Re: [PATCH] SELinux - support mls categories for context mounts

[Andrew Morton <akpm@osdl.org>]

On Thu, 28 Sep 2006 15:30:53 -0400 (EDT)
James Morris <jmorris@namei.org> wrote:

> This patch allows commas to be embedded into context mount options (i.e. 
> "-o context=some_selinux_context_t"), to better support multiple 
> categories, which are separated by commas and confuse mount.
> 
> For example, with the current code:
> 
>   mount -t iso9660 /dev/cdrom /media/cdrom -o \
>   ro,context=system_u:object_r:iso9660_t:s0:c1,c3,c4,exec
> 
> The context option that will be interpreted by SELinux is
> context=system_u:object_r:iso9660_t:s0:c1
> 
> instead of
> context=system_u:object_r:iso9660_t:s0:c1,c3,c4
> 
> The options that will be passed on to the file system will be
> ro,c3,c4,exec.
> 
> The proposed solution is to allow/require the SELinux context option 
> specified to mount to use quotes when the context contains a comma.

None of this seems to be documented anywhere.  I expect the people who
actually work on this stuff make a pretty tight group, but...