Re: [PATCH] libsepol: add support for new polcap genfs_seclabel_symlinks

[Stephen Smalley <sds@xxxxxxxxxxxxx>]

On 1/31/20 1:39 PM, Christian Göttsche wrote:
> Add support for new SELinux policy capability genfs_seclabel_symlinks.
> With this capability enabled symlinks on kernel filesystems will receive
> contexts based on genfscon statements, like directories and files,
> and not be restricted to the respective filesystem root sid.
>
> Signed-off-by: Christian Göttsche <cgzones@xxxxxxxxxxxxxx>

Acked-by: Stephen Smalley <sds@xxxxxxxxxxxxx>

> ---
>   libsepol/include/sepol/policydb/polcaps.h | 1 +
>   libsepol/src/polcaps.c                    | 1 +
>   2 files changed, 2 insertions(+)
>
> diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
> index dc9356a6..40669fb5 100644
> --- a/libsepol/include/sepol/policydb/polcaps.h
> +++ b/libsepol/include/sepol/policydb/polcaps.h
> @@ -13,6 +13,7 @@ enum {
>   	POLICYDB_CAPABILITY_ALWAYSNETWORK,
>   	POLICYDB_CAPABILITY_CGROUPSECLABEL,
>   	POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION,
> +	POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS,
>   	__POLICYDB_CAPABILITY_MAX
>   };
>   #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
> diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
> index b9dc3526..67ed5786 100644
> --- a/libsepol/src/polcaps.c
> +++ b/libsepol/src/polcaps.c
> @@ -12,6 +12,7 @@ static const char *polcap_names[] = {
>   	"always_check_network",		/* POLICYDB_CAPABILITY_ALWAYSNETWORK */
>   	"cgroup_seclabel",		/* POLICYDB_CAPABILITY_SECLABEL */
>   	"nnp_nosuid_transition",	/* POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION */
> +	"genfs_seclabel_symlinks",	/* POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS */
>   	NULL
>   };
>