lkml.org 
[lkml]   [2014]   [Nov]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
SubjectRe: [PATCH 3/7] SELinux: Stub in copy-up handling
Date
Paul Moore <paul@paul-moore.com> wrote:

> > +static int selinux_inode_copy_up_xattr(struct dentry *src, struct dentry
> > ...*dst,
> > + const char *name, void *value, size_t *size)
> > +{
> > + if (strcmp(name, XATTR_NAME_SELINUX) == 0)
> > + return 1; /* Discard */
>
> I understand that this is just a stub, but I we need to discuss this at some
> point and I figure better in this patch than elsewhere where it might get
> lost.
>
> For the docker, context= mount use case (similar to SELinux/sVirt) dropping
> the SELinux xattr is probably an okay behavior. However, I would expect that
> ultimately this is something we would want to control by policy and/or the
> presence of a context= label.

The problem is that the label you actually want has already been set and you
have to be careful not to overwrite it.

The other hook (->inode_copy_up) is called first to label the destination
inode - and that has access to the source file also so it can label the
destination with consideration of the attributes on the source. Normally, the
attributes on the source will be in memory attached to the source inode, I
would imagine.

David


\
 
 \ /
  Last update: 2014-11-07 23:21    [W:0.309 / U:0.320 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site