Commit 442155c1 authored by David Howells's avatar David Howells Committed by Al Viro

selinux: Implement the new mount API LSM hooks

Implement the new mount API LSM hooks for SELinux.  At some point the old
hooks will need to be removed.
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
cc: Paul Moore <paul@paul-moore.com>
cc: Stephen Smalley <sds@tycho.nsa.gov>
cc: selinux@tycho.nsa.gov
cc: linux-security-module@vger.kernel.org
Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
parent da2441fd
...@@ -48,6 +48,8 @@ ...@@ -48,6 +48,8 @@
#include <linux/fdtable.h> #include <linux/fdtable.h>
#include <linux/namei.h> #include <linux/namei.h>
#include <linux/mount.h> #include <linux/mount.h>
#include <linux/fs_context.h>
#include <linux/fs_parser.h>
#include <linux/netfilter_ipv4.h> #include <linux/netfilter_ipv4.h>
#include <linux/netfilter_ipv6.h> #include <linux/netfilter_ipv6.h>
#include <linux/tty.h> #include <linux/tty.h>
...@@ -454,11 +456,11 @@ static inline int inode_doinit(struct inode *inode) ...@@ -454,11 +456,11 @@ static inline int inode_doinit(struct inode *inode)
enum { enum {
Opt_error = -1, Opt_error = -1,
Opt_context = 1, Opt_context = 0,
Opt_defcontext = 1,
Opt_fscontext = 2, Opt_fscontext = 2,
Opt_defcontext = 3, Opt_rootcontext = 3,
Opt_rootcontext = 4, Opt_seclabel = 4,
Opt_seclabel = 5,
}; };
#define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg} #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
...@@ -1089,6 +1091,7 @@ static int show_sid(struct seq_file *m, u32 sid) ...@@ -1089,6 +1091,7 @@ static int show_sid(struct seq_file *m, u32 sid)
if (!rc) { if (!rc) {
bool has_comma = context && strchr(context, ','); bool has_comma = context && strchr(context, ',');
seq_putc(m, '=');
if (has_comma) if (has_comma)
seq_putc(m, '\"'); seq_putc(m, '\"');
seq_escape(m, context, "\"\n\\"); seq_escape(m, context, "\"\n\\");
...@@ -1142,7 +1145,7 @@ static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb) ...@@ -1142,7 +1145,7 @@ static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
} }
if (sbsec->flags & SBLABEL_MNT) { if (sbsec->flags & SBLABEL_MNT) {
seq_putc(m, ','); seq_putc(m, ',');
seq_puts(m, LABELSUPP_STR); seq_puts(m, SECLABEL_STR);
} }
return 0; return 0;
} }
...@@ -2761,6 +2764,38 @@ static int selinux_umount(struct vfsmount *mnt, int flags) ...@@ -2761,6 +2764,38 @@ static int selinux_umount(struct vfsmount *mnt, int flags)
FILESYSTEM__UNMOUNT, NULL); FILESYSTEM__UNMOUNT, NULL);
} }
static const struct fs_parameter_spec selinux_param_specs[] = {
fsparam_string(CONTEXT_STR, Opt_context),
fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
fsparam_string(FSCONTEXT_STR, Opt_fscontext),
fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
fsparam_flag (SECLABEL_STR, Opt_seclabel),
{}
};
static const struct fs_parameter_description selinux_fs_parameters = {
.name = "SELinux",
.specs = selinux_param_specs,
};
static int selinux_fs_context_parse_param(struct fs_context *fc,
struct fs_parameter *param)
{
struct fs_parse_result result;
int opt, rc;
opt = fs_parse(fc, &selinux_fs_parameters, param, &result);
if (opt < 0)
return opt;
rc = selinux_add_opt(opt, param->string, &fc->security);
if (!rc) {
param->string = NULL;
rc = 1;
}
return rc;
}
/* inode security operations */ /* inode security operations */
static int selinux_inode_alloc_security(struct inode *inode) static int selinux_inode_alloc_security(struct inode *inode)
...@@ -6710,6 +6745,8 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { ...@@ -6710,6 +6745,8 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds), LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds), LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security), LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security), LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts), LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
...@@ -6978,6 +7015,8 @@ static __init int selinux_init(void) ...@@ -6978,6 +7015,8 @@ static __init int selinux_init(void)
else else
pr_debug("SELinux: Starting in permissive mode\n"); pr_debug("SELinux: Starting in permissive mode\n");
fs_validate_description(&selinux_fs_parameters);
return 0; return 0;
} }
......
...@@ -59,11 +59,11 @@ ...@@ -59,11 +59,11 @@
#define SE_SBPROC 0x0200 #define SE_SBPROC 0x0200
#define SE_SBGENFS 0x0400 #define SE_SBGENFS 0x0400
#define CONTEXT_STR "context=" #define CONTEXT_STR "context"
#define FSCONTEXT_STR "fscontext=" #define FSCONTEXT_STR "fscontext"
#define ROOTCONTEXT_STR "rootcontext=" #define ROOTCONTEXT_STR "rootcontext"
#define DEFCONTEXT_STR "defcontext=" #define DEFCONTEXT_STR "defcontext"
#define LABELSUPP_STR "seclabel" #define SECLABEL_STR "seclabel"
struct netlbl_lsm_secattr; struct netlbl_lsm_secattr;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment