libselinux: do not check fcontext duplicates on use
Tools like restorecon or systemd, which load the fcontext database to
make labeling decisions do not need to check for duplicate rules. Only
the first rule will be used. Instead we should only check for
duplicates when new rules are added to the database. And fail the
transaction if we find one.
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Dan Walsh <dwalsh@redhat.com>
diff --git a/libselinux/src/label_file.c b/libselinux/src/label_file.c
index af7fd8f..3b8346d 100644
--- a/libselinux/src/label_file.c
+++ b/libselinux/src/label_file.c
@@ -485,7 +485,7 @@
pass, ++lineno) != 0)
goto finish;
}
- if (pass == 1) {
+ if (pass == 1 && rec->validating) {
status = nodups_specs(data, path);
if (status)
goto finish;