On Friday, May 22, 2015 08:33:47 AM Stephen Smalley wrote:
> Support per-file labeling of sysfs and pstore files based on
> genfscon policy entries. This is safe because the sysfs
> and pstore directory tree cannot be manipulated by userspace,
> except to unlink pstore entries.
> This provides an alternative method of assigning per-file labeling
> to sysfs or pstore files without needing to set the labels from
> userspace on each boot. The advantages of this approach are that
> the labels are assigned as soon as the dentry is first instantiated
> and userspace does not need to walk the sysfs or pstore tree and
> set the labels on each boot. The limitations of this approach are
> that the labels can only be assigned based on pathname prefix matching.
> You can initially assign labels using this mechanism and then change
> them at runtime via setxattr if allowed to do so by policy.
>
> Signed-off-by: Stephen Smalley <sds@xxxxxxxxxxxxx>
> Suggested-by: Dominick Grift <dac.override@xxxxxxxxx>
> ---
> This version adds support for pstore as well as sysfs.
>
> security/selinux/hooks.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
Applied, thanks.
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 2c616f6..070ab05 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -727,7 +727,9 @@ static int selinux_set_mnt_opts(struct super_block *sb,
> if (strcmp(sb->s_type->name, "proc") == 0)
> sbsec->flags |= SE_SBPROC | SE_SBGENFS;
>
> - if (strcmp(sb->s_type->name, "debugfs") == 0)
> + if (!strcmp(sb->s_type->name, "debugfs") ||
> + !strcmp(sb->s_type->name, "sysfs") ||
> + !strcmp(sb->s_type->name, "pstore"))
> sbsec->flags |= SE_SBGENFS;
>
> if (!sbsec->behavior) {
--
paul moore
www.paul-moore.com
_______________________________________________
Selinux mailing list
Selinux@xxxxxxxxxxxxx
To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx.
To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
