From: Taras Kondratiuk <takondra@cisco.com> To: "H. Peter Anvin" <hpa@zytor.com>, Al Viro <viro@zeniv.linux.org.uk>, Arnd Bergmann <arnd@arndb.de>, Rob Landley <rob@landley.net>, Mimi Zohar <zohar@linux.vnet.ibm.com>, Jonathan Corbet <corbet@lwn.net>, James McMechan <james.w.mcmechan@gmail.com> Cc: initramfs@vger.kernel.org, Victor Kamensky <kamensky@cisco.com>, linux-doc@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, xe-linux-external@cisco.com Subject: [PATCH v2 14/15] selinux: allow setxattr on rootfs so initramfs code can set them Date: Thu, 25 Jan 2018 03:27:54 +0000 [thread overview] Message-ID: <1516850875-25066-15-git-send-email-takondra@cisco.com> (raw) In-Reply-To: <1516850875-25066-1-git-send-email-takondra@cisco.com> From: Victor Kamensky <kamensky@cisco.com> initramfs code supporting extended cpio format have ability to fill extended attributes from cpio archive, but if SELinux enabled and security server is not initialized yet, selinux callback would refuse setxattr made by initramfs code. Solution enable SBLABEL_MNT on rootfs even if secrurity server is not initialized yet. Signed-off-by: Victor Kamensky <kamensky@cisco.com> --- security/selinux/hooks.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 8644d864e3c1..f3fe65589f02 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -706,6 +706,18 @@ static int selinux_set_mnt_opts(struct super_block *sb, if (!ss_initialized) { if (!num_opts) { + /* + * Special handling for rootfs. Is genfs but supports + * setting SELinux context on in-core inodes. + * + * Chicken and egg problem: policy may reside in rootfs + * but for initramfs code to fill in attributes, it + * needs selinux to allow that. + */ + if (!strncmp(sb->s_type->name, "rootfs", + sizeof("rootfs"))) + sbsec->flags |= SBLABEL_MNT; + /* Defer initialization until selinux_complete_init, after the initial policy is loaded and the security server is ready to handle calls. */ -- 2.10.3.dirty
WARNING: multiple messages have this Message-ID (diff)
From: takondra@cisco.com (Taras Kondratiuk) To: linux-security-module@vger.kernel.org Subject: [PATCH v2 14/15] selinux: allow setxattr on rootfs so initramfs code can set them Date: Thu, 25 Jan 2018 03:27:54 +0000 [thread overview] Message-ID: <1516850875-25066-15-git-send-email-takondra@cisco.com> (raw) In-Reply-To: <1516850875-25066-1-git-send-email-takondra@cisco.com> From: Victor Kamensky <kamensky@cisco.com> initramfs code supporting extended cpio format have ability to fill extended attributes from cpio archive, but if SELinux enabled and security server is not initialized yet, selinux callback would refuse setxattr made by initramfs code. Solution enable SBLABEL_MNT on rootfs even if secrurity server is not initialized yet. Signed-off-by: Victor Kamensky <kamensky@cisco.com> --- security/selinux/hooks.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 8644d864e3c1..f3fe65589f02 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -706,6 +706,18 @@ static int selinux_set_mnt_opts(struct super_block *sb, if (!ss_initialized) { if (!num_opts) { + /* + * Special handling for rootfs. Is genfs but supports + * setting SELinux context on in-core inodes. + * + * Chicken and egg problem: policy may reside in rootfs + * but for initramfs code to fill in attributes, it + * needs selinux to allow that. + */ + if (!strncmp(sb->s_type->name, "rootfs", + sizeof("rootfs"))) + sbsec->flags |= SBLABEL_MNT; + /* Defer initialization until selinux_complete_init, after the initial policy is loaded and the security server is ready to handle calls. */ -- 2.10.3.dirty -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2018-01-25 3:39 UTC|newest] Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-01-25 3:27 [PATCH v2 00/15] extend initramfs archive format to support xattrs Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 01/15] Documentation: add newcx initramfs format description Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 9:29 ` Arnd Bergmann 2018-01-25 9:29 ` Arnd Bergmann 2018-01-25 20:26 ` Taras Kondratiuk 2018-01-25 20:26 ` Taras Kondratiuk 2018-01-25 20:26 ` Taras Kondratiuk 2018-01-25 21:02 ` Arnd Bergmann 2018-01-25 21:02 ` Arnd Bergmann 2018-01-25 22:13 ` Taras Kondratiuk 2018-01-25 22:13 ` Taras Kondratiuk 2018-01-26 2:39 ` Rob Landley 2018-01-26 2:39 ` Rob Landley 2018-01-26 9:04 ` Arnd Bergmann 2018-01-26 9:04 ` Arnd Bergmann 2018-01-26 10:31 ` Henrique de Moraes Holschuh 2018-01-26 10:31 ` Henrique de Moraes Holschuh 2018-01-26 15:51 ` Victor Kamensky 2018-01-26 15:51 ` Victor Kamensky 2018-01-26 18:15 ` Henrique de Moraes Holschuh 2018-01-26 18:15 ` Henrique de Moraes Holschuh 2018-01-26 18:15 ` Henrique de Moraes Holschuh 2018-01-26 2:40 ` Rob Landley 2018-01-26 2:40 ` Rob Landley 2018-01-26 21:02 ` Taras Kondratiuk 2018-01-26 21:02 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 02/15] initramfs: replace states with function pointers Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 03/15] initramfs: store file name in name_buf Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 04/15] initramfs: remove unnecessary symlinks processing shortcut Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 05/15] initramfs: move files creation into separate state Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 06/15] initramfs: separate reading cpio method from header Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 07/15] initramfs: split header layout information from parsing function Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 08/15] initramfs: add newcx format Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 09/15] initramfs: set extended attributes Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 10/15] gen_init_cpio: move header formatting into function Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 11/15] gen_init_cpio: add newcx format Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-26 2:40 ` Rob Landley 2018-01-26 2:40 ` Rob Landley 2018-01-26 20:37 ` Taras Kondratiuk 2018-01-26 20:37 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 12/15] gen_init_cpio: set extended attributes for " Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` [PATCH v2 13/15] gen_initramfs_list.sh: add -x option to enable " Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk [this message] 2018-01-25 3:27 ` [PATCH v2 14/15] selinux: allow setxattr on rootfs so initramfs code can set them Taras Kondratiuk 2018-01-25 13:51 ` [Fwd: [PATCH v2 14/15] selinux: allow setxattr on rootfs so initramfs code can set them] Stephen Smalley 2018-01-25 3:27 ` [PATCH v2 15/15] selinux: delay sid population for rootfs till init is complete Taras Kondratiuk 2018-01-25 3:27 ` Taras Kondratiuk 2018-01-25 13:48 ` [Fwd: [PATCH v2 15/15] selinux: delay sid population for rootfs till init is complete] Stephen Smalley
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1516850875-25066-15-git-send-email-takondra@cisco.com \ --to=takondra@cisco.com \ --cc=arnd@arndb.de \ --cc=corbet@lwn.net \ --cc=hpa@zytor.com \ --cc=initramfs@vger.kernel.org \ --cc=james.w.mcmechan@gmail.com \ --cc=kamensky@cisco.com \ --cc=linux-doc@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=rob@landley.net \ --cc=viro@zeniv.linux.org.uk \ --cc=xe-linux-external@cisco.com \ --cc=zohar@linux.vnet.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.