From: Stephen Smalley Date: Tue, 23 Jul 2013 21:38:41 +0000 (-0400) Subject: SELinux: Enable setting security contexts on rootfs inodes. X-Git-Tag: firefly_0821_release~2958^2~141 X-Git-Url: http://plrg.eecs.uci.edu/git/?a=commitdiff_plain;h=78d36d2111cd4ca722a602846f7db8f54a0b074c;p=firefly-linux-kernel-4.4.55.git SELinux: Enable setting security contexts on rootfs inodes. rootfs (ramfs) can support setting of security contexts by userspace due to the vfs fallback behavior of calling the security module to set the in-core inode state for security.* attributes when the filesystem does not provide an xattr handler. No xattr handler required as the inodes are pinned in memory and have no backing store. This is useful in allowing early userspace to label individual files within a rootfs while still providing a policy-defined default via genfs. Signed-off-by: Stephen Smalley Signed-off-by: Paul Moore Signed-off-by: Eric Paris --- diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index d0cfaa9f19d0..0ff911a94757 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -464,6 +464,13 @@ static int sb_finish_set_opts(struct super_block *sb) if (selinux_is_sblabel_mnt(sb)) sbsec->flags |= SBLABEL_MNT; + /* + * Special handling for rootfs. Is genfs but supports + * setting SELinux context on in-core inodes. + */ + if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0) + sbsec->flags |= SE_SBLABELSUPP; + /* Initialize the root inode. */ rc = inode_doinit_with_dentry(root_inode, root);