lkml.org 
[lkml]   [2015]   [Jun]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH 7/8] SELinux: Create a common helper to determine an inode label
    Date
    Stephen Smalley <sds@tycho.nsa.gov> wrote:

    > > + if ((sbsec->flags & SE_SBINITIALIZED) &&
    > > + (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
    > > + *_new_isid = sbsec->mntpoint_sid;
    > > + } else if (tsec->create_sid) {
    >
    > This doesn't quite match the logic in inode_init_security today, see its
    > checking of SBLABEL_MNT.

    Fair point. What does SBLABEL_MNT mean precisely? It seems to indicate one
    of an odd mix of behaviours. I presume it means that we *have* to calculate a
    label and can't get one from the underlying fs if it is not set.

    Also, in:

    sbsec->flags |= SE_SBINITIALIZED;
    if (selinux_is_sblabel_mnt(sb))
    sbsec->flags |= SBLABEL_MNT;

    should SE_SBINITIALIZED be set after SBLABEL_MNT? And should there be a
    memory barrier in here somewhere before the setting of SE_SBINITIALIZED?

    David


    \
     
     \ /
      Last update: 2015-06-18 17:41    [W:2.797 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site