RE: [PATCH] Smack: separate smackfstransmute and smackfsroot

[Chanho Park <chanho61.park@samsung.com>]

Hi,

> -----Original Message-----
> From: Casey Schaufler [mailto:casey@schaufler-ca.com]
> Sent: Wednesday, June 18, 2014 10:26 PM
> To: Chanho Park
> Cc: james.l.morris@oracle.com; linux-security-module@vger.kernel.org;
> linux-kernel@vger.kernel.org; Casey Schaufler
> Subject: Re: [PATCH] Smack: separate smackfstransmute and smackfsroot
> 
> On 6/18/2014 5:41 AM, Chanho Park wrote:
> > According to previous commit(e830b39: Smack: Add smkfstransmute mount
> option),
> > the smackfstransmute option is the smackfsroot option + transmute
> option.
> > I think it can be confused because the transmute option can only have
> "TRUE".
> > Before the patch, you cannot use the smackfsroot and the
> smackfstransmute at
> > the same time. If you use the options simultaenously, the previous
> option will
> > be omitted. In the below example, the smackfsroot option will be
> omitted.
> > mount -t tmpfs -o size=128M,smackfsroot=*,smackfstransmute=_ tmpfs
> /tmp
> >
> > After the patch, now you can use the smackfstransmute option like
> below:
> > mount -t tmpfs -o size=128M,smackfsroot=*,smackfstransmute=TRUE tmpfs
> /tmp
> >
> > Signed-off-by: Chanho Park <chanho61.park@samsung.com>
> 
> Nacked-by: Casey Schaufler <casey@schaufler-ca.com>
> 
> The smackfsroot option behaves as intended.
> The smackfstransmute option behaves as intended.
> There is no case where you want to mark the root inode
> transmuting where you do not also want to set the
> Smack label of that inode. Making the smackfstransmute
> option require the smackfsroot option as well would be
> unnecessary and inconvenient.

If the smackfstransmute option was like that, we should prevent the two
options at the same time to avoid confusing.
At least, I think we need to provide a documentation for that.

Best Regards,
Chanho Park