1/2 decouple fscontext/context mount options

PATCH In review Eric Paris 2 participants 2 messages Jul 5, 2006 SELinux security module

Share & tools

Eric Paris

author

2006-07-05 15:59 UTC #0 lore raw

PATCH 1/1 1/2 decouple fscontext/context mount options

This patch will remove the conflict between fscontext and context mount options. If context= is specified without fscontext it will operate just as before, if both are specified we will use mount point labeling
and all inodes will get the label specified by context=. The
superblock will be labeled with the label of fscontext=, thus affecting operations which check the superblock security context, such as associate permissions.

Hopefully this addresses all of the concerns.

 security/selinux/hooks.c          |   68 +++++++++++++++++++++++++++++---------
 security/selinux/include/objsec.h |    3 +
 2 files changed, 55 insertions(+), 16 deletions(-)

security/selinux/hooks.c renamed from security/selinux/hooks.c.orig +53 ~~-15~~

@@ -246,6 +246,7 @@ static int superblock_alloc_security(str
 	sbsec->sb = sb;
 	sbsec->sid = SECINITSID_UNLABELED;
 	sbsec->def_sid = SECINITSID_FILE;
+	sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 	sb->s_security = sbsec;
 
 	return 0;

@@ -329,9 +330,25 @@ static match_table_t tokens = {
 
 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 
+static int may_context_mount_sb_relabel(u32 sid, struct superblock_security_struct *sbsec,
+			struct task_security_struct *tsec)
+{
+	int rc;
+
+	rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
+			  FILESYSTEM__RELABELFROM, NULL);
+	if (rc)
+		return rc;
+
+	rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
+			  FILESYSTEM__RELABELTO, NULL);
+	return rc;
+}
+
 static int try_context_mount(struct super_block *sb, void *data)
 {
 	char *context = NULL, *defcontext = NULL;
+	char *fscontext = NULL;
 	const char *name;
 	u32 sid;
 	int alloc = 0, rc = 0, seen = 0;

@@ -374,7 +391,7 @@ static int try_context_mount(struct supe
 
 			switch (token) {
 			case Opt_context:
-				if (seen) {
+				if (seen & (Opt_context|Opt_defcontext)) {
 					rc = -EINVAL;
 					printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 					goto out_free;

@@ -390,13 +407,13 @@ static int try_context_mount(struct supe
 				break;
 
 			case Opt_fscontext:
-				if (seen & (Opt_context|Opt_fscontext)) {
+				if (seen & Opt_fscontext) {
 					rc = -EINVAL;
 					printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 					goto out_free;
 				}
-				context = match_strdup(&args[0]);
-				if (!context) {
+				fscontext = match_strdup(&args[0]);
+				if (!fscontext) {
 					rc = -ENOMEM;
 					goto out_free;
 				}

@@ -441,29 +458,46 @@ static int try_context_mount(struct supe
 	if (!seen)
 		goto out;
 
-	if (context) {
-		rc = security_context_to_sid(context, strlen(context), &sid);
+	/* sets the context of the superblock for the fs being mounted. */
+	if (fscontext) {
+		rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
 		if (rc) {
 			printk(KERN_WARNING "SELinux: security_context_to_sid"
 			       "(%s) failed for (dev %s, type %s) errno=%d\n",
-			       context, sb->s_id, name, rc);
+			       fscontext, sb->s_id, name, rc);
 			goto out_free;
 		}
 
-		rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
-		                  FILESYSTEM__RELABELFROM, NULL);
+		rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 		if (rc)
 			goto out_free;
 
-		rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
-		                  FILESYSTEM__RELABELTO, NULL);
+		sbsec->sid = sid;
+	}
+
+	/* 
+	 * Switch to using mount point labeling behavior.
+	 * sets the label used on all files below the mountpoint, and will set
+	 * the superblock context if not already set.
+	 */
+	if (context) {
+		rc = security_context_to_sid(context, strlen(context), &sid);
+		if (rc) {
+			printk(KERN_WARNING "SELinux: security_context_to_sid"
+			       "(%s) failed for (dev %s, type %s) errno=%d\n",
+			       context, sb->s_id, name, rc);
+			goto out_free;
+		}
+
+		rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 		if (rc)
 			goto out_free;
 
-		sbsec->sid = sid;
+		if (!fscontext)
+			sbsec->sid = sid;
+		sbsec->mntpoint_sid = sid;
 
-		if (seen & Opt_context)
-			sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
+		sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 	}
 
 	if (defcontext) {

@@ -495,6 +529,7 @@ out_free:
 	if (alloc) {
 		kfree(context);
 		kfree(defcontext);
+		kfree(fscontext);
 	}
 out:
 	return rc;

@@ -876,8 +911,11 @@ static int inode_doinit_with_dentry(stru
 			goto out;
 		isec->sid = sid;
 		break;
+	case SECURITY_FS_USE_MNTPOINT:
+		isec->sid = sbsec->mntpoint_sid;
+		break;
 	default:
-		/* Default to the fs SID. */
+		/* Default to the fs superblock SID. */
 		isec->sid = sbsec->sid;
 
 		if (sbsec->proc) {

security/selinux/include/objsec.h renamed from security/selinux/include/objsec.h.orig +2 -1

@@ -57,8 +57,9 @@ struct file_security_struct {
 struct superblock_security_struct {
 	struct super_block *sb;         /* back pointer to sb object */
 	struct list_head list;          /* list of superblock_security_struct */
-	u32 sid;              /* SID of file system */
+	u32 sid;			/* SID of file system superblock */
 	u32 def_sid;			/* default SID for labeling */
+	u32 mntpoint_sid;		/* SECURITY_FS_USE_MNTPOINT context for files */
 	unsigned int behavior;          /* labeling behavior */
 	unsigned char initialized;      /* initialization flag */
 	unsigned char proc;             /* proc fs */

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

2006-07-05 16:31 UTC #1 lore raw

Quoted 25 lines · Eric Paris

This patch will remove the conflict between fscontext and context mount options. If context= is specified without fscontext it will operate just as before, if both are specified we will use mount point labeling
and all inodes will get the label specified by context=. The
superblock will be labeled with the label of fscontext=, thus affecting operations which check the superblock security context, such as associate permissions.
Hopefully this addresses all of the concerns.
 security/selinux/hooks.c          |   68 +++++++++++++++++++++++++++++---------
 security/selinux/include/objsec.h |    3 +
 2 files changed, 55 insertions(+), 16 deletions(-)
security/selinux/hooks.c renamed from security/selinux/hooks.c.orig +1 -0
@@ -246,6 +246,7 @@ static int superblock_alloc_security(str
 	sbsec->sb = sb;
 	sbsec->sid = SECINITSID_UNLABELED;
 	sbsec->def_sid = SECINITSID_FILE;
+	sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 	sb->s_security = sbsec;
 
 	return 0;

security/selinux/hooks.c static match_table_t tokens = { · line 333

Quoted 4 lines

security/selinux/hooks.c renamed from security/selinux/hooks.c.orig +1 -0

@@ -329,9 +330,25 @@ static match_table_t tokens = {
 
 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 
+static int may_context_mount_sb_relabel(u32 sid, struct superblock_security_struct *sbsec,

This line is too long. Also, any reason for the long function name (why not just may_context_mount)?

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.