diff options
| -rw-r--r-- | NEWS | 6 | ||||
| -rw-r--r-- | doc/coreutils.texi | 8 | ||||
| -rw-r--r-- | src/ls.c | 25 | ||||
| -rwxr-xr-x | tests/misc/selinux | 4 |
4 files changed, 32 insertions, 11 deletions
@@ -6,6 +6,12 @@ GNU coreutils NEWS -*- outline -*- stat -f recognizes the Lustre file system type +** Changes in behavior + + ls -l now marks SELinux-only files with the less obtrusive '.', + rather than '+'. A file with any other combination of MAC and ACL + is still marked with a '+'. + * Noteworthy changes in release 7.0 (2008-10-05) [beta] diff --git a/doc/coreutils.texi b/doc/coreutils.texi index 64598705d..cbef0139b 100644 --- a/doc/coreutils.texi +++ b/doc/coreutils.texi @@ -6474,9 +6474,11 @@ applies to the file. When the character following the file mode bits is a space, there is no alternate access method. When it is a printing character, then there is such a method. -For a file with an extended access control list, a @samp{+} character is -listed. Basic access control lists are equivalent to the permissions -listed, and are not considered an alternate access method. +GNU @command{ls} uses a @samp{.} character to indicate a file +with an SELinux security context, but no other alternate access method. + +A file with any other combination of alternate access methods +is marked with a @samp{+} character. @item -n @itemx --numeric-uid-gid @@ -154,6 +154,12 @@ verify (sizeof filetype_letter - 1 == arg_directory + 1); C_LINK, C_SOCK, C_FILE, C_DIR \ } +enum acl_type + { + ACL_T_NONE, + ACL_T_SELINUX_ONLY, + ACL_T_YES + }; struct fileinfo { @@ -182,7 +188,7 @@ struct fileinfo /* For long listings, true if the file has an access control list, or an SELinux security context. */ - bool have_acl; + enum acl_type acl_type; }; #define LEN_STR_PAIR(s) sizeof (s) - 1, s @@ -2689,6 +2695,7 @@ gobble_file (char const *name, enum filetype type, ino_t inode, if (format == long_format || print_scontext) { + bool have_selinux = false; bool have_acl = false; int attr_len = (do_deref ? getfilecon (absolute_name, &f->scontext) @@ -2707,7 +2714,7 @@ gobble_file (char const *name, enum filetype type, ino_t inode, } if (err == 0) - have_acl = ! STREQ ("unlabeled", f->scontext); + have_selinux = ! STREQ ("unlabeled", f->scontext); else { f->scontext = UNKNOWN_SECURITY_CONTEXT; @@ -2720,15 +2727,19 @@ gobble_file (char const *name, enum filetype type, ino_t inode, err = 0; } - if (err == 0 && ! have_acl && format == long_format) + if (err == 0 && format == long_format) { int n = file_has_acl (absolute_name, &f->stat); err = (n < 0); have_acl = (0 < n); } - f->have_acl = have_acl; - any_has_acl |= have_acl; + f->acl_type = (!have_selinux && !have_acl + ? ACL_T_NONE + : (have_selinux && !have_acl + ? ACL_T_SELINUX_ONLY + : ACL_T_YES)); + any_has_acl |= f->acl_type != ACL_T_NONE; if (err) error (0, errno, "%s", quotearg_colon (absolute_name)); @@ -3449,7 +3460,9 @@ print_long_format (const struct fileinfo *f) } if (! any_has_acl) modebuf[10] = '\0'; - else if (f->have_acl) + else if (f->acl_type == ACL_T_SELINUX_ONLY) + modebuf[10] = '.'; + else if (f->acl_type == ACL_T_YES) modebuf[10] = '+'; switch (time_type) diff --git a/tests/misc/selinux b/tests/misc/selinux index a231fa78f..8211c80f7 100755 --- a/tests/misc/selinux +++ b/tests/misc/selinux @@ -34,8 +34,8 @@ for i in d f p; do c=`stat --printf %C $i`; test x$c = x$ctx || fail=1 done -# ensure that ls -l output includes the "+". -c=`ls -l f|cut -c11`; test "$c" = + || fail=1 +# ensure that ls -l output includes the ".". +c=`ls -l f|cut -c11`; test "$c" = . || fail=1 # Copy each to a new directory and ensure that context is preserved. cp -r --preserve=all d f p s1 || fail=1 |