diff options
| author |   Ondrej Mosnacek <omosnace@redhat.com> | 2018-12-21 21:18:52 +0100 |
|---|---|---|
| committer |   Paul Moore <paul@paul-moore.com> | 2019-01-10 21:23:39 -0500 |
| commit | a83d6ddaebe541570291205cb538e35ad4ff94f9 (patch) | |
| tree | e06b9552bec95ead56f8ba79ac4f27947866850b /kernel/user_namespace.c | |
| parent | selinux: stop passing MAY_NOT_BLOCK to the AVC upon follow_link (diff) | |
| download | linux-dev-a83d6ddaebe541570291205cb538e35ad4ff94f9.tar.xz linux-dev-a83d6ddaebe541570291205cb538e35ad4ff94f9.zip | |
selinux: never allow relabeling on context mounts
In the SECURITY_FS_USE_MNTPOINT case we never want to allow relabeling
files/directories, so we should never set the SBLABEL_MNT flag. The
'special handling' in selinux_is_sblabel_mnt() is only intended for when
the behavior is set to SECURITY_FS_USE_GENFS.
While there, make the logic in selinux_is_sblabel_mnt() more explicit
and add a BUILD_BUG_ON() to make sure that introducing a new
SECURITY_FS_USE_* forces a review of the logic.
Fixes: d5f3a5f6e7e7 ("selinux: add security in-core xattr support for pstore and debugfs")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'kernel/user_namespace.c')
0 files changed, 0 insertions, 0 deletions