Thanks to visit codestin.com
Credit goes to github.com

Skip to content
This repository was archived by the owner on Sep 24, 2020. It is now read-only.

Rebase CoreOS patches onto Linux v4.8.17 #36

Merged
merged 21 commits into from
Jan 18, 2017
Merged

Rebase CoreOS patches onto Linux v4.8.17 #36

Changes from 1 commit
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
72f2135
security, overlayfs: provide copy up security hook for unioned files
rhvgoyal Jul 19, 2016
b45eb80
selinux: Implementation for inode_copy_up() hook
rhvgoyal Jul 19, 2016
8a5e4f3
security,overlayfs: Provide security hook for copy up of xattrs for o…
rhvgoyal Jul 19, 2016
6f9f703
selinux: Implementation for inode_copy_up_xattr() hook
rhvgoyal Jul 19, 2016
1104a4c
selinux: Pass security pointer to determine_inode_label()
rhvgoyal Jul 19, 2016
6edae16
security, overlayfs: Provide hook to correctly label newly created files
rhvgoyal Jul 19, 2016
d1d5776
selinux: Implement dentry_create_files_as() hook
rhvgoyal Jul 19, 2016
14accb8
Add secure_modules() call
Aug 9, 2013
c1a2f1a
PCI: Lock down BAR access when module security is enabled
Mar 8, 2012
ef9962b
x86: Lock down IO port access when module security is enabled
Mar 8, 2012
d01d4b3
ACPI: Limit access to custom_method
Mar 9, 2012
70e4a01
asus-wmi: Restrict debugfs interface when module loading is restricted
Mar 9, 2012
c746f34
Restrict /dev/mem and /dev/kmem when module loading is restricted
Mar 9, 2012
5f74d42
acpi: Ignore acpi_rsdp kernel parameter when module loading is restri…
jwboyer Jun 25, 2012
fb93701
kexec: Disable at runtime if the kernel enforces module loading restr…
Nov 20, 2015
c707e9d
x86: Restrict MSR access when module loading is restricted
Feb 8, 2013
22a7af2
Add option to automatically enforce module signatures when in Secure …
Aug 9, 2013
2271087
efi: Make EFI_SECURE_BOOT_SIG_ENFORCE depend on EFI
Aug 27, 2013
b0f4c9e
efi: Add EFI_SECURE_BOOT bit
Aug 27, 2013
f342c4a
hibernate: Disable in a signed modules environment
Jun 20, 2014
fd0e348
kbuild: derive relative path for KBUILD_SRC from CURDIR
Nov 25, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
selinux: Implementation for inode_copy_up_xattr() hook 
When a file is copied up in overlay, we have already created file on upper/
with right label and there is no need to copy up selinux label/xattr from
lower file to upper file. In fact in case of context mount, we don't want
to copy up label as newly created file got its label from context= option.
 
Signed-off-by: Vivek Goyal <[email protected]>
Acked-by: Stephen Smalley <[email protected]>
  • Loading branch information
@rhvgoyal @crawford
rhvgoyal authored and crawford committed Jan 18, 2017
commit 6f9f7038760f6ed22de9beb621d1dcd5259bfa00
16 changes: 16 additions & 0 deletions security/selinux/hooks.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3313,6 +3313,21 @@ static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
return 0;
}

static int selinux_inode_copy_up_xattr(const char *name)
{
/* The copy_up hook above sets the initial context on an inode, but we
* don't then want to overwrite it by blindly copying all the lower
* xattrs up. Instead, we have to filter out SELinux-related xattrs.
*/
if (strcmp(name, XATTR_NAME_SELINUX) == 0)
return 1; /* Discard */
/*
* Any other attribute apart from SELINUX is not claimed, supported
* by selinux.
*/
return -EOPNOTSUPP;
}

/* file security operations */

static int selinux_revalidate_file_permission(struct file *file, int mask)
Expand Down Expand Up @@ -6109,6 +6124,7 @@ static struct security_hook_list selinux_hooks[] = {
LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),

LSM_HOOK_INIT(file_permission, selinux_file_permission),
LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
Expand Down