Enable reading of /sys/fs/selinux/unshare as a way to detect
whether a process is in a non-init SELinux namespace. This is
to allow the selinux-testsuite to adapt based on whether it is
run within a child SELinux namespace. Whether or not we want
to retain this as a userspace API is an open question.
Signed-off-by: Stephen Smalley <stephen.smalley.work@xxxxxxxxx>
---
security/selinux/selinuxfs.c | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index de4d7eda415f..efceb3ac9157 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -329,6 +329,19 @@ static const struct file_operations sel_disable_ops = {
.llseek = generic_file_llseek,
};
+static ssize_t sel_read_unshare(struct file *filp, char __user *buf,
+ size_t count, loff_t *ppos)
+{
+ struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
+ char tmpbuf[1];
+
+ if (fsi->state == init_selinux_state)
+ tmpbuf[0] = '0';
+ else
+ tmpbuf[0] = '1';
+ return simple_read_from_buffer(buf, count, ppos, tmpbuf, 1);
+}
+
static ssize_t sel_write_unshare(struct file *file, const char __user *buf,
size_t count, loff_t *ppos)
@@ -390,6 +403,7 @@ static ssize_t sel_write_unshare(struct file *file, const char __user *buf,
}
static const struct file_operations sel_unshare_ops = {
+ .read = sel_read_unshare,
.write = sel_write_unshare,
.llseek = generic_file_llseek,
};
@@ -2339,7 +2353,7 @@ static int sel_fill_super(struct super_block *sb, struct fs_context *fc)
[SEL_POLICY] = {"policy", &sel_policy_ops, S_IRUGO},
[SEL_VALIDATE_TRANS] = {"validatetrans", &sel_transition_ops,
S_IWUGO},
- [SEL_UNSHARE] = {"unshare", &sel_unshare_ops, 0200},
+ [SEL_UNSHARE] = {"unshare", &sel_unshare_ops, 0600},
[SEL_MAXNS] = {"maxns", &sel_maxns_ops, 0600},
[SEL_MAXNSDEPTH] = {"maxnsdepth", &sel_maxnsdepth_ops, 0600},
/* last one */ {""}
--
2.47.1
