On Wed, Jul 22, 2015 at 12:02:13PM -0400, Stephen Smalley wrote: > On 07/16/2015 09:23 AM, Stephen Smalley wrote: > > On 07/15/2015 03:46 PM, Seth Forshee wrote: > >> Unprivileged users should not be able to supply security labels > >> in filesystems, nor should they be able to supply security > >> contexts in unprivileged mounts. For any mount where s_user_ns is > >> not init_user_ns, force the use of SECURITY_FS_USE_NONE behavior > >> and return EPERM if any contexts are supplied in the mount > >> options. > >> > >> Signed-off-by: Seth Forshee <seth.forshee@xxxxxxxxxxxxx> > > > > I think this is obsoleted by the subsequent discussion, but just for the > > record: this patch would cause the files in the userns mount to be left > > with the "unlabeled" label, and therefore under typical policies, > > completely inaccessible to any process in a confined domain. > > The right way to handle this for SELinux would be to automatically use > mountpoint labeling (SECURITY_FS_USE_MNTPOINT, normally set by > specifying a context= mount option), with the sbsec->mntpoint_sid set > from some related object (e.g. the block device file context, as in your > patches for Smack). That will cause SELinux to use that value instead > of any xattr value from the filesystem and will cause attempts by > userspace to set the security.selinux xattr to fail on that filesystem. > That is how SELinux normally deals with untrusted filesystems, except > that it is normally specified as a mount option by a trusted mounting > process, whereas in your case you need to automatically set it. Excellent, thank you for the advice. I'll start on this when I've finished with Smack. Seth _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
