From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755967AbbFRPcu (ORCPT ); Thu, 18 Jun 2015 11:32:50 -0400 Received: from mx1.redhat.com ([209.132.183.28]:59722 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754705AbbFRPcm convert rfc822-to-8bit (ORCPT ); Thu, 18 Jun 2015 11:32:42 -0400 Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <5582E1CE.2010301@tycho.nsa.gov> References: <5582E1CE.2010301@tycho.nsa.gov> <5582DC0F.7090800@tycho.nsa.gov> <20150618133215.12722.70352.stgit@warthog.procyon.org.uk> <20150618133310.12722.16624.stgit@warthog.procyon.org.uk> <17513.1434640431@warthog.procyon.org.uk> To: Stephen Smalley Cc: dhowells@redhat.com, viro@zeniv.linux.org.uk, miklos@szeredi.hu, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-unionfs@vger.kernel.org, linux-kernel@vger.kernel.org, SELinux , Paul Moore Subject: Re: [PATCH 7/8] SELinux: Create a common helper to determine an inode label MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <22797.1434641556.1@warthog.procyon.org.uk> Content-Transfer-Encoding: 8BIT Date: Thu, 18 Jun 2015 16:32:36 +0100 Message-ID: <22798.1434641556@warthog.procyon.org.uk> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Stephen Smalley wrote: > > Fair point. What does SBLABEL_MNT mean precisely? It seems to indicate one > > of an odd mix of behaviours. I presume it means that we *have* to calculate a > > label and can't get one from the underlying fs if it is not set. > > It means the filesystem supports per-file labeling and you can use > setxattr(..."security.selinux") and setfscreatecon() for files on it. > You can see whether it is set on a filesystem by looking for the > seclabel option in cat /proc/mounts. If it is not set, then we ignore > tsec->create_sid. It is arguable as to whether it is correct to always > call security_transition_sid() there either, but that's another topic. Okay, so how about the attached? David --- static int selinux_determine_inode_label(const struct inode *dir, const struct qstr *name, const char *caller, u16 tclass, u32 *_new_isid) { const struct superblock_security_struct *sbsec = dir->i_sb->s_security; const struct inode_security_struct *dsec = dir->i_security; const struct task_security_struct *tsec = current_security(); if ((sbsec->flags & SE_SBINITIALIZED) && (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) { *_new_isid = sbsec->mntpoint_sid; } else if ((sbsec->flags & SBLABEL_MNT) && tsec->create_sid) { *_new_isid = tsec->create_sid; } else { return security_transition_sid(tsec->sid, dsec->sid, tclass, name, _new_isid); } return 0; } From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Howells In-Reply-To: <5582E1CE.2010301@tycho.nsa.gov> References: <5582E1CE.2010301@tycho.nsa.gov> <5582DC0F.7090800@tycho.nsa.gov> <20150618133215.12722.70352.stgit@warthog.procyon.org.uk> <20150618133310.12722.16624.stgit@warthog.procyon.org.uk> <17513.1434640431@warthog.procyon.org.uk> To: Stephen Smalley Subject: Re: [PATCH 7/8] SELinux: Create a common helper to determine an inode label MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Thu, 18 Jun 2015 16:32:36 +0100 Message-ID: <22798.1434641556@warthog.procyon.org.uk> Cc: miklos@szeredi.hu, linux-unionfs@vger.kernel.org, linux-kernel@vger.kernel.org, dhowells@redhat.com, linux-security-module@vger.kernel.org, viro@zeniv.linux.org.uk, SELinux , linux-fsdevel@vger.kernel.org List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Stephen Smalley wrote: > > Fair point. What does SBLABEL_MNT mean precisely? It seems to indicate one > > of an odd mix of behaviours. I presume it means that we *have* to calculate a > > label and can't get one from the underlying fs if it is not set. > > It means the filesystem supports per-file labeling and you can use > setxattr(..."security.selinux") and setfscreatecon() for files on it. > You can see whether it is set on a filesystem by looking for the > seclabel option in cat /proc/mounts. If it is not set, then we ignore > tsec->create_sid. It is arguable as to whether it is correct to always > call security_transition_sid() there either, but that's another topic. Okay, so how about the attached? David --- static int selinux_determine_inode_label(const struct inode *dir, const struct qstr *name, const char *caller, u16 tclass, u32 *_new_isid) { const struct superblock_security_struct *sbsec = dir->i_sb->s_security; const struct inode_security_struct *dsec = dir->i_security; const struct task_security_struct *tsec = current_security(); if ((sbsec->flags & SE_SBINITIALIZED) && (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) { *_new_isid = sbsec->mntpoint_sid; } else if ((sbsec->flags & SBLABEL_MNT) && tsec->create_sid) { *_new_isid = tsec->create_sid; } else { return security_transition_sid(tsec->sid, dsec->sid, tclass, name, _new_isid); } return 0; }