: allow setfiles to continue on errors (new option)

PATCH In review Guido Trentalancia 2 participants 4 messages Jul 21, 2012 – Jul 24, 2012 SELinux security module

lore

Share & tools

lore

Guido Trentalancia

author

2012-07-21 13:19 UTC #0 lore raw

PATCH 1/1 : allow setfiles to continue on errors (new option)

Add a command-line option to setfiles to disable program abortion after 10 errors (e.g. invalid contexts).

Signed-off-by Guido Trentalancia <[email protected]>

---

 policycoreutils/setfiles/restore.o  |binary
 policycoreutils/setfiles/restorecon |binary
 policycoreutils/setfiles/setfiles   |binary
 policycoreutils/setfiles/setfiles.8 |    3 +++
 policycoreutils/setfiles/setfiles.c |   11 +++++++----
 policycoreutils/setfiles/setfiles.o |binary
 6 files changed, 10 insertions(+), 4 deletions(-)

policycoreutils/setfiles/setfiles.8 +3 -0

diff -pruN selinux-20072012/policycoreutils/setfiles/setfiles.8 selinux-20072012-setfiles-continue-on-errors/policycoreutils/setfiles/setfiles.8
@@ -43,6 +43,9 @@ use an alternate root path
 .TP 
 .B \-e directory
 directory to exclude (repeat option for more than one directory.)
+.TP
+.B \-C
+continue on errors (instead of aborting after 10 errors).
 .TP 
 .B \-F
 Force reset of context to match file_context for customizable files

policycoreutils/setfiles/setfiles.c +7 -4

diff -pruN selinux-20072012/policycoreutils/setfiles/setfiles.c selinux-20072012-setfiles-continue-on-errors/policycoreutils/setfiles/setfiles.c
@@ -43,9 +43,9 @@ void usage(const char *const name)
 			name);
 	} else {
 		fprintf(stderr,
-			"usage:  %s [-dnpqvW] [-o filename] [-r alt_root_path ] spec_file pathname...\n"
+			"usage:  %s [-dnpqvCW] [-o filename] [-r alt_root_path ] spec_file pathname...\n"
 			"usage:  %s -c policyfile spec_file\n"
-			"usage:  %s -s [-dnpqvW] [-o filename ] spec_file\n", name, name,
+			"usage:  %s -s [-dnpqvCW] [-o filename ] spec_file\n", name, name,
 			name);
 	}
 	exit(1);

@@ -56,7 +56,7 @@ static int nerr = 0;
 void inc_err()
 {
 	nerr++;
-	if (nerr > 9 && !r_opts.debug) {
+	if (nerr > 9 && !r_opts.debug && r_opts.abort_on_error) {
 		fprintf(stderr, "Exiting after 10 errors.\n");
 		exit(1);
 	}

@@ -217,7 +217,7 @@ int main(int argc, char **argv)
 	exclude_non_seclabel_mounts();
 
 	/* Process any options. */
-	while ((opt = getopt(argc, argv, "c:de:f:ilnpqrsvo:FRW0")) > 0) {
+	while ((opt = getopt(argc, argv, "c:de:f:ilnpqrsvo:CFRW0")) > 0) {
 		switch (opt) {
 		case 'c':
 			{

@@ -274,6 +274,9 @@ int main(int argc, char **argv)
 		case 'l':
 			r_opts.logging = 1;
 			break;
+		case 'C':
+			r_opts.abort_on_error = 0;
+			break;
 		case 'F':
 			r_opts.force = 1;
 			break;

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Pat McClory

2012-07-23 15:28 UTC #1 lore raw

Quoted 5 lines · Guido Trentalancia

Add a command-line option to setfiles to disable program abortion after 10 errors (e.g. invalid contexts).
Signed-off-by Guido Trentalancia<[email protected]>

Quoted 9 lines

---

  policycoreutils/setfiles/restore.o  |binary
  policycoreutils/setfiles/restorecon |binary
  policycoreutils/setfiles/setfiles   |binary
  policycoreutils/setfiles/setfiles.8 |    3 +++
  policycoreutils/setfiles/setfiles.c |   11 +++++++----
  policycoreutils/setfiles/setfiles.o |binary
  6 files changed, 10 insertions(+), 4 deletions(-)

probably don't want object files and executables appearing in the diff.

Quoted 38 lines

diff -pruN selinux-20072012/policycoreutils/setfiles/setfiles.8 selinux-20072012-setfiles-continue-on-errors/policycoreutils/setfiles/setfiles.8

policycoreutils/setfiles/setfiles.8 +3 -0

@@ -43,6 +43,9 @@ use an alternate root path
  .TP
  .B \-e directory
  directory to exclude (repeat option for more than one directory.)
+.TP
+.B \-C
+continue on errors (instead of aborting after 10 errors).
  .TP
  .B \-F
  Force reset of context to match file_context for customizable files

diff -pruN selinux-20072012/policycoreutils/setfiles/setfiles.c selinux-20072012-setfiles-continue-on-errors/policycoreutils/setfiles/setfiles.c

policycoreutils/setfiles/setfiles.c +3 -3

@@ -43,9 +43,9 @@ void usage(const char *const name)
  			name);
  	} else {
  		fprintf(stderr,
-			"usage:  %s [-dnpqvW] [-o filename] [-r alt_root_path ] spec_file pathname...\n"
+			"usage:  %s [-dnpqvCW] [-o filename] [-r alt_root_path ] spec_file pathname...\n"
  			"usage:  %s -c policyfile spec_file\n"
-			"usage:  %s -s [-dnpqvW] [-o filename ] spec_file\n", name, name,
+			"usage:  %s -s [-dnpqvCW] [-o filename ] spec_file\n", name, name,
  			name);
  	}
  	exit(1);

@@ -56,7 +56,7 @@ static int nerr = 0;
  void inc_err()
  {
  	nerr++;
-	if (nerr>  9&&  !r_opts.debug) {
+	if (nerr>  9&&  !r_opts.debug&&  r_opts.abort_on_error) {
  		fprintf(stderr, "Exiting after 10 errors.\n");
  		exit(1);
  	}

policycoreutils/setfiles/setfiles.c int main(int argc, char **argv) · line 220

Quoted 5 lines

policycoreutils/setfiles/setfiles.c +1 -1

@@ -217,7 +217,7 @@ int main(int argc, char **argv)
  	exclude_non_seclabel_mounts();
 
  	/* Process any options. */
-	while ((opt = getopt(argc, argv, "c:de:f:ilnpqrsvo:FRW0"))>  0) {
+	while ((opt = getopt(argc, argv, "c:de:f:ilnpqrsvo:CFRW0"))>  0) {

I think it's confusing that there are now two options that control whether or not to exit after 10 errors. I think the man page should be updated to reflect that -d implies -C.

policycoreutils/setfiles/setfiles.c int main(int argc, char **argv) · line 279

Quoted 10 lines

policycoreutils/setfiles/setfiles.c +3 -0

  		switch (opt) {
  		case 'c':
  			{

@@ -274,6 +274,9 @@ int main(int argc, char **argv)
  		case 'l':
  			r_opts.logging = 1;
  			break;
+		case 'C':
+			r_opts.abort_on_error = 0;
+			break;

b/c -C is only an option for setfiles, I think there should be an

if (iamrestorecon)

    usage(argv[0]);

block in this case (like there is for -c)

Quoted 9 lines

policycoreutils/setfiles/setfiles.c +0 -1
  		case 'F':
  			r_opts.force = 1;
  			break;
 
 
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Guido Trentalancia

author

2012-07-23 20:58 UTC #2 lore raw

Hello Pat.

Thanks for your comments.

Quoted 6 lines · Pat McClory

Quoted 5 lines · Guido Trentalancia
Add a command-line option to setfiles to disable program abortion after 10 errors (e.g. invalid contexts).
Signed-off-by Guido Trentalancia<[email protected]>

Quoted 8 lines

---

  policycoreutils/setfiles/restore.o  |binary
  policycoreutils/setfiles/restorecon |binary
  policycoreutils/setfiles/setfiles   |binary
  policycoreutils/setfiles/setfiles.8 |    3 +++
  policycoreutils/setfiles/setfiles.c |   11 +++++++----
  policycoreutils/setfiles/setfiles.o |binary
  6 files changed, 10 insertions(+), 4 deletions(-)

Oops. I am sorry, please just ignore them.

Quoted 42 lines

probably don't want object files and executables appearing in the diff.

Quoted 40 lines

diff -pruN selinux-20072012/policycoreutils/setfiles/setfiles.8 selinux-20072012-setfiles-continue-on-errors/policycoreutils/setfiles/setfiles.8

policycoreutils/setfiles/setfiles.8 +3 -0

@@ -43,6 +43,9 @@ use an alternate root path
  .TP
  .B \-e directory
  directory to exclude (repeat option for more than one directory.)
+.TP
+.B \-C
+continue on errors (instead of aborting after 10 errors).
  .TP
  .B \-F
  Force reset of context to match file_context for customizable files

diff -pruN selinux-20072012/policycoreutils/setfiles/setfiles.c selinux-20072012-setfiles-continue-on-errors/policycoreutils/setfiles/setfiles.c

policycoreutils/setfiles/setfiles.c +3 -3

@@ -43,9 +43,9 @@ void usage(const char *const name)
  			name);
  	} else {
  		fprintf(stderr,
-			"usage:  %s [-dnpqvW] [-o filename] [-r alt_root_path ] spec_file pathname...\n"
+			"usage:  %s [-dnpqvCW] [-o filename] [-r alt_root_path ] spec_file pathname...\n"
  			"usage:  %s -c policyfile spec_file\n"
-			"usage:  %s -s [-dnpqvW] [-o filename ] spec_file\n", name, name,
+			"usage:  %s -s [-dnpqvCW] [-o filename ] spec_file\n", name, name,
  			name);
  	}
  	exit(1);

@@ -56,7 +56,7 @@ static int nerr = 0;
  void inc_err()
  {
  	nerr++;
-	if (nerr>  9&&  !r_opts.debug) {
+	if (nerr>  9&&  !r_opts.debug&&  r_opts.abort_on_error) {
  		fprintf(stderr, "Exiting after 10 errors.\n");
  		exit(1);
  	}

@@ -217,7 +217,7 @@ int main(int argc, char **argv)
  	exclude_non_seclabel_mounts();

Quoted 7 lines

policycoreutils/setfiles/setfiles.c int main(int argc, char **argv) · line 220
Quoted 3 lines
policycoreutils/setfiles/setfiles.c +1 -1
  	/* Process any options. */
-	while ((opt = getopt(argc, argv, "c:de:f:ilnpqrsvo:FRW0"))>  0) {
+	while ((opt = getopt(argc, argv, "c:de:f:ilnpqrsvo:CFRW0"))>  0) {
I think it's confusing that there are now two options that control whether or not to exit after 10 errors. I think the man page should be updated to reflect that -d implies -C.

Yes, you're right, I didn't notice that, mostly because I trusted too much the wording "debug" as being something related to producing more verbose output or some other functionality related to the usual meaning of the word in similar contexts and even more catastrophically I did then fully trust the actual manual page description of the option.

In truth the problem is not just related to "debugging" but also to "fixing" the filesystem as invalid contexts might be due to an improper policy installation (e.g. begin a new policy + do not relabel or system crashes or new policy loading fails for some reason at the next reboot = the system needs to be fixed after rebooting and there might be invalid contexts around).

Given the above, it's better to ignore the whole patch and perhaps just give a better documentation of -d (or at most, add -C as an alias to -d in the switch block).

I think there is at least one more in-congruence in the documentation, as far as I remember, the -0 option is only documented in one of the two manual pages.

Quoted 13 lines

policycoreutils/setfiles/setfiles.c int main(int argc, char **argv) · line 279
Quoted 10 lines
policycoreutils/setfiles/setfiles.c +3 -0
  		switch (opt) {
  		case 'c':
  			{
@@ -274,6 +274,9 @@ int main(int argc, char **argv)
  		case 'l':
  			r_opts.logging = 1;
  			break;
+		case 'C':
+			r_opts.abort_on_error = 0;
+			break;
b/c -C is only an option for setfiles, I think there should be an

Quoted 2 lines

if (iamrestorecon)
     usage(argv[0]);

To be honest, at the moment, I think restorecon does not produce any usage message when called without arguments (so that at first, to get one, I had to fool it by using an invalid option such as -h). If you don't mind, I'll check what exactly is going on tomorrow as I am quite sure that's not the way it was intended to behave when it was created...

By the way, I was also thinking about de-hardcoding the number of errors value of 10 (by using a #define), in order to improve style, readability and so on.

Quoted 7 lines

block in this case (like there is for -c)
Quoted 5 lines
policycoreutils/setfiles/setfiles.c +0 -0
  		case 'F':
  			r_opts.force = 1;
  			break;

Regards,

Guido

Guido Trentalancia

author

2012-07-24 13:27 UTC #3 lore raw

PATCH 1/1 : setfiles/restorecon minor improvements [was Re: [PATCH]: allow setfiles to continue on errors (new option)]

In reply to Pat McClory

Hello again Pat.

With a little bit more time available, I managed to come to a more meaningful, possibly better patch for setfiles/restorecon that:

- improves the manual page for both setfiles and restorecon (formatting including alphabetical re-ordering of options, undocumented options, references and a few cosmetic changes);
- de-hardcodes a couple of constants in the source files and makes a dynamic use of them to create the manual pages after the compilation and prior to the installation: more specifically the constants are the number of errors for the setfiles' validation process abort condition and the sensitivity of the progress meter for both programs (uses external programs grep and awk);
- improves the usage message for both programs and introduces a -h (aliased with currently existing -?) option where not already available;
- print out the usage message for restorecon when it is called without arguments;
- white-space/tab conversion to get proper indentation towards the end of the main source file.

If you and/or others like any part of the patch or just believe it might be useful, feel free to apply it. Also, if you believe anything is in error, please let me know (as in further inline review, for example) and I'll try to amend as required.

Signed-off-by Guido Trentalancia <[email protected]>

---
 policycoreutils/setfiles/Makefile     |   18 +++++--
 policycoreutils/setfiles/restorecon.8 |   73 +++++++++++++++++++-----------
 policycoreutils/setfiles/setfiles.8   |   81 ++++++++++++++++++++++------------
 policycoreutils/setfiles/setfiles.c   |   34 +++++++++-----
 4 files changed, 137 insertions(+), 69 deletions(-)

policycoreutils/setfiles/Makefile +14 -4

diff -pruN selinux/policycoreutils/setfiles/Makefile selinux-20072012-setfiles-minor-fixes/policycoreutils/setfiles/Makefile
@@ -5,6 +5,9 @@ MANDIR = $(PREFIX)/share/man
 LIBDIR ?= $(PREFIX)/lib
 AUDITH = $(shell ls /usr/include/libaudit.h 2>/dev/null)
 
+PROGRESS_STEP=$(shell grep "^\#define STAR_COUNT" restore.h | awk -S '{ print $$3 }')
+ABORT_ON_ERRORS=$(shell grep "^\#define ABORT_ON_ERRORS" setfiles.c | awk -S '{ print $$3 }')
+
 CFLAGS = -g -Werror -Wall -W
 override CFLAGS += -I$(PREFIX)/include
 LDLIBS = -lselinux -lsepol -L$(LIBDIR)

@@ -14,25 +17,32 @@ ifeq ($(AUDITH), /usr/include/libaudit.h
 	LDLIBS += -laudit
 endif
 
-all: setfiles restorecon
+all: setfiles restorecon man
 
 setfiles:  setfiles.o restore.o
 
 restorecon: setfiles
 	ln -sf setfiles restorecon
 
+man:
+	@cp -af setfiles.8 setfiles.8.man
+	@cp -af restorecon.8 restorecon.8.man
+	@sed -i "s/STAR_COUNT/$(PROGRESS_STEP)/g" setfiles.8.man restorecon.8.man
+	@sed -i "s/ABORT_ON_ERRORS/$(ABORT_ON_ERRORS)/g" setfiles.8.man
+ 
 install: all
 	[ -d $(MANDIR)/man8 ] || mkdir -p $(MANDIR)/man8
 	-mkdir -p $(SBINDIR)
 	install -m 755 setfiles $(SBINDIR)
 	(cd $(SBINDIR) && ln -sf setfiles restorecon)
-	install -m 644 setfiles.8 restorecon.8 $(MANDIR)/man8
+	install -m 644 setfiles.8.man $(MANDIR)/man8/setfiles.8
+	install -m 644 restorecon.8.man $(MANDIR)/man8/restorecon.8
 
 clean:
-	rm -f setfiles restorecon *.o 
+	rm -f setfiles restorecon *.o setfiles.8.man restorecon.8.man
 
 indent:
 	../../scripts/Lindent $(wildcard *.[ch])
 
 relabel: install
-	/sbin/restorecon $(SBINDIR)/setfiles
+	$(SBINDIR)/restorecon $(SBINDIR)/setfiles

policycoreutils/setfiles/restorecon.8 +47 ~~-26~~

112 lines not on this page · raw message

policycoreutils/setfiles/setfiles.8 +54 ~~-27~~

136 lines not on this page · raw message

policycoreutils/setfiles/setfiles.c +22 ~~-12~~

diff -pruN selinux/policycoreutils/setfiles/setfiles.c selinux-20072012-setfiles-minor-fixes/policycoreutils/setfiles/setfiles.c
@@ -25,7 +25,11 @@ static struct restore_opts r_opts;
 
 #define STAT_BLOCK_SIZE 1
 
-
+/* setfiles will abort its operation after reaching the
+ * following number of errors (e.g. invalid contexts),
+ * unless it is used in "debug" mode (-d option).
+ */
+#define ABORT_ON_ERRORS	10
 
 #define SETFILES "setfiles"
 #define RESTORECON "restorecon"

@@ -39,14 +43,16 @@ void usage(const char *const name)
 {
 	if (iamrestorecon) {
 		fprintf(stderr,
-			"usage:  %s [-iFnprRv0] [-e excludedir ] [-o filename ] [-f filename | pathname... ]\n",
-			name);
+			"usage:  %s [-iFnprRv0] [-e excludedir] [-o filename] pathname...\n"
+			"usage:  %s [-iFnprRv0] [-e excludedir] [-o filename] -f filename\n",
+			name, name);
 	} else {
 		fprintf(stderr,
-			"usage:  %s [-dnpqvW] [-o filename] [-r alt_root_path ] spec_file pathname...\n"
-			"usage:  %s -c policyfile spec_file\n"
-			"usage:  %s -s [-dnpqvW] [-o filename ] spec_file\n", name, name,
-			name);
+			"usage:  %s [-dilnpqvFW] [-e excludedir] [-o filename] [-r alt_root_path] spec_file pathname...\n"
+			"usage:  %s [-dilnpqvFW] [-e excludedir] [-o filename] [-r alt_root_path] spec_file -f filename...\n"
+			"usage:  %s -s [-dilnpqvFW] [-o filename] spec_file\n"
+			"usage:  %s -c policyfile spec_file\n",
+			name, name, name, name);
 	}
 	exit(1);
 }

@@ -56,7 +62,7 @@ static int nerr = 0;
 void inc_err()
 {
 	nerr++;
-	if (nerr > 9 && !r_opts.debug) {
+	if (nerr > ABORT_ON_ERRORS - 1 && !r_opts.debug) {
 		fprintf(stderr, "Exiting after 10 errors.\n");
 		exit(1);
 	}

@@ -217,7 +223,7 @@ int main(int argc, char **argv)
 	exclude_non_seclabel_mounts();
 
 	/* Process any options. */
-	while ((opt = getopt(argc, argv, "c:de:f:ilnpqrsvo:FRW0")) > 0) {
+	while ((opt = getopt(argc, argv, "c:de:f:hilno:pqrsvFRW0")) > 0) {
 		switch (opt) {
 		case 'c':
 			{

@@ -266,6 +272,8 @@ int main(int argc, char **argv)
 			input_filename = optarg;
 			break;			
 		case 'd':
+			if (iamrestorecon)
+				usage(argv[0]);
 			r_opts.debug = 1;
 			break;
 		case 'i':

@@ -344,6 +352,7 @@ int main(int argc, char **argv)
 		case '0':
 			null_terminated = 1;
 			break;
+		case 'h':
 		case '?':
 			usage(argv[0]);
 		}

@@ -381,7 +390,8 @@ int main(int argc, char **argv)
 
 		altpath = argv[optind];
 		optind++;
-	}
+	} else if (argc == 1)
+		usage(argv[0]);
 
 	/* Load the file contexts configuration and check it. */
 	r_opts.selabel_opt_validate = (ctx_validate ? (char *)1 : NULL);

@@ -433,7 +443,7 @@ int main(int argc, char **argv)
 	if (r_opts.outfile)
 		fclose(r_opts.outfile);
 
-       if (r_opts.progress && r_opts.count >= STAR_COUNT)
-               printf("\n");
+	if (r_opts.progress && r_opts.count >= STAR_COUNT)
+		printf("\n");
 	exit(errors);
 }

Quoted 79 lines · Pat McClory

Quoted 5 lines · Guido Trentalancia
Add a command-line option to setfiles to disable program abortion after 10 errors (e.g. invalid contexts).
Signed-off-by Guido Trentalancia<[email protected]>
Quoted 9 lines
---
  policycoreutils/setfiles/restore.o  |binary
  policycoreutils/setfiles/restorecon |binary
  policycoreutils/setfiles/setfiles   |binary
  policycoreutils/setfiles/setfiles.8 |    3 +++
  policycoreutils/setfiles/setfiles.c |   11 +++++++----
  policycoreutils/setfiles/setfiles.o |binary
  6 files changed, 10 insertions(+), 4 deletions(-)
probably don't want object files and executables appearing in the diff.
Quoted 38 lines
diff -pruN selinux-20072012/policycoreutils/setfiles/setfiles.8 selinux-20072012-setfiles-continue-on-errors/policycoreutils/setfiles/setfiles.8
policycoreutils/setfiles/setfiles.8 +3 -0
@@ -43,6 +43,9 @@ use an alternate root path
  .TP
  .B \-e directory
  directory to exclude (repeat option for more than one directory.)
+.TP
+.B \-C
+continue on errors (instead of aborting after 10 errors).
  .TP
  .B \-F
  Force reset of context to match file_context for customizable files
diff -pruN selinux-20072012/policycoreutils/setfiles/setfiles.c selinux-20072012-setfiles-continue-on-errors/policycoreutils/setfiles/setfiles.c
policycoreutils/setfiles/setfiles.c +3 -3
@@ -43,9 +43,9 @@ void usage(const char *const name)
  			name);
  	} else {
  		fprintf(stderr,
-			"usage:  %s [-dnpqvW] [-o filename] [-r alt_root_path ] spec_file pathname...\n"
+			"usage:  %s [-dnpqvCW] [-o filename] [-r alt_root_path ] spec_file pathname...\n"
  			"usage:  %s -c policyfile spec_file\n"
-			"usage:  %s -s [-dnpqvW] [-o filename ] spec_file\n", name, name,
+			"usage:  %s -s [-dnpqvCW] [-o filename ] spec_file\n", name, name,
  			name);
  	}
  	exit(1);
@@ -56,7 +56,7 @@ static int nerr = 0;
  void inc_err()
  {
  	nerr++;
-	if (nerr>  9&&  !r_opts.debug) {
+	if (nerr>  9&&  !r_opts.debug&&  r_opts.abort_on_error) {
  		fprintf(stderr, "Exiting after 10 errors.\n");
  		exit(1);
  	}
policycoreutils/setfiles/setfiles.c int main(int argc, char **argv) · line 220
Quoted 5 lines
policycoreutils/setfiles/setfiles.c +1 -1
@@ -217,7 +217,7 @@ int main(int argc, char **argv)
  	exclude_non_seclabel_mounts();
 
  	/* Process any options. */
-	while ((opt = getopt(argc, argv, "c:de:f:ilnpqrsvo:FRW0"))>  0) {
+	while ((opt = getopt(argc, argv, "c:de:f:ilnpqrsvo:CFRW0"))>  0) {
I think it's confusing that there are now two options that control whether or not to exit after 10 errors. I think the man page should be updated to reflect that -d implies -C.
policycoreutils/setfiles/setfiles.c int main(int argc, char **argv) · line 279
Quoted 10 lines
policycoreutils/setfiles/setfiles.c +3 -0
  		switch (opt) {
  		case 'c':
  			{
@@ -274,6 +274,9 @@ int main(int argc, char **argv)
  		case 'l':
  			r_opts.logging = 1;
  			break;
+		case 'C':
+			r_opts.abort_on_error = 0;
+			break;
b/c -C is only an option for setfiles, I think there should be an

Quoted 10 lines

if (iamrestorecon)
     usage(argv[0]);
block in this case (like there is for -c)
Quoted 5 lines
policycoreutils/setfiles/setfiles.c +0 -0
  		case 'F':
  			r_opts.force = 1;
  			break;