summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorEric Paris <eparis@parisplace.org>2006-07-14 11:24:33 +0400
committerLinus Torvalds <torvalds@g5.osdl.org>2006-07-15 08:53:55 +0400
commitb04ea3cebf79d6808632808072f276dbc98aaf01 (patch)
tree7620a01477510d9e4ae042baab17bce103b59185
parent517e7aa5b022f9dc486639c7689666663daee24f (diff)
downloadlinux-b04ea3cebf79d6808632808072f276dbc98aaf01.tar.xz
[PATCH] Fix security check for joint context= and fscontext= mount options
After some discussion on the actual meaning of the filesystem class security check in try context mount it was determined that the checks for the context= mount options were not correct if fscontext mount option had already been used. When labeling the superblock we should be checking relabel_from and relabel_to. But if the superblock has already been labeled (with fscontext) then context= is actually labeling the inodes, and so we should be checking relabel_from and associate. This patch fixes which checks are called depending on the mount options. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: James Morris <jmorris@namei.org> Cc: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--security/selinux/hooks.c14
1 files changed, 9 insertions, 5 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 2e8b4dfcbc74..a91c961ba38b 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -523,12 +523,16 @@ static int try_context_mount(struct super_block *sb, void *data)
goto out_free;
}
- rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
- if (rc)
- goto out_free;
-
- if (!fscontext)
+ if (!fscontext) {
+ rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
+ if (rc)
+ goto out_free;
sbsec->sid = sid;
+ } else {
+ rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
+ if (rc)
+ goto out_free;
+ }
sbsec->mntpoint_sid = sid;
sbsec->behavior = SECURITY_FS_USE_MNTPOINT;