selinux: enable genfscon labeling for tracefs
PATCH 1/1 selinux: enable genfscon labeling for tracefs
In kernel version 4.1, tracefs was separated from debugfs into its own filesystem. Prior to this split, files in /sys/kernel/debug/tracing could be labeled during filesystem creation using genfscon or later from userspace using setxattr. This change re-enables support for genfscon labeling.
--- security/selinux/hooks.c | 1 + 1 file changed, 1 insertion(+)
security/selinux/hooks.c +1 -0
@@ -813,6 +813,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, sbsec->flags |=SE_SBPROC |SE_SBGENFS ;if (!strcmp (sb->s_type->name,"debugfs" ) || + !strcmp (sb->s_type->name,"tracefs" ) || !strcmp (sb->s_type->name,"sysfs" ) || !strcmp (sb->s_type->name,"pstore" )) sbsec->flags |=SE_SBGENFS ;
Signature · 1 line
2.13.1.518.g3df882009-goog
Quoted 7 lines · Jeff Vander Stoep
In kernel version 4.1, tracefs was separated from debugfs into its own filesystem. Prior to this split, files in
/sys/kernel/debug/tracingcould be labeled during filesystem creation using genfscon or later from userspace using setxattr. This change re-enables support for genfscon labeling.Signed-off-by Jeff Vander Stoep <[email protected]>
I don't suppose we could get you to tackle
https://github.com/SELinuxProject/selinux-kernel/issues/2
so that we don't have to keep patching these filesystem type whitelists?
That said, given that this is a user-visible regression, I'm ok with this as the short term fix.
Quoted 17 lines
---
security/selinux/hooks.c | 1 +1 file changed, 1 insertion(+)security/selinux/hooks.c +0
-0@@ -813,6 +813,7 @@ static int selinux_set_mnt_opts(structsuper_block *sb, sbsec->flags |= SE_SBPROC | SE_SBGENFS;
if (!strcmp(sb->s_type->name, "debugfs") ||security/selinux/hooks.c +1
-0+ !strcmp(sb->s_type->name, "tracefs") ||!strcmp(sb->s_type->name, "sysfs") ||
!strcmp(sb->s_type->name, "pstore"))
sbsec->flags|=SE_SBGENFS;
Paul Moore
maintainerQuoted 7 lines · Stephen Smalley
Quoted 6 lines · Jeff Vander Stoep
In kernel version 4.1, tracefs was separated from debugfs into its own filesystem. Prior to this split, files in
/sys/kernel/debug/tracingcould be labeled during filesystem creation using genfscon or later from userspace using setxattr. This change re-enables support for genfscon labeling.
Quoted 6 lines
Quoted 1 line
Signed-off-by Jeff Vander Stoep <[email protected]>I don't suppose we could get you to tackle
https://github.com/SELinuxProject/selinux-kernel/issues/2
so that we don't have to keep patching these filesystem type whitelists?
+1 for Stephen's request. For what it's worth you'll also earn my appreciation, or your beverage of choice the next time we are in the same spot (I'd go for the drink if I were you, much more valuable).
Quoted 4 lines
That said, given that this is a user-visible regression, I'm ok with this as the short term fix.
Acked-by Stephen Smalley <[email protected]>
Looks fine to me too, merged into selinux/next.
Quoted 17 lines
Quoted 17 lines
--- security/selinux/hooks.c | 1 + 1 file changed, 1 insertion(+)security/selinux/hooks.c +1
-0@@ -813,6 +813,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, sbsec->flags |=SE_SBPROC |SE_SBGENFS ;if (!strcmp (sb->s_type->name,"debugfs" ) || + !strcmp (sb->s_type->name,"tracefs" ) || !strcmp (sb->s_type->name,"sysfs" ) || !strcmp (sb->s_type->name,"pstore" ))sbsec->flags |= SE_SBGENFS;
Signature · 2 lines
paul moore www.paul-moore.com