Commit cd89596f authored by David P. Quigley's avatar David P. Quigley Committed by James Morris

SELinux: Unify context mount and genfs behavior

Context mounts and genfs labeled file systems behave differently with respect to
setting file system labels. This patch brings genfs labeled file systems in line
with context mounts in that setxattr calls to them should return EOPNOTSUPP and
fscreate calls will be ignored.
Signed-off-by: default avatarDavid P. Quigley <dpquigl@tycho.nsa.gov>
Acked-by: default avatarEric Paris <eparis@redhat.com>
Signed-off-by: default avatarJames Morris <jmorris@macbook.localdomain>
parent 11689d47
...@@ -1613,7 +1613,7 @@ static int may_create(struct inode *dir, ...@@ -1613,7 +1613,7 @@ static int may_create(struct inode *dir,
if (rc) if (rc)
return rc; return rc;
if (!newsid || sbsec->behavior == SECURITY_FS_USE_MNTPOINT) { if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
rc = security_transition_sid(sid, dsec->sid, tclass, &newsid); rc = security_transition_sid(sid, dsec->sid, tclass, &newsid);
if (rc) if (rc)
return rc; return rc;
...@@ -2597,7 +2597,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, ...@@ -2597,7 +2597,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
sid = tsec->sid; sid = tsec->sid;
newsid = tsec->create_sid; newsid = tsec->create_sid;
if (!newsid || sbsec->behavior == SECURITY_FS_USE_MNTPOINT) { if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
rc = security_transition_sid(sid, dsec->sid, rc = security_transition_sid(sid, dsec->sid,
inode_mode_to_security_class(inode->i_mode), inode_mode_to_security_class(inode->i_mode),
&newsid); &newsid);
...@@ -2619,7 +2619,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, ...@@ -2619,7 +2619,7 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
isec->initialized = 1; isec->initialized = 1;
} }
if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT) if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
return -EOPNOTSUPP; return -EOPNOTSUPP;
if (name) { if (name) {
...@@ -2796,7 +2796,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name, ...@@ -2796,7 +2796,7 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
return selinux_inode_setotherxattr(dentry, name); return selinux_inode_setotherxattr(dentry, name);
sbsec = inode->i_sb->s_security; sbsec = inode->i_sb->s_security;
if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT) if (!(sbsec->flags & SE_SBLABELSUPP))
return -EOPNOTSUPP; return -EOPNOTSUPP;
if (!is_owner_or_cap(inode)) if (!is_owner_or_cap(inode))
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment