Re: [PATCH] selinux: enable genfscon labeling for securityfs

[Paul Moore <paul@paul-moore.com>]

On Thu, Sep 16, 2021 at 1:41 PM Christian Göttsche
<cgzones@googlemail.com> wrote:
> On Wed, 15 Sept 2021 at 20:28, Paul Moore <paul@paul-moore.com> wrote:
> >
> > On Wed, Sep 15, 2021 at 12:24 PM Christian Göttsche
> > <cgzones@googlemail.com> wrote:
> > >
> > > Add support for genfscon per-file labeling of securityfs files. This allows
> > > for separate labels and therby permissions for different files, e.g.
> > > /sys/kernel/security/integrity/ima/policy.
> > >
> > > Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> > > ---
> > >  security/selinux/hooks.c | 3 ++-
> > >  1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > Hi Christian,
> >
> > It would be nice if you could add some additional notes on how this
> > was tested to the description above.
> >
> > > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> > > index 6517f221d52c..a18626424731 100644
> > > --- a/security/selinux/hooks.c
> > > +++ b/security/selinux/hooks.c
> > > @@ -760,7 +760,8 @@ static int selinux_set_mnt_opts(struct super_block *sb,
> > >             !strcmp(sb->s_type->name, "tracefs") ||
> > >             !strcmp(sb->s_type->name, "binder") ||
> > >             !strcmp(sb->s_type->name, "bpf") ||
> > > -           !strcmp(sb->s_type->name, "pstore"))
> > > +           !strcmp(sb->s_type->name, "pstore") ||
> > > +           !strcmp(sb->s_type->name, "securityfs"))
> > >                 sbsec->flags |= SE_SBGENFS;
> > >
> > >         if (!strcmp(sb->s_type->name, "sysfs") ||
> > > --
> > > 2.33.0
> >
> > --
> > paul moore
> > www.paul-moore.com
>
> Something like:
>
>     Add support for genfscon per-file labeling of securityfs files. This allows
>     for separate labels and thereby access control for different files.
>     For example a genfscon statement
>         genfscon securityfs /integrity/ima/policy
> system_u:object_r:ima_policy_t:s0
>     will set a specific label to the IMA policy file and thus allow to
> control the ability
>     to set the IMA policy.
>     Setting labels directly, e.g. via chcon(1) or setfiles(8), is
> still not supported.
>
> ?

That's a much better description of the functionality, especially for
those who may not be very familiar with SELinux, thank you.  However I
was hoping to also hear some confirmation that you have tested this
and it worked without problem?

-- 
paul moore
www.paul-moore.com