* [PATCH v3] libsepol: Support functionfs_seclabel policycap
@ 2025-08-28 17:05 Neill Kapron
2025-08-29 12:25 ` Stephen Smalley
2025-09-10 14:11 ` Stephen Smalley
0 siblings, 2 replies; 4+ messages in thread
From: Neill Kapron @ 2025-08-28 17:05 UTC (permalink / raw)
To: Paul Moore, Stephen Smalley, Ondrej Mosnacek
Cc: Neill Kapron, kernel-team, linux-kernel, selinux
This adds the necessary userspace pieces to support the
functionfs_seclabel policycap which enables per-file labels in
functionfs and the ability for userspace to apply the labels.
With the policycap disabled, legacy behaviors are maintained and
per-file labeling is disallowed.
Signed-off-by: Neill Kapron <nkapron@google.com>
Changes since v2:
- Sending as separate patches
---
libsepol/include/sepol/policydb/polcaps.h | 1 +
libsepol/src/polcaps.c | 1 +
2 files changed, 2 insertions(+)
diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
index 0835ea21..bbaebf1a 100644
--- a/libsepol/include/sepol/policydb/polcaps.h
+++ b/libsepol/include/sepol/policydb/polcaps.h
@@ -19,6 +19,7 @@ enum {
POLICYDB_CAP_NETLINK_XPERM,
POLICYDB_CAP_NETIF_WILDCARD,
POLICYDB_CAP_GENFS_SECLABEL_WILDCARD,
+ POLICYDB_CAP_FUNCTIONFS_SECLABEL,
__POLICYDB_CAP_MAX
};
#define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)
diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
index 7ac0ae7c..83eb6143 100644
--- a/libsepol/src/polcaps.c
+++ b/libsepol/src/polcaps.c
@@ -18,6 +18,7 @@ static const char * const polcap_names[POLICYDB_CAP_MAX + 1] = {
[POLICYDB_CAP_NETLINK_XPERM] = "netlink_xperm",
[POLICYDB_CAP_NETIF_WILDCARD] = "netif_wildcard",
[POLICYDB_CAP_GENFS_SECLABEL_WILDCARD] = "genfs_seclabel_wildcard",
+ [POLICYDB_CAP_FUNCTIONFS_SECLABEL] = "functionfs_seclabel",
};
int sepol_polcap_getnum(const char *name)
--
2.51.0.318.gd7df087d1a-goog
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v3] libsepol: Support functionfs_seclabel policycap
2025-08-28 17:05 [PATCH v3] libsepol: Support functionfs_seclabel policycap Neill Kapron
@ 2025-08-29 12:25 ` Stephen Smalley
2025-09-10 14:11 ` Stephen Smalley
1 sibling, 0 replies; 4+ messages in thread
From: Stephen Smalley @ 2025-08-29 12:25 UTC (permalink / raw)
To: Neill Kapron
Cc: Paul Moore, Ondrej Mosnacek, kernel-team, linux-kernel, selinux
On Thu, Aug 28, 2025 at 1:05 PM Neill Kapron <nkapron@google.com> wrote:
>
> This adds the necessary userspace pieces to support the
> functionfs_seclabel policycap which enables per-file labels in
> functionfs and the ability for userspace to apply the labels.
>
> With the policycap disabled, legacy behaviors are maintained and
> per-file labeling is disallowed.
>
> Signed-off-by: Neill Kapron <nkapron@google.com>
Same caveat here - don't rely on this policy capability bit remaining
stable until the kernel patch is merged and de-conflicted with the
other recent patches introducing policy capabilities.
And likewise, again doesn't require re-spinning IMHO but the changelog
below should go after the "---" so it doesn't get included in the
commit message since it becomes irrelevant once the patch is merged.
Will wait to Ack this one until the kernel patch is merged.
>
> Changes since v2:
> - Sending as separate patches
> ---
> libsepol/include/sepol/policydb/polcaps.h | 1 +
> libsepol/src/polcaps.c | 1 +
> 2 files changed, 2 insertions(+)
>
> diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
> index 0835ea21..bbaebf1a 100644
> --- a/libsepol/include/sepol/policydb/polcaps.h
> +++ b/libsepol/include/sepol/policydb/polcaps.h
> @@ -19,6 +19,7 @@ enum {
> POLICYDB_CAP_NETLINK_XPERM,
> POLICYDB_CAP_NETIF_WILDCARD,
> POLICYDB_CAP_GENFS_SECLABEL_WILDCARD,
> + POLICYDB_CAP_FUNCTIONFS_SECLABEL,
> __POLICYDB_CAP_MAX
> };
> #define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)
> diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
> index 7ac0ae7c..83eb6143 100644
> --- a/libsepol/src/polcaps.c
> +++ b/libsepol/src/polcaps.c
> @@ -18,6 +18,7 @@ static const char * const polcap_names[POLICYDB_CAP_MAX + 1] = {
> [POLICYDB_CAP_NETLINK_XPERM] = "netlink_xperm",
> [POLICYDB_CAP_NETIF_WILDCARD] = "netif_wildcard",
> [POLICYDB_CAP_GENFS_SECLABEL_WILDCARD] = "genfs_seclabel_wildcard",
> + [POLICYDB_CAP_FUNCTIONFS_SECLABEL] = "functionfs_seclabel",
> };
>
> int sepol_polcap_getnum(const char *name)
> --
> 2.51.0.318.gd7df087d1a-goog
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v3] libsepol: Support functionfs_seclabel policycap
2025-08-28 17:05 [PATCH v3] libsepol: Support functionfs_seclabel policycap Neill Kapron
2025-08-29 12:25 ` Stephen Smalley
@ 2025-09-10 14:11 ` Stephen Smalley
2025-09-10 14:17 ` Stephen Smalley
1 sibling, 1 reply; 4+ messages in thread
From: Stephen Smalley @ 2025-09-10 14:11 UTC (permalink / raw)
To: Neill Kapron
Cc: Paul Moore, Ondrej Mosnacek, kernel-team, linux-kernel, selinux
On Thu, Aug 28, 2025 at 1:05 PM Neill Kapron <nkapron@google.com> wrote:
>
> This adds the necessary userspace pieces to support the
> functionfs_seclabel policycap which enables per-file labels in
> functionfs and the ability for userspace to apply the labels.
>
> With the policycap disabled, legacy behaviors are maintained and
> per-file labeling is disallowed.
>
> Signed-off-by: Neill Kapron <nkapron@google.com>
Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
>
> Changes since v2:
> - Sending as separate patches
> ---
> libsepol/include/sepol/policydb/polcaps.h | 1 +
> libsepol/src/polcaps.c | 1 +
> 2 files changed, 2 insertions(+)
>
> diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
> index 0835ea21..bbaebf1a 100644
> --- a/libsepol/include/sepol/policydb/polcaps.h
> +++ b/libsepol/include/sepol/policydb/polcaps.h
> @@ -19,6 +19,7 @@ enum {
> POLICYDB_CAP_NETLINK_XPERM,
> POLICYDB_CAP_NETIF_WILDCARD,
> POLICYDB_CAP_GENFS_SECLABEL_WILDCARD,
> + POLICYDB_CAP_FUNCTIONFS_SECLABEL,
> __POLICYDB_CAP_MAX
> };
> #define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)
> diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
> index 7ac0ae7c..83eb6143 100644
> --- a/libsepol/src/polcaps.c
> +++ b/libsepol/src/polcaps.c
> @@ -18,6 +18,7 @@ static const char * const polcap_names[POLICYDB_CAP_MAX + 1] = {
> [POLICYDB_CAP_NETLINK_XPERM] = "netlink_xperm",
> [POLICYDB_CAP_NETIF_WILDCARD] = "netif_wildcard",
> [POLICYDB_CAP_GENFS_SECLABEL_WILDCARD] = "genfs_seclabel_wildcard",
> + [POLICYDB_CAP_FUNCTIONFS_SECLABEL] = "functionfs_seclabel",
> };
>
> int sepol_polcap_getnum(const char *name)
> --
> 2.51.0.318.gd7df087d1a-goog
>
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH v3] libsepol: Support functionfs_seclabel policycap
2025-09-10 14:11 ` Stephen Smalley
@ 2025-09-10 14:17 ` Stephen Smalley
0 siblings, 0 replies; 4+ messages in thread
From: Stephen Smalley @ 2025-09-10 14:17 UTC (permalink / raw)
To: Neill Kapron
Cc: Paul Moore, Ondrej Mosnacek, kernel-team, linux-kernel, selinux
On Wed, Sep 10, 2025 at 10:11 AM Stephen Smalley
<stephen.smalley.work@gmail.com> wrote:
>
> On Thu, Aug 28, 2025 at 1:05 PM Neill Kapron <nkapron@google.com> wrote:
> >
> > This adds the necessary userspace pieces to support the
> > functionfs_seclabel policycap which enables per-file labels in
> > functionfs and the ability for userspace to apply the labels.
> >
> > With the policycap disabled, legacy behaviors are maintained and
> > per-file labeling is disallowed.
> >
> > Signed-off-by: Neill Kapron <nkapron@google.com>
>
> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Thanks, merged.
>
> >
> > Changes since v2:
> > - Sending as separate patches
> > ---
> > libsepol/include/sepol/policydb/polcaps.h | 1 +
> > libsepol/src/polcaps.c | 1 +
> > 2 files changed, 2 insertions(+)
> >
> > diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h
> > index 0835ea21..bbaebf1a 100644
> > --- a/libsepol/include/sepol/policydb/polcaps.h
> > +++ b/libsepol/include/sepol/policydb/polcaps.h
> > @@ -19,6 +19,7 @@ enum {
> > POLICYDB_CAP_NETLINK_XPERM,
> > POLICYDB_CAP_NETIF_WILDCARD,
> > POLICYDB_CAP_GENFS_SECLABEL_WILDCARD,
> > + POLICYDB_CAP_FUNCTIONFS_SECLABEL,
> > __POLICYDB_CAP_MAX
> > };
> > #define POLICYDB_CAP_MAX (__POLICYDB_CAP_MAX - 1)
> > diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c
> > index 7ac0ae7c..83eb6143 100644
> > --- a/libsepol/src/polcaps.c
> > +++ b/libsepol/src/polcaps.c
> > @@ -18,6 +18,7 @@ static const char * const polcap_names[POLICYDB_CAP_MAX + 1] = {
> > [POLICYDB_CAP_NETLINK_XPERM] = "netlink_xperm",
> > [POLICYDB_CAP_NETIF_WILDCARD] = "netif_wildcard",
> > [POLICYDB_CAP_GENFS_SECLABEL_WILDCARD] = "genfs_seclabel_wildcard",
> > + [POLICYDB_CAP_FUNCTIONFS_SECLABEL] = "functionfs_seclabel",
> > };
> >
> > int sepol_polcap_getnum(const char *name)
> > --
> > 2.51.0.318.gd7df087d1a-goog
> >
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2025-09-10 14:17 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-08-28 17:05 [PATCH v3] libsepol: Support functionfs_seclabel policycap Neill Kapron
2025-08-29 12:25 ` Stephen Smalley
2025-09-10 14:11 ` Stephen Smalley
2025-09-10 14:17 ` Stephen Smalley
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®