diff --git a/libselinux/src/selinux_restorecon.c b/libselinux/src/selinux_restorecon.c index 524b171b8f1f8e25a84dec264e66c8ecdd0d5cdc..cce358402613e3f2023cdd8c5d28bfef21f67cef 100644 --- a/libselinux/src/selinux_restorecon.c +++ b/libselinux/src/selinux_restorecon.c @@ -42,6 +42,7 @@ #include "sha1.h" #define STAR_COUNT 1024 +#define RESOTECON_FILE_COUNT_LIMIT 50000 static struct selabel_handle *fc_sehandle = NULL; static bool selabel_no_digest; @@ -921,6 +922,8 @@ static void *selinux_restorecon_thread(void *arg) char ent_path[PATH_MAX]; struct stat ent_st; bool first = false; + char current_dir[PATH_MAX] = ""; + uint64_t file_count = 0; if (state->parallel) pthread_mutex_lock(&state->mutex); @@ -978,6 +981,9 @@ loop_body: fts_set(fts, ftsent, FTS_SKIP); continue; case FTS_D: + strncpy(current_dir, ftsent->fts_path, PATH_MAX - 1); + file_count = 0; + if (state->sfsb.f_type == SYSFS_MAGIC && !selabel_partial_match(fc_sehandle, ftsent->fts_path)) { @@ -1042,6 +1048,13 @@ loop_body: /* fall through */ default: + file_count++; + if (file_count > RESOTECON_FILE_COUNT_LIMIT) { + selinux_log(SELINUX_WARNING, + "Directory %s has exceeded file count limit: %llu\n", + current_dir, file_count); + } + if (strlcpy(ent_path, ftsent->fts_path, sizeof(ent_path)) >= sizeof(ent_path)) { selinux_log(SELINUX_ERROR, "Path name too long on %s.\n",