[PATCH] libselinux: drop error return from is_selinux_enabled.3

[PATCH] libselinux: drop error return from is_selinux_enabled.3

[Christian Göttsche]

is_selinux_enabled() does never return -1, do not say so in the manpage.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 libselinux/man/man3/is_selinux_enabled.3 | 1 -
 1 file changed, 1 deletion(-)

diff --git a/libselinux/man/man3/is_selinux_enabled.3 b/libselinux/man/man3/is_selinux_enabled.3
index df62c225..a887b48c 100644
--- a/libselinux/man/man3/is_selinux_enabled.3
+++ b/libselinux/man/man3/is_selinux_enabled.3
@@ -15,7 +15,6 @@ is_selinux_mls_enabled \- check whether SELinux is enabled for (Multi Level Secu
 .SH "DESCRIPTION"
 .BR is_selinux_enabled ()
 returns 1 if SELinux is running or 0 if it is not. 
-On error, \-1 is returned.
 
 .BR is_selinux_mls_enabled ()
 returns 1 if SELinux is capable of running in MLS mode or 0 if it is not. To
-- 
2.25.0

Re: [PATCH] libselinux: drop error return from is_selinux_enabled.3

[Petr Lautrbach]

Christian Göttsche <cgzones@googlemail.com> writes:

> is_selinux_enabled() does never return -1, do not say so in the manpage.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
>  libselinux/man/man3/is_selinux_enabled.3 | 1 -
>  1 file changed, 1 deletion(-)
>
> diff --git a/libselinux/man/man3/is_selinux_enabled.3 b/libselinux/man/man3/is_selinux_enabled.3
> index df62c225..a887b48c 100644
> --- a/libselinux/man/man3/is_selinux_enabled.3
> +++ b/libselinux/man/man3/is_selinux_enabled.3
> @@ -15,7 +15,6 @@ is_selinux_mls_enabled \- check whether SELinux is enabled for (Multi Level Secu
>  .SH "DESCRIPTION"
>  .BR is_selinux_enabled ()
>  returns 1 if SELinux is running or 0 if it is not. 
> -On error, \-1 is returned.
>  
>  .BR is_selinux_mls_enabled ()
>  returns 1 if SELinux is capable of running in MLS mode or 0 if it is not. To


There's also

libselinux/include/selinux/selinux.h:

/* Return 1 if we are running on a SELinux kernel, or 0 if not or -1 if we get an error. */
extern int is_selinux_enabled(void);


Would you mind to update this as well?

Thanks,

Petr

Re: [PATCH] libselinux: drop error return from is_selinux_enabled.3

[Stephen Smalley]

On 2/7/20 10:39 AM, Petr Lautrbach wrote:
> 
> Christian Göttsche <cgzones@googlemail.com> writes:
> 
>> is_selinux_enabled() does never return -1, do not say so in the manpage.

Just as a historical footnote: it used to be possible that it would 
return -1 prior to commit e3cab998b48ab293a9962faf9779d70ca339c65d circa 
release 20120216.

>>
>> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
>> ---
>>   libselinux/man/man3/is_selinux_enabled.3 | 1 -
>>   1 file changed, 1 deletion(-)
>>
>> diff --git a/libselinux/man/man3/is_selinux_enabled.3 b/libselinux/man/man3/is_selinux_enabled.3
>> index df62c225..a887b48c 100644
>> --- a/libselinux/man/man3/is_selinux_enabled.3
>> +++ b/libselinux/man/man3/is_selinux_enabled.3
>> @@ -15,7 +15,6 @@ is_selinux_mls_enabled \- check whether SELinux is enabled for (Multi Level Secu
>>   .SH "DESCRIPTION"
>>   .BR is_selinux_enabled ()
>>   returns 1 if SELinux is running or 0 if it is not.
>> -On error, \-1 is returned.
>>   
>>   .BR is_selinux_mls_enabled ()
>>   returns 1 if SELinux is capable of running in MLS mode or 0 if it is not. To
> 
> 
> There's also
> 
> libselinux/include/selinux/selinux.h:
> 
> /* Return 1 if we are running on a SELinux kernel, or 0 if not or -1 if we get an error. */
> extern int is_selinux_enabled(void);
> 
> 
> Would you mind to update this as well?
> 
> Thanks,
> 
> Petr
> 

Re: [PATCH] libselinux: drop error return from is_selinux_enabled.3

[Christian Göttsche]

Am Fr., 7. Feb. 2020 um 18:51 Uhr schrieb Stephen Smalley <sds@tycho.nsa.gov>:
>
> On 2/7/20 10:39 AM, Petr Lautrbach wrote:
> >
> > Christian Göttsche <cgzones@googlemail.com> writes:
> >
> >> is_selinux_enabled() does never return -1, do not say so in the manpage.

I am having second thoughts about this:
With the current inaccurate documentation the worst effect are dead
error handlers in client code.
But when removed now, after a potential SELinux rework (either kernel
or userland) in some years it might be way harder to re-introduce
error checking in all client applications.

Re: [PATCH] libselinux: drop error return from is_selinux_enabled.3

[Stephen Smalley]

On 2/11/20 2:12 PM, Christian Göttsche wrote:
> Am Fr., 7. Feb. 2020 um 18:51 Uhr schrieb Stephen Smalley <sds@tycho.nsa.gov>:
>>
>> On 2/7/20 10:39 AM, Petr Lautrbach wrote:
>>>
>>> Christian Göttsche <cgzones@googlemail.com> writes:
>>>
>>>> is_selinux_enabled() does never return -1, do not say so in the manpage.
> 
> I am having second thoughts about this:
> With the current inaccurate documentation the worst effect are dead
> error handlers in client code.
> But when removed now, after a potential SELinux rework (either kernel
> or userland) in some years it might be way harder to re-introduce
> error checking in all client applications.

Looking around at callers via codesearch, I don't see any actual error 
handlers for is_selinux_enabled() < 0.  There is also inconsistent 
handling of the < 0 case; some code handles it the same as 0 (disabled) 
while other code handles any non-zero result as selinux-enabled. 
Probably better to fix the man page and header.

[PATCH] libselinux: drop error return from is_selinux_enabled documentation

[Christian Göttsche]

Since commit e3cab998b48ab293a9962faf9779d70ca339c65d ("libselinux
mountpoint changing patch.") for version 20120216 is_selinux_enabled()
does never return -1; drop mentions in the man-page and header file.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 libselinux/include/selinux/selinux.h     | 2 +-
 libselinux/man/man3/is_selinux_enabled.3 | 1 -
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/libselinux/include/selinux/selinux.h b/libselinux/include/selinux/selinux.h
index 7922d96b..883d8b85 100644
--- a/libselinux/include/selinux/selinux.h
+++ b/libselinux/include/selinux/selinux.h
@@ -8,7 +8,7 @@
 extern "C" {
 #endif
 
-/* Return 1 if we are running on a SELinux kernel, or 0 if not or -1 if we get an error. */
+/* Return 1 if we are running on a SELinux kernel, or 0 otherwise. */
 extern int is_selinux_enabled(void);
 /* Return 1 if we are running on a SELinux MLS kernel, or 0 otherwise. */
 extern int is_selinux_mls_enabled(void);
diff --git a/libselinux/man/man3/is_selinux_enabled.3 b/libselinux/man/man3/is_selinux_enabled.3
index df62c225..a887b48c 100644
--- a/libselinux/man/man3/is_selinux_enabled.3
+++ b/libselinux/man/man3/is_selinux_enabled.3
@@ -15,7 +15,6 @@ is_selinux_mls_enabled \- check whether SELinux is enabled for (Multi Level Secu
 .SH "DESCRIPTION"
 .BR is_selinux_enabled ()
 returns 1 if SELinux is running or 0 if it is not. 
-On error, \-1 is returned.
 
 .BR is_selinux_mls_enabled ()
 returns 1 if SELinux is capable of running in MLS mode or 0 if it is not. To
-- 
2.25.0

Re: [PATCH] libselinux: drop error return from is_selinux_enabled documentation

[Stephen Smalley]

On 2/14/20 1:47 PM, Christian Göttsche wrote:
> Since commit e3cab998b48ab293a9962faf9779d70ca339c65d ("libselinux
> mountpoint changing patch.") for version 20120216 is_selinux_enabled()
> does never return -1; drop mentions in the man-page and header file.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Acked-by: Stephen Smalley <sds@tycho.nsa.gov>

> ---
>   libselinux/include/selinux/selinux.h     | 2 +-
>   libselinux/man/man3/is_selinux_enabled.3 | 1 -
>   2 files changed, 1 insertion(+), 2 deletions(-)
> 
> diff --git a/libselinux/include/selinux/selinux.h b/libselinux/include/selinux/selinux.h
> index 7922d96b..883d8b85 100644
> --- a/libselinux/include/selinux/selinux.h
> +++ b/libselinux/include/selinux/selinux.h
> @@ -8,7 +8,7 @@
>   extern "C" {
>   #endif
>   
> -/* Return 1 if we are running on a SELinux kernel, or 0 if not or -1 if we get an error. */
> +/* Return 1 if we are running on a SELinux kernel, or 0 otherwise. */
>   extern int is_selinux_enabled(void);
>   /* Return 1 if we are running on a SELinux MLS kernel, or 0 otherwise. */
>   extern int is_selinux_mls_enabled(void);
> diff --git a/libselinux/man/man3/is_selinux_enabled.3 b/libselinux/man/man3/is_selinux_enabled.3
> index df62c225..a887b48c 100644
> --- a/libselinux/man/man3/is_selinux_enabled.3
> +++ b/libselinux/man/man3/is_selinux_enabled.3
> @@ -15,7 +15,6 @@ is_selinux_mls_enabled \- check whether SELinux is enabled for (Multi Level Secu
>   .SH "DESCRIPTION"
>   .BR is_selinux_enabled ()
>   returns 1 if SELinux is running or 0 if it is not.
> -On error, \-1 is returned.
>   
>   .BR is_selinux_mls_enabled ()
>   returns 1 if SELinux is capable of running in MLS mode or 0 if it is not. To
> 

Re: [PATCH] libselinux: drop error return from is_selinux_enabled documentation

[Stephen Smalley]

On 2/14/20 2:42 PM, Stephen Smalley wrote:
> On 2/14/20 1:47 PM, Christian Göttsche wrote:
>> Since commit e3cab998b48ab293a9962faf9779d70ca339c65d ("libselinux
>> mountpoint changing patch.") for version 20120216 is_selinux_enabled()
>> does never return -1; drop mentions in the man-page and header file.
>>
>> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> 
> Acked-by: Stephen Smalley <sds@tycho.nsa.gov>

Thanks, applied.