From patchwork Thu Dec 13 14:17:39 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Ondrej Mosnacek X-Patchwork-Id: 10728779 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1354114E2 for ; Thu, 13 Dec 2018 14:19:25 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 0465C2BDF1 for ; Thu, 13 Dec 2018 14:19:25 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id ECBB32C0F4; Thu, 13 Dec 2018 14:19:24 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.9 required=2.0 tests=BAYES_00,MAILING_LIST_MULTI, RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8599E2BDF1 for ; Thu, 13 Dec 2018 14:19:24 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727757AbeLMOTY (ORCPT ); Thu, 13 Dec 2018 09:19:24 -0500 Received: from mail-wr1-f68.google.com ([209.85.221.68]:37293 "EHLO mail-wr1-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728138AbeLMOTY (ORCPT ); Thu, 13 Dec 2018 09:19:24 -0500 Received: by mail-wr1-f68.google.com with SMTP id s12so1756173wrt.4 for ; Thu, 13 Dec 2018 06:19:22 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=YFhekL8QmWsTx5uZ6jKbGnq66XQoz3PD4UcdxRJoFy8=; b=JR4SeQtJnvXZQmHtQwo0SQjwRlsGBIiA0AR/sOOxAoCUtUZ/mV035GhgEe00jLWRYS kWcjxqfhc+b114Xff7AamVfBtoBKIkXibije+7CKzKMn6AkKM66KZL6EH05wjihiMdwT IxwQcPOGlVfxvH+iZNaDdlj7Nu1SxcGM8XLsvoOLAhFDhoDq1NZaVkuMgc1ijAX4IC7U O75nescARB7hQ3bDTkD8Gnid2OrBvcbFPI9bzSqL9U6hbKnk81N4U2m/9nAndk7hKgs0 bcAH5jEry0Wc6WwM+g3qMh3jMCZGfLvj0IxClsfo5VWIqEwBIa2MOjVamMIq/XtBaDHS fANA== X-Gm-Message-State: AA+aEWaGvgmErd256EA079Lwp4PsNppKVGPUOum3j/yTnF9xH34wGh40 cRwDXbGF8r6JLerBB5Auy2WBt9pva6A= X-Google-Smtp-Source: AFSGD/WQ1FEuiPE4dYF2GeN+QD7Dd1iyuSBmzuarTNFkaA/XEqX7bwjSwX6+xaeWgkFLApnwapL03w== X-Received: by 2002:a5d:66c1:: with SMTP id k1mr20640084wrw.132.1544710761932; Thu, 13 Dec 2018 06:19:21 -0800 (PST) Received: from localhost.localdomain.com (nat-pool-brq-t.redhat.com. [213.175.37.10]) by smtp.gmail.com with ESMTPSA id e16sm2544750wrn.72.2018.12.13.06.19.20 (version=TLS1_2 cipher=ECDHE-RSA-CHACHA20-POLY1305 bits=256/256); Thu, 13 Dec 2018 06:19:21 -0800 (PST) From: Ondrej Mosnacek To: selinux@vger.kernel.org, Paul Moore , cgroups@vger.kernel.org, Tejun Heo Cc: Stephen Smalley , Li Zefan , Johannes Weiner , Ondrej Mosnacek Subject: [RFC PATCH 3/3] selinux: do not override context on context mounts Date: Thu, 13 Dec 2018 15:17:39 +0100 Message-Id: <20181213141739.8534-4-omosnace@redhat.com> X-Mailer: git-send-email 2.19.2 In-Reply-To: <20181213141739.8534-1-omosnace@redhat.com> References: <20181213141739.8534-1-omosnace@redhat.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Ignore all selinux_inode_notifysecctx() calls on mounts with the SECURITY_FS_USE_MNTPOINT behavior. This fixes behavior of kernfs-based filesystems when mounted with the 'context=' option. Before this patch, if a node's context had been explicitly set to a non-default value and later the filesystem has been remounted with the 'context=' option, then this node would show up as having a different context. Steps to reproduce: # mount -t cgroup2 cgroup2 /sys/fs/cgroup/unified # chcon unconfined_u:object_r:user_home_t:s0 /sys/fs/cgroup/unified/cgroup.stat # ls -lZ /sys/fs/cgroup/unified total 0 -r--r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.controllers -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.max.depth -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.max.descendants -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.procs -r--r--r--. 1 root root unconfined_u:object_r:user_home_t:s0 0 Dec 13 10:41 cgroup.stat -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.subtree_control -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Dec 13 10:41 cgroup.threads # umount /sys/fs/cgroup/unified # mount -o context=system_u:object_r:tmpfs_t:s0 -t cgroup2 cgroup2 /sys/fs/cgroup/unified Result before: # ls -lZ /sys/fs/cgroup/unified total 0 -r--r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.controllers -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.max.depth -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.max.descendants -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.procs -r--r--r--. 1 root root unconfined_u:object_r:user_home_t:s0 0 Dec 13 10:41 cgroup.stat -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.subtree_control -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.threads Result after: # ls -lZ /sys/fs/cgroup/unified total 0 -r--r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.controllers -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.max.depth -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.max.descendants -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.procs -r--r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.stat -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.subtree_control -rw-r--r--. 1 root root system_u:object_r:tmpfs_t:s0 0 Dec 13 10:41 cgroup.threads Signed-off-by: Ondrej Mosnacek --- security/selinux/hooks.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index d6d29ec54eab..0ca5ed30afe1 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6620,6 +6620,13 @@ static void selinux_inode_invalidate_secctx(struct inode *inode) */ static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) { + struct superblock_security_struct *sbsec = inode->i_sb->s_security; + + /* Do not change context in SECURITY_FS_USE_MNTPOINT case */ + if ((sbsec->flags & SE_SBINITIALIZED) && + (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) + return 0; + return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0); }