From a089634c855312a28f2ff3c2e7c08df5d030e2f5 Mon Sep 17 00:00:00 2001 From: Jim Meyering redhat.com> Date: Tue, 20 May 2008 17:58:42 +0200 Subject: [PATCH] install: avoid a leak in currently-ifdef'd-out code * src/install.c (setdefaultfilecon) [ENABLE_WHEN_MATCHPATHCON_IS_MORE_EFFICIENT]: Call matchpathcon_init_prefix only once. Suggestion from Stephen Smalley. Reported by Ben Webb in . --- src/install.c | 5 ++++- 1 files changed, 4 insertions(+), 1 deletions(-) diff --git a/src/install.c b/src/install.c index 964ab36..b531f45 100644 --- a/src/install.c +++ b/src/install.c @@ -208,6 +208,8 @@ setdefaultfilecon (char const *file) { struct stat st; security_context_t scontext = NULL; + static bool first_call = true; + if (selinux_enabled != 1) { /* Indicate no context found. */ @@ -216,7 +218,7 @@ setdefaultfilecon (char const *file) if (lstat (file, &st) != 0) return; - if (IS_ABSOLUTE_FILE_NAME (file)) + if (first_call && IS_ABSOLUTE_FILE_NAME (file)) { /* Calling matchpathcon_init_prefix (NULL, "/first_component/") is an optimization to minimize the expense of the following @@ -247,6 +249,7 @@ setdefaultfilecon (char const *file) } } } + first_call = false; /* If there's an error determining the context, or it has none, return to allow default context */ -- 1.5.5.1.249.g68ef3