On 1/27/20 7:52 AM, Dominick Grift wrote:
What is the fs sid used for exactly? What, if any, is its relationship with persistent file systems with xattr support. Were currently associating a type that is generally also associated with persistent filesystems that support xattr but i dont know why. Why would it not apply to other filesystems, for example tmpfs or vfat or whatever? Is the fs sid still used and what do i need to consider when determining what context to associate with it?
Are you referring to the fs initial SID, or to the SID associated with each filesystem/superblock?
The former appears to be unused by any kernel code other than the declaration (grep -r SECINITSID_FS). At one time, it was the default SID to use for the filesystem/superblock. Looks like this has never been used in mainline Linux, just pre-mainline SELinux. Sadly we cannot just remove obsolete initial SIDs until we fix https://github.com/SELinuxProject/selinux-kernel/issues/12
The latter is still relevant but the defaults are now determined through fs_use_* or genfscon statements, default to the unlabeled SID if there is no match, and can be overridden via the fscontext= mount option. It is used in permission checks on the superblock/filesystem (e.g. mount, unmount, ...) and to limit what file contexts can be assigned to files within the filesystem (associate).
