RFC Context Mounts and Unsupported Contexts
Get series with b4
b4 am [email protected]Versions newest first
- v1 RFC Latest3 patches 3 repliesIn review
Patches in v1 No applies recorded yet
| # | Subject and files | Size | Replies | Applied |
|---|---|---|---|---|
| 1/3 | Context Mounts and Unsupported Contexts: kernellinux-2.6.17.i686/ | +33 | 3 replies | |
| 2/3 | Context Mounts and Unsupported Contexts: util-linuxmount/ mount/ | +103 | 0 replies | |
| 3/3 | Context Mounts and Unsupported Contexts: nfs-utilsutils/ utils/ | +54 | 0 replies |
Reviews trailers per patch
No Reviewed-by, Acked-by or Tested-by trailers for v1 yet.
Cover letter [RFC Patch 0/3] Context Mounts and Unsupported Contexts
This is a potential patch set to correct the collision which is occurring between commas in contexts and the comma delimiter between option values for mount.
The Problem:
If the context option specified to mount contains a comma then the value of the context option will be improperly broken up.
Example:
Using an MCS translation setup with these entries.
s0:c1=PatientRecord
s0:c2=Unclassified
s0:c3=Secret
s0:c4=TopSecret
s0:c1,c3,c4=CompanySecrets
With translations turned off:
mount -t iso9660 /dev/cdrom /media/cdrom -o \
ro,context=system_u:object_r:iso9660_t:s0:c2,c3,c4,exec
The context option that will be interpreted by SeLinux is context=system_u:object_r:iso9660_t:s0:c2
The options that will be passed on to the file system will be ro,c3,c4,exec.
If translations are turned on the context that will be interpreted for the context, system_u:object_r:iso9660_t:Unclassified,Secret,TopSecret, will be system_u:object_r:iso9660_t:Unclassified.
Proposed Solution:
The proposed solution is to allow/require the SeLinux context option specified to mount to use escaped quotes when the context contains a comma. The patches that are included are for the kernel, util-linux, and nfs-utils. They were generated against the following Fedora rawhide rpms util-linux-2.13-0.36, nfs-utils-1.0.9-3, and kernel-2.6.17-1.2528.
Signature · 10 lines
Cory Olmo Trusted Computer Solutions www.TrustedCS.com -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.