>

+#include <selinux/selinux.h>

+#include <selinux/context.h>

+

+#include "system.h"

+#include "error.h"

+#include "savedir.h"

+#include "group-member.h"

+

+enum Change_status

+{

+  CH_SUCCEEDED,

+  CH_FAILED,

+  CH_NO_CHANGE_REQUESTED

+};

+

+enum Verbosity

+{

+  /* Print a message for each file that is processed.  */

+  V_high,

+

+  /* Print a message for each file whose attributes we change.  */

+  V_changes_only,

+

+  /* Do not be verbose.  This is the default. */

+  V_off

+};

+

+static int change_dir_context (const char *dir, const struct stat *statp);

+

+/* The name the program was run with. */

+char *program_name;

+

+/* If nonzero, and the systems has support for it, change the context

+   of symbolic links rather than any files they point to.  */

+static int change_symlinks;

+

+/* If nonzero, change the context of directories recursively. */

+static int recurse;

+

+/* If nonzero, force silence (no error messages). */

+static int force_silent;

+

+/* Level of verbosity.  */

+static enum Verbosity verbosity = V_off;

+

+/* The name of the context file is being given. */

+static const char *specified_context;

+

+/* Specific components of the context */

+static const char *specified_user;

+static const char *specified_role;

+static const char *specified_range;

+static const char *specified_type;

+

+/* The argument to the --reference option.  Use the context of this file.

+   This file must exist.  */

+static char *reference_file;

+

+/* If nonzero, display usage information and exit.  */

+static int show_help;

+

+/* If nonzero, print the version on standard output and exit.  */

+static int show_version;

+

+static struct option const long_options[] =

+{

+  {"recursive", no_argument, 0, 'R'},

+  {"changes", no_argument, 0, 'c'},

+  {"no-dereference", no_argument, 0, 'h'},

+  {"silent", no_argument, 0, 'f'},

+  {"quiet", no_argument, 0, 'f'},

+  {"reference", required_argument, 0, CHAR_MAX + 1},

+  {"context", required_argument, 0, CHAR_MAX + 2},

+  {"user", required_argument, 0, 'u'},

+  {"role", required_argument, 0, 'r'},      

+  {"type", required_argument, 0, 't'},

+  {"range", required_argument, 0, 'l'},   

+  {"verbose", no_argument, 0, 'v'},

+  {"help", no_argument, &show_help, 1},

+  {"version", no_argument, &show_version, 1},

+  {0, 0, 0, 0}

+};

+

+/* Tell the user how/if the context of FILE has been changed.

+   CHANGED describes what (if anything) has happened. */

+

+static void

+describe_change (const char *file, security_context_t newcontext, enum Change_status changed)

+{

+  const char *fmt;

+  switch (changed)

+    {

+    case CH_SUCCEEDED:

+      fmt = _("context of %s changed to %s\n");

+      break;

+    case CH_FAILED:

+      fmt = _("failed to change context of %s to %s\n");

+      break;

+    case CH_NO_CHANGE_REQUESTED:

+      fmt = _("context of %s retained as %s\n");

+      break;

+    default:

+      abort ();

+    }

+  printf (fmt, file, newcontext);

+}

+

+static int

+compute_context_from_mask (security_context_t context, context_t *ret)

+{

+  context_t newcontext = context_new (context);

+  if (!newcontext)

+    return 1;

+#define SETCOMPONENT(comp) \

+  do { \

+    if (specified_ ## comp) \

+      if (context_ ## comp ## _set (newcontext, specified_ ## comp)) \

+        goto lose; \

+  } while (0)

+      

+  SETCOMPONENT(user);

+  SETCOMPONENT(range);

+  SETCOMPONENT(role);

+  SETCOMPONENT(type);

+#undef SETCOMPONENT

+  

+  *ret = newcontext;

+  return 0;

+ lose:

+  context_free (newcontext);

+  return 1;

+}

+

+/* Change the context of FILE, using specified components.

+   If it is a directory and -R is given, recurse.

+   Return 0 if successful, 1 if errors occurred. */

+

+static int

+change_file_context (const char *file)

+{

+  struct stat file_stats;

+  security_context_t file_context=NULL;

+  context_t context;

+  security_context_t context_string;

+  int errors = 0;

+  int status = 0;

+

+  if (change_symlinks)

+    status = lgetfilecon(file, &file_context);

+  else 

+    status = getfilecon(file, &file_context);

+

+  if ((status < 0) && (errno != ENODATA))

+    {

+      if (force_silent == 0)

+	error (0, errno, "%s", file);

+      return 1;

+    }

+

+  /* If the file doesn't have a context, and we're not setting all of

+     the context components, there isn't really an obvious default.

+     Thus, we just give up. */

+  if (file_context == NULL && specified_context == NULL)

+    {

+      error (0, 0, _("can't apply partial context to unlabeled file %s"), file);

+      return 1;

+    }

+      

+  if (specified_context == NULL)

+    {

+      if (compute_context_from_mask (file_context, &context))

+	{

+	  error (0, 0, _("couldn't compute security context from %s"), file_context);

+	      return 1;

+	}

+    }

+  else

+    {

+      context = context_new (specified_context);

+      if (!context)

+	error (1, 0,_("invalid context: %s"),specified_context);	    

+    }

+

+  context_string = context_str (context);

+      

+  if (file_context == NULL || strcmp(context_string,file_context)!=0)

+    {

+      int fail;

+

+      if (change_symlinks)

+      	fail = lsetfilecon (file, context_string);

+      else

+      	fail = setfilecon (file, context_string);

+

+      if (verbosity == V_high || (verbosity == V_changes_only && !fail))

+	describe_change (file, context_string, (fail ? CH_FAILED : CH_SUCCEEDED));

+

+      if (fail)

+	{

+	  errors = 1;

+	  if (force_silent == 0)

+	    {

+	      error (0, errno, _("failed to change context of %s to %s"), file, context_string);

+	    }

+	}

+    }

+  else if (verbosity == V_high)

+    {

+      describe_change (file, context_string, CH_NO_CHANGE_REQUESTED);

+    }

+

+  context_free(context);

+  freecon(file_context);

+

+  if (recurse) {

+    if (lstat(file, &file_stats)==0)

+      if (S_ISDIR (file_stats.st_mode))

+	errors |= change_dir_context (file, &file_stats);

+  }

+  return errors;

+}

+

+/* Recursively change context of the files in directory DIR

+   using specified context components.

+   STATP points to the results of lstat on DIR.

+   Return 0 if successful, 1 if errors occurred. */

+

+static int

+change_dir_context (const char *dir, const struct stat *statp)

+{

+  char *name_space, *namep;

+  char *path;			/* Full path of each entry to process. */

+  unsigned dirlength;		/* Length of `dir' and '\0'. */