Since kernfs supports the security xattr handlers, we can simply use these to determine the inode's context, dropping the need to update it from kernfs explicitly using a security_inode_notifysecctx() call. We achieve this by setting a new sbsec flag SE_SBGENFS_XATTR to all mounts that are known to use kernfs under the hood and then fetching the xattrs after determining the fallback genfs sid in inode_doinit_with_dentry() when this flag is set. This will allow implementing full security xattr support in kernfs and removing the ...notifysecctx() call in a subsequent patch. Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: Casey Schaufler <casey@schaufler-ca.com> [PM: more manual merge fixups] Signed-off-by: Paul Moore <paul@paul-moore.com> |
||
---|---|---|
.. | ||
audit.h | ||
avc.h | ||
avc_ss.h | ||
classmap.h | ||
conditional.h | ||
ibpkey.h | ||
initial_sid_to_string.h | ||
netif.h | ||
netlabel.h | ||
netnode.h | ||
netport.h | ||
objsec.h | ||
security.h | ||
xfrm.h |