linux-kernel - [RFC][PATCH 1/2] selinux: call may_context_mount_inode_relabel() if fscontext

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201012081345.51190.roberto.sassu@polito.it>
Date:	Wed, 8 Dec 2010 13:45:42 +0100
From:	Roberto Sassu <roberto.sassu@...ito.it>
To:	Stephen Smalley <sds@...ho.nsa.gov>
Cc:	James Morris <jmorris@...ei.org>,
	Eric Paris <eparis@...isplace.org>,
	linux-security-module@...r.kernel.org,
	linux-kernel@...r.kernel.org, selinux@...ho.nsa.gov
Subject: [RFC][PATCH 1/2] selinux: call may_context_mount_inode_relabel() if fscontext_sid is defined

One purpose of the function may_context_mount_inode_relabel() is to check
if the 'associate' permission can be granted to security contexts set in
some SELinux defined mount parameters that affect the inode labeling
behavior.
For instance, the 'context' mount parameter allows to label all inodes with
the specified security context, the 'defcontext' mount parameter permits to
assign a label to inodes, in a filesystem with the 'SECURITY_FS_USE_XATTR'
labeling behavior, that do not have the getxattr() method defined or lack
the SELinux's specific extended attribute.
The 'fscontext' parameter also is involved in the inode labeling process,
specifically in case the labeling behavior is 'SECURITY_FS_USE_TRANS' and
the security_transition_sid() function returns an error or in the 'default'
case for all filesystems except 'proc'.
This patch adds the missing call of the may_context_mount_inode_relabel()
function for the security context specified with the mount parameter
'fscontext' and it should not break any existent functionality because the
required permission is already granted in the SELinux reference policy
by the following rule in the file 'policy/modules/kernel/filesystem.te':

    allow filesystem_type self:filesystem associate;

Signed-off-by: Roberto Sassu <roberto.sassu@...ito.it>
---
 security/selinux/hooks.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 65fa8bf..9486f38 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -682,6 +682,11 @@ static int selinux_set_mnt_opts(struct super_block *sb,
 		if (rc)
 			goto out;

+		rc = may_context_mount_inode_relabel(fscontext_sid, sbsec,
+						     cred);
+		if (rc)
+			goto out;
+
 		sbsec->sid = fscontext_sid;
 	}

-- 
1.7.3.2

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4707 bytes)