* [PATCH] SELinux: Create a common helper to determine an inode label [ver #3]
@ 2015-06-18 18:25 ` David Howells
0 siblings, 0 replies; 14+ messages in thread
From: David Howells @ 2015-06-18 18:25 UTC (permalink / raw)
To: Stephen Smalley
Cc: dhowells, linux-fsdevel, linux-security-module, linux-unionfs,
linux-kernel, SELinux, Paul Moore
Create a common helper function to determine the label for a new inode.
This is then used by:
- may_create()
- selinux_dentry_init_security()
- selinux_inode_init_security()
This will change the behaviour of the functions slightly, bringing them all
into line.
Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: David Howells <dhowells@redhat.com>
---
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index ffa5a642629a..ec30e599fb46 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1684,6 +1684,32 @@ out:
return rc;
}
+/*
+ * Determine the label for an inode that might be unioned.
+ */
+static int selinux_determine_inode_label(const struct inode *dir,
+ const struct qstr *name,
+ u16 tclass,
+ u32 *_new_isid)
+{
+ const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
+ const struct inode_security_struct *dsec = dir->i_security;
+ const struct task_security_struct *tsec = current_security();
+
+ if ((sbsec->flags & SE_SBINITIALIZED) &&
+ (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
+ *_new_isid = sbsec->mntpoint_sid;
+ } else if ((sbsec->flags & SBLABEL_MNT) &&
+ tsec->create_sid) {
+ *_new_isid = tsec->create_sid;
+ } else {
+ return security_transition_sid(tsec->sid, dsec->sid, tclass,
+ name, _new_isid);
+ }
+
+ return 0;
+}
+
/* Check whether a task can create a file. */
static int may_create(struct inode *dir,
struct dentry *dentry,
@@ -1700,7 +1726,6 @@ static int may_create(struct inode *dir,
sbsec = dir->i_sb->s_security;
sid = tsec->sid;
- newsid = tsec->create_sid;
ad.type = LSM_AUDIT_DATA_DENTRY;
ad.u.dentry = dentry;
@@ -1711,12 +1736,10 @@ static int may_create(struct inode *dir,
if (rc)
return rc;
- if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
- rc = security_transition_sid(sid, dsec->sid, tclass,
- &dentry->d_name, &newsid);
- if (rc)
- return rc;
- }
+ rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
+ &newsid);
+ if (rc)
+ return rc;
rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
if (rc)
@@ -2723,32 +2746,14 @@ static int selinux_dentry_init_security(struct dentry *dentry, int mode,
struct qstr *name, void **ctx,
u32 *ctxlen)
{
- const struct cred *cred = current_cred();
- struct task_security_struct *tsec;
- struct inode_security_struct *dsec;
- struct superblock_security_struct *sbsec;
- struct inode *dir = d_backing_inode(dentry->d_parent);
u32 newsid;
int rc;
- tsec = cred->security;
- dsec = dir->i_security;
- sbsec = dir->i_sb->s_security;
-
- if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
- newsid = tsec->create_sid;
- } else {
- rc = security_transition_sid(tsec->sid, dsec->sid,
- inode_mode_to_security_class(mode),
- name,
- &newsid);
- if (rc) {
- printk(KERN_WARNING
- "%s: security_transition_sid failed, rc=%d\n",
- __func__, -rc);
- return rc;
- }
- }
+ rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
+ inode_mode_to_security_class(mode),
+ &newsid);
+ if (rc)
+ return rc;
return security_sid_to_context(newsid, (char **)ctx, ctxlen);
}
@@ -2771,22 +2776,12 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
sid = tsec->sid;
newsid = tsec->create_sid;
- if ((sbsec->flags & SE_SBINITIALIZED) &&
- (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
- newsid = sbsec->mntpoint_sid;
- else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
- rc = security_transition_sid(sid, dsec->sid,
- inode_mode_to_security_class(inode->i_mode),
- qstr, &newsid);
- if (rc) {
- printk(KERN_WARNING "%s: "
- "security_transition_sid failed, rc=%d (dev=%s "
- "ino=%ld)\n",
- __func__,
- -rc, inode->i_sb->s_id, inode->i_ino);
- return rc;
- }
- }
+ rc = selinux_determine_inode_label(
+ dir, qstr,
+ inode_mode_to_security_class(inode->i_mode),
+ &newsid);
+ if (rc)
+ return rc;
/* Possibly defer initialization to selinux_complete_init. */
if (sbsec->flags & SE_SBINITIALIZED) {
^ permalink raw reply related [flat|nested] 14+ messages in thread
* [PATCH] SELinux: Create a common helper to determine an inode label [ver #3]
@ 2015-06-18 18:25 ` David Howells
0 siblings, 0 replies; 14+ messages in thread
From: David Howells @ 2015-06-18 18:25 UTC (permalink / raw)
To: Stephen Smalley
Cc: linux-unionfs, linux-kernel, dhowells, linux-security-module,
SELinux, linux-fsdevel
Create a common helper function to determine the label for a new inode.
This is then used by:
- may_create()
- selinux_dentry_init_security()
- selinux_inode_init_security()
This will change the behaviour of the functions slightly, bringing them all
into line.
Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: David Howells <dhowells@redhat.com>
---
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index ffa5a642629a..ec30e599fb46 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -1684,6 +1684,32 @@ out:
return rc;
}
+/*
+ * Determine the label for an inode that might be unioned.
+ */
+static int selinux_determine_inode_label(const struct inode *dir,
+ const struct qstr *name,
+ u16 tclass,
+ u32 *_new_isid)
+{
+ const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
+ const struct inode_security_struct *dsec = dir->i_security;
+ const struct task_security_struct *tsec = current_security();
+
+ if ((sbsec->flags & SE_SBINITIALIZED) &&
+ (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
+ *_new_isid = sbsec->mntpoint_sid;
+ } else if ((sbsec->flags & SBLABEL_MNT) &&
+ tsec->create_sid) {
+ *_new_isid = tsec->create_sid;
+ } else {
+ return security_transition_sid(tsec->sid, dsec->sid, tclass,
+ name, _new_isid);
+ }
+
+ return 0;
+}
+
/* Check whether a task can create a file. */
static int may_create(struct inode *dir,
struct dentry *dentry,
@@ -1700,7 +1726,6 @@ static int may_create(struct inode *dir,
sbsec = dir->i_sb->s_security;
sid = tsec->sid;
- newsid = tsec->create_sid;
ad.type = LSM_AUDIT_DATA_DENTRY;
ad.u.dentry = dentry;
@@ -1711,12 +1736,10 @@ static int may_create(struct inode *dir,
if (rc)
return rc;
- if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
- rc = security_transition_sid(sid, dsec->sid, tclass,
- &dentry->d_name, &newsid);
- if (rc)
- return rc;
- }
+ rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
+ &newsid);
+ if (rc)
+ return rc;
rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
if (rc)
@@ -2723,32 +2746,14 @@ static int selinux_dentry_init_security(struct dentry *dentry, int mode,
struct qstr *name, void **ctx,
u32 *ctxlen)
{
- const struct cred *cred = current_cred();
- struct task_security_struct *tsec;
- struct inode_security_struct *dsec;
- struct superblock_security_struct *sbsec;
- struct inode *dir = d_backing_inode(dentry->d_parent);
u32 newsid;
int rc;
- tsec = cred->security;
- dsec = dir->i_security;
- sbsec = dir->i_sb->s_security;
-
- if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
- newsid = tsec->create_sid;
- } else {
- rc = security_transition_sid(tsec->sid, dsec->sid,
- inode_mode_to_security_class(mode),
- name,
- &newsid);
- if (rc) {
- printk(KERN_WARNING
- "%s: security_transition_sid failed, rc=%d\n",
- __func__, -rc);
- return rc;
- }
- }
+ rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
+ inode_mode_to_security_class(mode),
+ &newsid);
+ if (rc)
+ return rc;
return security_sid_to_context(newsid, (char **)ctx, ctxlen);
}
@@ -2771,22 +2776,12 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
sid = tsec->sid;
newsid = tsec->create_sid;
- if ((sbsec->flags & SE_SBINITIALIZED) &&
- (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
- newsid = sbsec->mntpoint_sid;
- else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
- rc = security_transition_sid(sid, dsec->sid,
- inode_mode_to_security_class(inode->i_mode),
- qstr, &newsid);
- if (rc) {
- printk(KERN_WARNING "%s: "
- "security_transition_sid failed, rc=%d (dev=%s "
- "ino=%ld)\n",
- __func__,
- -rc, inode->i_sb->s_id, inode->i_ino);
- return rc;
- }
- }
+ rc = selinux_determine_inode_label(
+ dir, qstr,
+ inode_mode_to_security_class(inode->i_mode),
+ &newsid);
+ if (rc)
+ return rc;
/* Possibly defer initialization to selinux_complete_init. */
if (sbsec->flags & SE_SBINITIALIZED) {
^ permalink raw reply related [flat|nested] 14+ messages in thread
* Re: [PATCH] SELinux: Create a common helper to determine an inode label [ver #3]
2015-06-18 18:25 ` David Howells
@ 2015-06-18 18:27 ` Stephen Smalley
-1 siblings, 0 replies; 14+ messages in thread
From: Stephen Smalley @ 2015-06-18 18:27 UTC (permalink / raw)
To: David Howells
Cc: linux-fsdevel, linux-security-module, linux-unionfs,
linux-kernel, SELinux, Paul Moore
On 06/18/2015 02:25 PM, David Howells wrote:
>
> Create a common helper function to determine the label for a new inode.
> This is then used by:
>
> - may_create()
> - selinux_dentry_init_security()
> - selinux_inode_init_security()
>
> This will change the behaviour of the functions slightly, bringing them all
> into line.
>
> Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
> Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index ffa5a642629a..ec30e599fb46 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -1684,6 +1684,32 @@ out:
> return rc;
> }
>
> +/*
> + * Determine the label for an inode that might be unioned.
> + */
> +static int selinux_determine_inode_label(const struct inode *dir,
> + const struct qstr *name,
> + u16 tclass,
> + u32 *_new_isid)
> +{
> + const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
> + const struct inode_security_struct *dsec = dir->i_security;
> + const struct task_security_struct *tsec = current_security();
> +
> + if ((sbsec->flags & SE_SBINITIALIZED) &&
> + (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
> + *_new_isid = sbsec->mntpoint_sid;
> + } else if ((sbsec->flags & SBLABEL_MNT) &&
> + tsec->create_sid) {
> + *_new_isid = tsec->create_sid;
> + } else {
> + return security_transition_sid(tsec->sid, dsec->sid, tclass,
> + name, _new_isid);
> + }
> +
> + return 0;
> +}
> +
> /* Check whether a task can create a file. */
> static int may_create(struct inode *dir,
> struct dentry *dentry,
> @@ -1700,7 +1726,6 @@ static int may_create(struct inode *dir,
> sbsec = dir->i_sb->s_security;
>
> sid = tsec->sid;
> - newsid = tsec->create_sid;
>
> ad.type = LSM_AUDIT_DATA_DENTRY;
> ad.u.dentry = dentry;
> @@ -1711,12 +1736,10 @@ static int may_create(struct inode *dir,
> if (rc)
> return rc;
>
> - if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
> - rc = security_transition_sid(sid, dsec->sid, tclass,
> - &dentry->d_name, &newsid);
> - if (rc)
> - return rc;
> - }
> + rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
> + &newsid);
> + if (rc)
> + return rc;
>
> rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
> if (rc)
> @@ -2723,32 +2746,14 @@ static int selinux_dentry_init_security(struct dentry *dentry, int mode,
> struct qstr *name, void **ctx,
> u32 *ctxlen)
> {
> - const struct cred *cred = current_cred();
> - struct task_security_struct *tsec;
> - struct inode_security_struct *dsec;
> - struct superblock_security_struct *sbsec;
> - struct inode *dir = d_backing_inode(dentry->d_parent);
> u32 newsid;
> int rc;
>
> - tsec = cred->security;
> - dsec = dir->i_security;
> - sbsec = dir->i_sb->s_security;
> -
> - if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
> - newsid = tsec->create_sid;
> - } else {
> - rc = security_transition_sid(tsec->sid, dsec->sid,
> - inode_mode_to_security_class(mode),
> - name,
> - &newsid);
> - if (rc) {
> - printk(KERN_WARNING
> - "%s: security_transition_sid failed, rc=%d\n",
> - __func__, -rc);
> - return rc;
> - }
> - }
> + rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
> + inode_mode_to_security_class(mode),
> + &newsid);
> + if (rc)
> + return rc;
>
> return security_sid_to_context(newsid, (char **)ctx, ctxlen);
> }
> @@ -2771,22 +2776,12 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
> sid = tsec->sid;
> newsid = tsec->create_sid;
>
> - if ((sbsec->flags & SE_SBINITIALIZED) &&
> - (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
> - newsid = sbsec->mntpoint_sid;
> - else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
> - rc = security_transition_sid(sid, dsec->sid,
> - inode_mode_to_security_class(inode->i_mode),
> - qstr, &newsid);
> - if (rc) {
> - printk(KERN_WARNING "%s: "
> - "security_transition_sid failed, rc=%d (dev=%s "
> - "ino=%ld)\n",
> - __func__,
> - -rc, inode->i_sb->s_id, inode->i_ino);
> - return rc;
> - }
> - }
> + rc = selinux_determine_inode_label(
> + dir, qstr,
> + inode_mode_to_security_class(inode->i_mode),
> + &newsid);
> + if (rc)
> + return rc;
>
> /* Possibly defer initialization to selinux_complete_init. */
> if (sbsec->flags & SE_SBINITIALIZED) {
>
>
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] SELinux: Create a common helper to determine an inode label [ver #3]
@ 2015-06-18 18:27 ` Stephen Smalley
0 siblings, 0 replies; 14+ messages in thread
From: Stephen Smalley @ 2015-06-18 18:27 UTC (permalink / raw)
To: David Howells
Cc: linux-unionfs, linux-kernel, linux-security-module, SELinux,
linux-fsdevel
On 06/18/2015 02:25 PM, David Howells wrote:
>
> Create a common helper function to determine the label for a new inode.
> This is then used by:
>
> - may_create()
> - selinux_dentry_init_security()
> - selinux_inode_init_security()
>
> This will change the behaviour of the functions slightly, bringing them all
> into line.
>
> Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
> Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index ffa5a642629a..ec30e599fb46 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -1684,6 +1684,32 @@ out:
> return rc;
> }
>
> +/*
> + * Determine the label for an inode that might be unioned.
> + */
> +static int selinux_determine_inode_label(const struct inode *dir,
> + const struct qstr *name,
> + u16 tclass,
> + u32 *_new_isid)
> +{
> + const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
> + const struct inode_security_struct *dsec = dir->i_security;
> + const struct task_security_struct *tsec = current_security();
> +
> + if ((sbsec->flags & SE_SBINITIALIZED) &&
> + (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
> + *_new_isid = sbsec->mntpoint_sid;
> + } else if ((sbsec->flags & SBLABEL_MNT) &&
> + tsec->create_sid) {
> + *_new_isid = tsec->create_sid;
> + } else {
> + return security_transition_sid(tsec->sid, dsec->sid, tclass,
> + name, _new_isid);
> + }
> +
> + return 0;
> +}
> +
> /* Check whether a task can create a file. */
> static int may_create(struct inode *dir,
> struct dentry *dentry,
> @@ -1700,7 +1726,6 @@ static int may_create(struct inode *dir,
> sbsec = dir->i_sb->s_security;
>
> sid = tsec->sid;
> - newsid = tsec->create_sid;
>
> ad.type = LSM_AUDIT_DATA_DENTRY;
> ad.u.dentry = dentry;
> @@ -1711,12 +1736,10 @@ static int may_create(struct inode *dir,
> if (rc)
> return rc;
>
> - if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
> - rc = security_transition_sid(sid, dsec->sid, tclass,
> - &dentry->d_name, &newsid);
> - if (rc)
> - return rc;
> - }
> + rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
> + &newsid);
> + if (rc)
> + return rc;
>
> rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
> if (rc)
> @@ -2723,32 +2746,14 @@ static int selinux_dentry_init_security(struct dentry *dentry, int mode,
> struct qstr *name, void **ctx,
> u32 *ctxlen)
> {
> - const struct cred *cred = current_cred();
> - struct task_security_struct *tsec;
> - struct inode_security_struct *dsec;
> - struct superblock_security_struct *sbsec;
> - struct inode *dir = d_backing_inode(dentry->d_parent);
> u32 newsid;
> int rc;
>
> - tsec = cred->security;
> - dsec = dir->i_security;
> - sbsec = dir->i_sb->s_security;
> -
> - if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
> - newsid = tsec->create_sid;
> - } else {
> - rc = security_transition_sid(tsec->sid, dsec->sid,
> - inode_mode_to_security_class(mode),
> - name,
> - &newsid);
> - if (rc) {
> - printk(KERN_WARNING
> - "%s: security_transition_sid failed, rc=%d\n",
> - __func__, -rc);
> - return rc;
> - }
> - }
> + rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
> + inode_mode_to_security_class(mode),
> + &newsid);
> + if (rc)
> + return rc;
>
> return security_sid_to_context(newsid, (char **)ctx, ctxlen);
> }
> @@ -2771,22 +2776,12 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
> sid = tsec->sid;
> newsid = tsec->create_sid;
>
> - if ((sbsec->flags & SE_SBINITIALIZED) &&
> - (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
> - newsid = sbsec->mntpoint_sid;
> - else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
> - rc = security_transition_sid(sid, dsec->sid,
> - inode_mode_to_security_class(inode->i_mode),
> - qstr, &newsid);
> - if (rc) {
> - printk(KERN_WARNING "%s: "
> - "security_transition_sid failed, rc=%d (dev=%s "
> - "ino=%ld)\n",
> - __func__,
> - -rc, inode->i_sb->s_id, inode->i_ino);
> - return rc;
> - }
> - }
> + rc = selinux_determine_inode_label(
> + dir, qstr,
> + inode_mode_to_security_class(inode->i_mode),
> + &newsid);
> + if (rc)
> + return rc;
>
> /* Possibly defer initialization to selinux_complete_init. */
> if (sbsec->flags & SE_SBINITIALIZED) {
>
>
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] SELinux: Create a common helper to determine an inode label [ver #3]
2015-06-18 18:25 ` David Howells
@ 2015-06-18 20:35 ` Paul Moore
-1 siblings, 0 replies; 14+ messages in thread
From: Paul Moore @ 2015-06-18 20:35 UTC (permalink / raw)
To: David Howells
Cc: Stephen Smalley, linux-fsdevel, linux-security-module,
linux-unionfs, linux-kernel, SELinux
On Thursday, June 18, 2015 07:25:05 PM David Howells wrote:
> Create a common helper function to determine the label for a new inode.
> This is then used by:
>
> - may_create()
> - selinux_dentry_init_security()
> - selinux_inode_init_security()
>
> This will change the behaviour of the functions slightly, bringing them all
> into line.
>
> Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
> Signed-off-by: David Howells <dhowells@redhat.com>
This patch looks fine to me and I think there is an advantage to merging this
regardless of what happens with the "unioning" work so I'm inclined to queue
this up now unless you would prefer to resubmit with the union patches?
> ---
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index ffa5a642629a..ec30e599fb46 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -1684,6 +1684,32 @@ out:
> return rc;
> }
>
> +/*
> + * Determine the label for an inode that might be unioned.
> + */
> +static int selinux_determine_inode_label(const struct inode *dir,
> + const struct qstr *name,
> + u16 tclass,
> + u32 *_new_isid)
> +{
> + const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
> + const struct inode_security_struct *dsec = dir->i_security;
> + const struct task_security_struct *tsec = current_security();
> +
> + if ((sbsec->flags & SE_SBINITIALIZED) &&
> + (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
> + *_new_isid = sbsec->mntpoint_sid;
> + } else if ((sbsec->flags & SBLABEL_MNT) &&
> + tsec->create_sid) {
> + *_new_isid = tsec->create_sid;
> + } else {
> + return security_transition_sid(tsec->sid, dsec->sid, tclass,
> + name, _new_isid);
> + }
> +
> + return 0;
> +}
> +
> /* Check whether a task can create a file. */
> static int may_create(struct inode *dir,
> struct dentry *dentry,
> @@ -1700,7 +1726,6 @@ static int may_create(struct inode *dir,
> sbsec = dir->i_sb->s_security;
>
> sid = tsec->sid;
> - newsid = tsec->create_sid;
>
> ad.type = LSM_AUDIT_DATA_DENTRY;
> ad.u.dentry = dentry;
> @@ -1711,12 +1736,10 @@ static int may_create(struct inode *dir,
> if (rc)
> return rc;
>
> - if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
> - rc = security_transition_sid(sid, dsec->sid, tclass,
> - &dentry->d_name, &newsid);
> - if (rc)
> - return rc;
> - }
> + rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
> + &newsid);
> + if (rc)
> + return rc;
>
> rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
> if (rc)
> @@ -2723,32 +2746,14 @@ static int selinux_dentry_init_security(struct
> dentry *dentry, int mode, struct qstr *name, void **ctx,
> u32 *ctxlen)
> {
> - const struct cred *cred = current_cred();
> - struct task_security_struct *tsec;
> - struct inode_security_struct *dsec;
> - struct superblock_security_struct *sbsec;
> - struct inode *dir = d_backing_inode(dentry->d_parent);
> u32 newsid;
> int rc;
>
> - tsec = cred->security;
> - dsec = dir->i_security;
> - sbsec = dir->i_sb->s_security;
> -
> - if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
> - newsid = tsec->create_sid;
> - } else {
> - rc = security_transition_sid(tsec->sid, dsec->sid,
> - inode_mode_to_security_class(mode),
> - name,
> - &newsid);
> - if (rc) {
> - printk(KERN_WARNING
> - "%s: security_transition_sid failed, rc=%d\n",
> - __func__, -rc);
> - return rc;
> - }
> - }
> + rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
> + inode_mode_to_security_class(mode),
> + &newsid);
> + if (rc)
> + return rc;
>
> return security_sid_to_context(newsid, (char **)ctx, ctxlen);
> }
> @@ -2771,22 +2776,12 @@ static int selinux_inode_init_security(struct inode
> *inode, struct inode *dir, sid = tsec->sid;
> newsid = tsec->create_sid;
>
> - if ((sbsec->flags & SE_SBINITIALIZED) &&
> - (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
> - newsid = sbsec->mntpoint_sid;
> - else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
> - rc = security_transition_sid(sid, dsec->sid,
> - inode_mode_to_security_class(inode->i_mode),
> - qstr, &newsid);
> - if (rc) {
> - printk(KERN_WARNING "%s: "
> - "security_transition_sid failed, rc=%d (dev=%s "
> - "ino=%ld)\n",
> - __func__,
> - -rc, inode->i_sb->s_id, inode->i_ino);
> - return rc;
> - }
> - }
> + rc = selinux_determine_inode_label(
> + dir, qstr,
> + inode_mode_to_security_class(inode->i_mode),
> + &newsid);
> + if (rc)
> + return rc;
>
> /* Possibly defer initialization to selinux_complete_init. */
> if (sbsec->flags & SE_SBINITIALIZED) {
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] SELinux: Create a common helper to determine an inode label [ver #3]
@ 2015-06-18 20:35 ` Paul Moore
0 siblings, 0 replies; 14+ messages in thread
From: Paul Moore @ 2015-06-18 20:35 UTC (permalink / raw)
To: David Howells
Cc: linux-unionfs, linux-kernel, linux-security-module, SELinux,
linux-fsdevel, Stephen Smalley
On Thursday, June 18, 2015 07:25:05 PM David Howells wrote:
> Create a common helper function to determine the label for a new inode.
> This is then used by:
>
> - may_create()
> - selinux_dentry_init_security()
> - selinux_inode_init_security()
>
> This will change the behaviour of the functions slightly, bringing them all
> into line.
>
> Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
> Signed-off-by: David Howells <dhowells@redhat.com>
This patch looks fine to me and I think there is an advantage to merging this
regardless of what happens with the "unioning" work so I'm inclined to queue
this up now unless you would prefer to resubmit with the union patches?
> ---
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index ffa5a642629a..ec30e599fb46 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -1684,6 +1684,32 @@ out:
> return rc;
> }
>
> +/*
> + * Determine the label for an inode that might be unioned.
> + */
> +static int selinux_determine_inode_label(const struct inode *dir,
> + const struct qstr *name,
> + u16 tclass,
> + u32 *_new_isid)
> +{
> + const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
> + const struct inode_security_struct *dsec = dir->i_security;
> + const struct task_security_struct *tsec = current_security();
> +
> + if ((sbsec->flags & SE_SBINITIALIZED) &&
> + (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
> + *_new_isid = sbsec->mntpoint_sid;
> + } else if ((sbsec->flags & SBLABEL_MNT) &&
> + tsec->create_sid) {
> + *_new_isid = tsec->create_sid;
> + } else {
> + return security_transition_sid(tsec->sid, dsec->sid, tclass,
> + name, _new_isid);
> + }
> +
> + return 0;
> +}
> +
> /* Check whether a task can create a file. */
> static int may_create(struct inode *dir,
> struct dentry *dentry,
> @@ -1700,7 +1726,6 @@ static int may_create(struct inode *dir,
> sbsec = dir->i_sb->s_security;
>
> sid = tsec->sid;
> - newsid = tsec->create_sid;
>
> ad.type = LSM_AUDIT_DATA_DENTRY;
> ad.u.dentry = dentry;
> @@ -1711,12 +1736,10 @@ static int may_create(struct inode *dir,
> if (rc)
> return rc;
>
> - if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
> - rc = security_transition_sid(sid, dsec->sid, tclass,
> - &dentry->d_name, &newsid);
> - if (rc)
> - return rc;
> - }
> + rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
> + &newsid);
> + if (rc)
> + return rc;
>
> rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
> if (rc)
> @@ -2723,32 +2746,14 @@ static int selinux_dentry_init_security(struct
> dentry *dentry, int mode, struct qstr *name, void **ctx,
> u32 *ctxlen)
> {
> - const struct cred *cred = current_cred();
> - struct task_security_struct *tsec;
> - struct inode_security_struct *dsec;
> - struct superblock_security_struct *sbsec;
> - struct inode *dir = d_backing_inode(dentry->d_parent);
> u32 newsid;
> int rc;
>
> - tsec = cred->security;
> - dsec = dir->i_security;
> - sbsec = dir->i_sb->s_security;
> -
> - if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
> - newsid = tsec->create_sid;
> - } else {
> - rc = security_transition_sid(tsec->sid, dsec->sid,
> - inode_mode_to_security_class(mode),
> - name,
> - &newsid);
> - if (rc) {
> - printk(KERN_WARNING
> - "%s: security_transition_sid failed, rc=%d\n",
> - __func__, -rc);
> - return rc;
> - }
> - }
> + rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
> + inode_mode_to_security_class(mode),
> + &newsid);
> + if (rc)
> + return rc;
>
> return security_sid_to_context(newsid, (char **)ctx, ctxlen);
> }
> @@ -2771,22 +2776,12 @@ static int selinux_inode_init_security(struct inode
> *inode, struct inode *dir, sid = tsec->sid;
> newsid = tsec->create_sid;
>
> - if ((sbsec->flags & SE_SBINITIALIZED) &&
> - (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
> - newsid = sbsec->mntpoint_sid;
> - else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
> - rc = security_transition_sid(sid, dsec->sid,
> - inode_mode_to_security_class(inode->i_mode),
> - qstr, &newsid);
> - if (rc) {
> - printk(KERN_WARNING "%s: "
> - "security_transition_sid failed, rc=%d (dev=%s "
> - "ino=%ld)\n",
> - __func__,
> - -rc, inode->i_sb->s_id, inode->i_ino);
> - return rc;
> - }
> - }
> + rc = selinux_determine_inode_label(
> + dir, qstr,
> + inode_mode_to_security_class(inode->i_mode),
> + &newsid);
> + if (rc)
> + return rc;
>
> /* Possibly defer initialization to selinux_complete_init. */
> if (sbsec->flags & SE_SBINITIALIZED) {
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] SELinux: Create a common helper to determine an inode label [ver #3]
2015-06-18 18:25 ` David Howells
(?)
@ 2015-06-22 9:41 ` David Howells
-1 siblings, 0 replies; 14+ messages in thread
From: David Howells @ 2015-06-22 9:41 UTC (permalink / raw)
To: Paul Moore
Cc: dhowells, Stephen Smalley, linux-fsdevel, linux-security-module,
linux-unionfs, linux-kernel, SELinux
Paul Moore <paul@paul-moore.com> wrote:
> This patch looks fine to me and I think there is an advantage to merging this
> regardless of what happens with the "unioning" work so I'm inclined to queue
> this up now unless you would prefer to resubmit with the union patches?
If you could queue it up now, that'd be great!
David
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] SELinux: Create a common helper to determine an inode label [ver #3]
@ 2015-06-22 9:41 ` David Howells
0 siblings, 0 replies; 14+ messages in thread
From: David Howells @ 2015-06-22 9:41 UTC (permalink / raw)
To: Paul Moore
Cc: dhowells, Stephen Smalley, linux-fsdevel, linux-security-module,
linux-unionfs, linux-kernel, SELinux
Paul Moore <paul@paul-moore.com> wrote:
> This patch looks fine to me and I think there is an advantage to merging this
> regardless of what happens with the "unioning" work so I'm inclined to queue
> this up now unless you would prefer to resubmit with the union patches?
If you could queue it up now, that'd be great!
David
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] SELinux: Create a common helper to determine an inode label [ver #3]
@ 2015-06-22 9:41 ` David Howells
0 siblings, 0 replies; 14+ messages in thread
From: David Howells @ 2015-06-22 9:41 UTC (permalink / raw)
To: Paul Moore
Cc: linux-unionfs, linux-kernel, dhowells, linux-security-module,
SELinux, linux-fsdevel, Stephen Smalley
Paul Moore <paul@paul-moore.com> wrote:
> This patch looks fine to me and I think there is an advantage to merging this
> regardless of what happens with the "unioning" work so I'm inclined to queue
> this up now unless you would prefer to resubmit with the union patches?
If you could queue it up now, that'd be great!
David
^ permalink raw reply [flat|nested] 14+ messages in thread
* libselinux equivalent of restorecon -F
2015-06-22 9:41 ` David Howells
(?)
(?)
@ 2015-06-22 12:13 ` Dominick Grift
2015-06-22 12:48 ` Stephen Smalley
-1 siblings, 1 reply; 14+ messages in thread
From: Dominick Grift @ 2015-06-22 12:13 UTC (permalink / raw)
To: selinux
[-- Attachment #1: Type: text/plain, Size: 527 bytes --]
Please excuse my ignorance, and please bear with me for a moment:
I would consider lsetfilecon() functionality roughly the same to that of "restorecon" (in a sense at least).
Which libselinux interface would be provide roughly the same functionality to that of "restorecon -F" (in a sense at least) ?
Is that what selinux_lsetfilecon_default() is for?
Thanks
--
02DFF788
4D30 903A 1CF3 B756 FB48 1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
[-- Attachment #2: Type: application/pgp-signature, Size: 648 bytes --]
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: libselinux equivalent of restorecon -F
2015-06-22 12:13 ` libselinux equivalent of restorecon -F Dominick Grift
@ 2015-06-22 12:48 ` Stephen Smalley
0 siblings, 0 replies; 14+ messages in thread
From: Stephen Smalley @ 2015-06-22 12:48 UTC (permalink / raw)
To: selinux
On 06/22/2015 08:13 AM, Dominick Grift wrote:
> Please excuse my ignorance, and please bear with me for a moment:
>
> I would consider lsetfilecon() functionality roughly the same to that of "restorecon" (in a sense at least).
>
> Which libselinux interface would be provide roughly the same functionality to that of "restorecon -F" (in a sense at least) ?
>
> Is that what selinux_lsetfilecon_default() is for?
Yes, that's probably the closest equivalent in upstream libselinux.
However, in Android libselinux [1], we have a
selinux_android_restorecon() function that fully replicates restorecon
functionality. We should likely take a version of that to upstream
libselinux. Interface is:
#define SELINUX_ANDROID_RESTORECON_NOCHANGE 1
#define SELINUX_ANDROID_RESTORECON_VERBOSE 2
#define SELINUX_ANDROID_RESTORECON_RECURSE 4
#define SELINUX_ANDROID_RESTORECON_FORCE 8
#define SELINUX_ANDROID_RESTORECON_DATADATA 16
extern int selinux_android_restorecon(const char *file, unsigned int flags);
[1] https://android.googlesource.com/platform/external/libselinux
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] SELinux: Create a common helper to determine an inode label [ver #3]
2015-06-22 9:41 ` David Howells
(?)
@ 2015-06-22 21:48 ` Paul Moore
-1 siblings, 0 replies; 14+ messages in thread
From: Paul Moore @ 2015-06-22 21:48 UTC (permalink / raw)
To: David Howells
Cc: Stephen Smalley, linux-fsdevel, linux-security-module,
linux-unionfs, linux-kernel, SELinux
On Mon, Jun 22, 2015 at 5:41 AM, David Howells <dhowells@redhat.com> wrote:
> Paul Moore <paul@paul-moore.com> wrote:
>
>> This patch looks fine to me and I think there is an advantage to merging this
>> regardless of what happens with the "unioning" work so I'm inclined to queue
>> this up now unless you would prefer to resubmit with the union patches?
>
> If you could queue it up now, that'd be great!
All set. As soon as the merge window closes I'll push it to the
selinux#next branch.
--
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] SELinux: Create a common helper to determine an inode label [ver #3]
@ 2015-06-22 21:48 ` Paul Moore
0 siblings, 0 replies; 14+ messages in thread
From: Paul Moore @ 2015-06-22 21:48 UTC (permalink / raw)
To: David Howells
Cc: Stephen Smalley, linux-fsdevel, linux-security-module,
linux-unionfs, linux-kernel, SELinux
On Mon, Jun 22, 2015 at 5:41 AM, David Howells <dhowells@redhat.com> wrote:
> Paul Moore <paul@paul-moore.com> wrote:
>
>> This patch looks fine to me and I think there is an advantage to merging this
>> regardless of what happens with the "unioning" work so I'm inclined to queue
>> this up now unless you would prefer to resubmit with the union patches?
>
> If you could queue it up now, that'd be great!
All set. As soon as the merge window closes I'll push it to the
selinux#next branch.
--
paul moore
www.paul-moore.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 14+ messages in thread
* Re: [PATCH] SELinux: Create a common helper to determine an inode label [ver #3]
@ 2015-06-22 21:48 ` Paul Moore
0 siblings, 0 replies; 14+ messages in thread
From: Paul Moore @ 2015-06-22 21:48 UTC (permalink / raw)
To: David Howells
Cc: linux-unionfs, linux-kernel, linux-security-module, SELinux,
linux-fsdevel, Stephen Smalley
On Mon, Jun 22, 2015 at 5:41 AM, David Howells <dhowells@redhat.com> wrote:
> Paul Moore <paul@paul-moore.com> wrote:
>
>> This patch looks fine to me and I think there is an advantage to merging this
>> regardless of what happens with the "unioning" work so I'm inclined to queue
>> this up now unless you would prefer to resubmit with the union patches?
>
> If you could queue it up now, that'd be great!
All set. As soon as the merge window closes I'll push it to the
selinux#next branch.
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 14+ messages in thread
end of thread, other threads:[~2015-06-22 21:49 UTC | newest]
Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-06-18 18:25 [PATCH] SELinux: Create a common helper to determine an inode label [ver #3] David Howells
2015-06-18 18:25 ` David Howells
2015-06-18 18:27 ` Stephen Smalley
2015-06-18 18:27 ` Stephen Smalley
2015-06-18 20:35 ` Paul Moore
2015-06-18 20:35 ` Paul Moore
2015-06-22 9:41 ` David Howells
2015-06-22 9:41 ` David Howells
2015-06-22 9:41 ` David Howells
2015-06-22 12:13 ` libselinux equivalent of restorecon -F Dominick Grift
2015-06-22 12:48 ` Stephen Smalley
2015-06-22 21:48 ` [PATCH] SELinux: Create a common helper to determine an inode label [ver #3] Paul Moore
2015-06-22 21:48 ` Paul Moore
2015-06-22 21:48 ` Paul Moore
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.