diff options
| author |   Anand Avati <avati@redhat.com> | 2013-04-16 18:56:19 -0400 |
|---|---|---|
| committer |   Eric Paris <eparis@redhat.com> | 2013-08-28 14:44:52 -0400 |
| commit | 102aefdda4d8275ce7d7100bc16c88c74272b260 (patch) | |
| tree | 808ea5ebeb04abbf5e8d9c024f261225a41420d7 /security/selinux/include/security.h | |
| parent | Add SELinux policy capability for always checking packet and peer classes. (diff) | |
| download | wireguard-linux-102aefdda4d8275ce7d7100bc16c88c74272b260.tar.xz wireguard-linux-102aefdda4d8275ce7d7100bc16c88c74272b260.zip | |
selinux: consider filesystem subtype in policies
Not considering sub filesystem has the following limitation. Support
for SELinux in FUSE is dependent on the particular userspace
filesystem, which is identified by the subtype. For e.g, GlusterFS,
a FUSE based filesystem supports SELinux (by mounting and processing
FUSE requests in different threads, avoiding the mount time
deadlock), whereas other FUSE based filesystems (identified by a
different subtype) have the mount time deadlock.
By considering the subtype of the filesytem in the SELinux policies,
allows us to specify a filesystem subtype, in the following way:
fs_use_xattr fuse.glusterfs gen_context(system_u:object_r:fs_t,s0);
This way not all FUSE filesystems are put in the same bucket and
subjected to the limitations of the other subtypes.
Signed-off-by: Anand Avati <avati@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
Diffstat (limited to 'security/selinux/include/security.h')
0 files changed, 0 insertions, 0 deletions