On Mon, Jan 27, 2020 at 08:55:00AM -0500, Stephen Smalley wrote: > On 1/27/20 7:52 AM, Dominick Grift wrote: > > What is the fs sid used for exactly? What, if any, is its relationship with persistent file systems with xattr support. > > Were currently associating a type that is generally also associated with persistent filesystems that support xattr but i dont know why. > > Why would it not apply to other filesystems, for example tmpfs or vfat or whatever? > > > > Is the fs sid still used and what do i need to consider when determining what context to associate with it? > > Are you referring to the fs initial SID, or to the SID associated with each > filesystem/superblock? Thanks. Yes was referring to the fs initial sid. I now moved it to the list of unused_isids. I'll see if that works > > The former appears to be unused by any kernel code other than the > declaration (grep -r SECINITSID_FS). At one time, it was the default SID to > use for the filesystem/superblock. Looks like this has never been used in > mainline Linux, just pre-mainline SELinux. Sadly we cannot just remove > obsolete initial SIDs until we fix > https://github.com/SELinuxProject/selinux-kernel/issues/12 > > The latter is still relevant but the defaults are now determined through > fs_use_* or genfscon statements, default to the unlabeled SID if there is no > match, and can be overridden via the fscontext= mount option. It is used in > permission checks on the superblock/filesystem (e.g. mount, unmount, ...) > and to limit what file contexts can be assigned to files within the > filesystem (associate). -- gpg --locate-keys dominick.grift@xxxxxxxxxxx Key fingerprint = FCD2 3660 5D6B 9D27 7FC6 E0FF DA7E 521F 10F6 4098 Dominick Grift
Attachment:
signature.asc
Description: PGP signature
