GoogleGit

commit21a63f6526836f811e0ddbcb716bd4572c211b21[log][tgz]
authorStephen Smalley <sds@tycho.nsa.gov>Tue May 19 13:59:12 2015 -0400
committerStephen Smalley <sds@tycho.nsa.gov>Thu May 21 11:54:47 2015 -0400
tree136d638377dc855e3fb7daae6159f5cdcdd5b2d8
parent00a6e4dfa128c20861fbcd8adf3f28a8bf3a673e[diff]
selinux: enable per-file labeling for debugfs files.

upstream commit 6f29997f4a3117169eeabd41dbea4c1bd94a739c

Add support for per-file labeling of debugfs files so that
we can distinguish them in policy.  This is particularly
important in Android where certain debugfs files have to be writable
by apps and therefore the debugfs directory tree can be read and
searched by all.

Since debugfs is entirely kernel-generated, the directory tree is
immutable by userspace, and the inodes are pinned in memory, we can
simply use the same approach as with proc and label the inodes from
policy based on pathname from the root of the debugfs filesystem.
Generalize the existing labeling support used for proc and reuse it
for debugfs too.

[sds:  Back-ported to 3.10.  superblock_security_struct flags field
is only unsigned char in 3.10 so we have to redefine SE_SBGENFS.
However, this definition is kernel-private, not exposed to userspace
or stored anywhere persistent.]

Change-Id: I6460fbed6bb6bd36eb8554ac8c4fdd574edf3b07
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
2 files changed
tree: 136d638377dc855e3fb7daae6159f5cdcdd5b2d8
  1. .gitignore
  2. .mailmap
  3. COPYING
  4. CREDITS
  5. Documentation/
  6. Kbuild
  7. Kconfig
  8. MAINTAINERS
  9. Makefile
  10. README
  11. REPORTING-BUGS
  12. android/
  13. arch/
  14. block/
  15. crypto/
  16. drivers/
  17. firmware/
  18. fs/
  19. include/
  20. init/
  21. ipc/
  22. kernel/
  23. lib/
  24. mm/
  25. net/
  26. samples/
  27. scripts/
  28. security/
  29. sound/
  30. tools/
  31. usr/
  32. virt/