From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753348AbcGMOx2 (ORCPT ); Wed, 13 Jul 2016 10:53:28 -0400 Received: from emsm-gh1-uea10.nsa.gov ([8.44.101.8]:57559 "EHLO emsm-gh1-uea10.nsa.gov" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752314AbcGMOxO (ORCPT ); Wed, 13 Jul 2016 10:53:14 -0400 X-IronPort-AV: E=Sophos;i="5.28,357,1464652800"; d="scan'208";a="15530227" IronPort-PHdr: =?us-ascii?q?9a23=3AEQqEdxAVuw6bcsbk31ZVUyQJP3N1i/DPJgcQr6Af?= =?us-ascii?q?oPdwSPj/pcbcNUDSrc9gkEXOFd2CrakV06yK6+u/ByQp2tWoiDg6aptCVhsI24?= =?us-ascii?q?09vjcLJ4q7M3D9N+PgdCcgHc5PBxdP9nC/NlVJSo6lPwWB6kO74TNaIBjjLw09?= =?us-ascii?q?fr2zQd+KyZjvnL/ss7ToICxwzAKnZr1zKBjk5S7wjeIxxbVYF6Aq1xHSqWFJce?= =?us-ascii?q?kFjUlhJFaUggqurpzopM0r221qtvkg789NV7nhN+R9FOQATWcbKWR92OnH/VmG?= =?us-ascii?q?F1POtTMgVTAokwRFAEDq6wDzWt+lrCT9p+N58DOXMc3/UfY/XjH0q+9uSRzsjz?= =?us-ascii?q?wvLCw06mzbi4pwkeYTuBemoAZy65TZbIGcKLx1eaaZNdgTXmdQdt1aVyVcDIex?= =?us-ascii?q?dc4EBqwKOuMc5438oUYe6BizHw+hAMvxxTJSwHz7x6s316ImCw6ClAghGc8e9W?= =?us-ascii?q?nSrdLzOrw6T++41u/LwC/FYvcQ3i3yrMDMcxY8sbSXULlta8vN2AwqEA/Yili4?= =?us-ascii?q?t4PoJXWW2/4Lvmzd6PBvBsy1jGtykB18ujiiwI8Xj4DNgo8EggTf+T5R3Jc+Jd?= =?us-ascii?q?r+TlVyJ9GjDs0D5GmhK4JqT5Z6EClTsyEgx+hD4MTjcQ=3D=3D?= X-IPAS-Result: =?us-ascii?q?A2FBCgB8VIZX/wHyM5BbGgEBAQGDIIEAUqN0AQEBAQEBBpA?= =?us-ascii?q?zgiaECYYYAoEtTAEBAQEBAQICYieCMgQBEgGCEwEBBCNWEAsNAQoCAiYCAlcGA?= =?us-ascii?q?QwGAgEBiCyxY45+AQEBAQEBAQMBAQEBAQEhgQGEYYJAglWHQoJaBY4HixWOV4l?= =?us-ascii?q?mhUlIj09UhA0gMok3AQEB?= Subject: Re: [PATCH 4/9] selinux: Implementation for inode_copy_up_xattr() hook To: Vivek Goyal , miklos@szeredi.hu, pmoore@redhat.com, casey@schaufler-ca.com, linux-kernel@vger.kernel.org, linux-unionfs@vger.kernel.org, linux-security-module@vger.kernel.org References: <1468421095-22322-1-git-send-email-vgoyal@redhat.com> <1468421095-22322-5-git-send-email-vgoyal@redhat.com> Cc: dwalsh@redhat.com, dhowells@redhat.com, viro@ZenIV.linux.org.uk, linux-fsdevel@vger.kernel.org From: Stephen Smalley Organization: National Security Agency Message-ID: Date: Wed, 13 Jul 2016 10:54:39 -0400 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <1468421095-22322-5-git-send-email-vgoyal@redhat.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 07/13/2016 10:44 AM, Vivek Goyal wrote: > When a file is copied up in overlay, we have already created file on upper/ > with right label and there is no need to copy up selinux label/xattr from > lower file to upper file. In fact in case of context mount, we don't want > to copy up label as newly created file got its label from context= option. > > Signed-off-by: Vivek Goyal Acked-by: Stephen Smalley > --- > security/selinux/hooks.c | 16 ++++++++++++++++ > 1 file changed, 16 insertions(+) > > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index c82ee54..4fda548 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -3290,6 +3290,21 @@ static int selinux_inode_copy_up(struct dentry *src, struct cred **new) > return 0; > } > > +static int selinux_inode_copy_up_xattr(const char *name) > +{ > + /* The copy_up hook above sets the initial context on an inode, but we > + * don't then want to overwrite it by blindly copying all the lower > + * xattrs up. Instead, we have to filter out SELinux-related xattrs. > + */ > + if (strcmp(name, XATTR_NAME_SELINUX) == 0) > + return 1; /* Discard */ > + /* > + * Any other attribute apart from SELINUX is not claimed, supported > + * by selinux. > + */ > + return -EOPNOTSUPP; > +} > + > /* file security operations */ > > static int selinux_revalidate_file_permission(struct file *file, int mask) > @@ -6077,6 +6092,7 @@ static struct security_hook_list selinux_hooks[] = { > LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity), > LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid), > LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up), > + LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr), > > LSM_HOOK_INIT(file_permission, selinux_file_permission), > LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security), >