SELinux: Unify context mount and genfs behavior
Context mounts and genfs labeled file systems behave differently with respect to setting file system labels. This patch brings genfs labeled file systems in line with context mounts in that setxattr calls to them should return EOPNOTSUPP and fscreate calls will be ignored. Signed-off-by: David P. Quigley <dpquigl@tycho.nsa.gov> Acked-by: Eric Paris <eparis@redhat.com> Signed-off-by: James Morris <jmorris@macbook.localdomain>
This commit is contained in:
parent
11689d47f0
commit
cd89596f0c
|
@ -1613,7 +1613,7 @@ static int may_create(struct inode *dir,
|
||||||
if (rc)
|
if (rc)
|
||||||
return rc;
|
return rc;
|
||||||
|
|
||||||
if (!newsid || sbsec->behavior == SECURITY_FS_USE_MNTPOINT) {
|
if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
|
||||||
rc = security_transition_sid(sid, dsec->sid, tclass, &newsid);
|
rc = security_transition_sid(sid, dsec->sid, tclass, &newsid);
|
||||||
if (rc)
|
if (rc)
|
||||||
return rc;
|
return rc;
|
||||||
|
@ -2597,7 +2597,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
|
||||||
sid = tsec->sid;
|
sid = tsec->sid;
|
||||||
newsid = tsec->create_sid;
|
newsid = tsec->create_sid;
|
||||||
|
|
||||||
if (!newsid || sbsec->behavior == SECURITY_FS_USE_MNTPOINT) {
|
if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
|
||||||
rc = security_transition_sid(sid, dsec->sid,
|
rc = security_transition_sid(sid, dsec->sid,
|
||||||
inode_mode_to_security_class(inode->i_mode),
|
inode_mode_to_security_class(inode->i_mode),
|
||||||
&newsid);
|
&newsid);
|
||||||
|
@ -2619,7 +2619,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
|
||||||
isec->initialized = 1;
|
isec->initialized = 1;
|
||||||
}
|
}
|
||||||
|
|
||||||
if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
|
if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
|
||||||
return -EOPNOTSUPP;
|
return -EOPNOTSUPP;
|
||||||
|
|
||||||
if (name) {
|
if (name) {
|
||||||
|
@ -2796,7 +2796,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
|
||||||
return selinux_inode_setotherxattr(dentry, name);
|
return selinux_inode_setotherxattr(dentry, name);
|
||||||
|
|
||||||
sbsec = inode->i_sb->s_security;
|
sbsec = inode->i_sb->s_security;
|
||||||
if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
|
if (!(sbsec->flags & SE_SBLABELSUPP))
|
||||||
return -EOPNOTSUPP;
|
return -EOPNOTSUPP;
|
||||||
|
|
||||||
if (!is_owner_or_cap(inode))
|
if (!is_owner_or_cap(inode))
|
||||||
|
|
Loading…
Reference in New Issue