summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorStephen Smalley <sds@tycho.nsa.gov>2015-06-04 16:22:17 -0400
committerPaul Moore <pmoore@redhat.com>2015-06-04 16:22:17 -0400
commit8e01472078763ebc1eaea089a1adab75dd982ccd (patch)
tree7e587cb3c3358c8b61cd7767c08d5db06a1400de
parent134509d54e4e98888be2697a92cb4b48957b792b (diff)
selinux: enable genfscon labeling for sysfs and pstore files
Support per-file labeling of sysfs and pstore files based on genfscon policy entries. This is safe because the sysfs and pstore directory tree cannot be manipulated by userspace, except to unlink pstore entries. This provides an alternative method of assigning per-file labeling to sysfs or pstore files without needing to set the labels from userspace on each boot. The advantages of this approach are that the labels are assigned as soon as the dentry is first instantiated and userspace does not need to walk the sysfs or pstore tree and set the labels on each boot. The limitations of this approach are that the labels can only be assigned based on pathname prefix matching. You can initially assign labels using this mechanism and then change them at runtime via setxattr if allowed to do so by policy. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Suggested-by: Dominick Grift <dac.override@gmail.com> Acked-by: Jeff Vander Stoep <jeffv@google.com> Signed-off-by: Paul Moore <pmoore@redhat.com>
-rw-r--r--security/selinux/hooks.c4
1 files changed, 3 insertions, 1 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index ec39b9ab6569..daf59b4bc02b 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -726,7 +726,9 @@ static int selinux_set_mnt_opts(struct super_block *sb,
if (strcmp(sb->s_type->name, "proc") == 0)
sbsec->flags |= SE_SBPROC | SE_SBGENFS;
- if (strcmp(sb->s_type->name, "debugfs") == 0)
+ if (!strcmp(sb->s_type->name, "debugfs") ||
+ !strcmp(sb->s_type->name, "sysfs") ||
+ !strcmp(sb->s_type->name, "pstore"))
sbsec->flags |= SE_SBGENFS;
if (!sbsec->behavior) {