From 659e4f92119df7fb78f38606089e15cf743c7674 Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Wed, 20 May 2015 12:33:16 -0400 Subject: [PATCH] selinux: enable genfscon labeling for sysfs and pstore files Support per-file labeling of sysfs and pstore files based on genfscon policy entries. This is safe because the sysfs and pstore directory tree cannot be manipulated by userspace, except to unlink pstore entries. This provides an alternative method of assigning per-file labeling to sysfs or pstore files without needing to set the labels from userspace on each boot. The advantages of this approach are that the labels are assigned as soon as the dentry is first instantiated and userspace does not need to walk the sysfs or pstore tree and set the labels on each boot. The limitations of this approach are that the labels can only be assigned based on pathname prefix matching. You can initially assign labels using this mechanism and then change them at runtime via setxattr if allowed to do so by policy. Change-Id: If5999785fdc1d24d869b23ae35cd302311e94562 Signed-off-by: Stephen Smalley Suggested-by: Dominick Grift Git-commit: 6f4f0dc1bc18de691668acf4bfeb9420507e2aa5 Git-repo: https://android.googlesource.com/kernel/common.git Signed-off-by: Kaushal Kumar --- security/selinux/hooks.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index aa7eb7cc7253..8d404a57ec65 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -710,7 +710,9 @@ static int selinux_set_mnt_opts(struct super_block *sb, if (strcmp(sb->s_type->name, "proc") == 0) sbsec->flags |= SE_SBPROC | SE_SBGENFS; - if (strcmp(sb->s_type->name, "debugfs") == 0) + if (!strcmp(sb->s_type->name, "debugfs") || + !strcmp(sb->s_type->name, "sysfs") || + !strcmp(sb->s_type->name, "pstore")) sbsec->flags |= SE_SBGENFS; /* Determine the labeling behavior to use for this filesystem type. */