diff options
| author | Eric Paris <eparis@parisplace.org> | 2006-07-14 00:24:33 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@g5.osdl.org> | 2006-07-14 21:53:55 -0700 |
| commit | b04ea3cebf79d6808632808072f276dbc98aaf01 (patch) | |
| tree | 7620a01477510d9e4ae042baab17bce103b59185 /security | |
| parent | 517e7aa5b022f9dc486639c7689666663daee24f (diff) | |
[PATCH] Fix security check for joint context= and fscontext= mount options
After some discussion on the actual meaning of the filesystem class
security check in try context mount it was determined that the checks for
the context= mount options were not correct if fscontext mount option had
already been used.
When labeling the superblock we should be checking relabel_from and
relabel_to. But if the superblock has already been labeled (with
fscontext) then context= is actually labeling the inodes, and so we should
be checking relabel_from and associate. This patch fixes which checks are
called depending on the mount options.
Signed-off-by: Eric Paris <eparis@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/selinux/hooks.c | 14 |
1 files changed, 9 insertions, 5 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 2e8b4dfcbc7..a91c961ba38 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -523,12 +523,16 @@ static int try_context_mount(struct super_block *sb, void *data) goto out_free; } - rc = may_context_mount_sb_relabel(sid, sbsec, tsec); - if (rc) - goto out_free; - - if (!fscontext) + if (!fscontext) { + rc = may_context_mount_sb_relabel(sid, sbsec, tsec); + if (rc) + goto out_free; sbsec->sid = sid; + } else { + rc = may_context_mount_inode_relabel(sid, sbsec, tsec); + if (rc) + goto out_free; + } sbsec->mntpoint_sid = sid; sbsec->behavior = SECURITY_FS_USE_MNTPOINT; |