Messages in this thread | | | From | David Howells <> | Subject | Re: [PATCH 5/8] SELinux: Stub in copy-up handling | Date | Thu, 18 Jun 2015 17:51:15 +0100 |
| |
Stephen Smalley <sds@tycho.nsa.gov> wrote:
> I'm not sure we never want to copy up the SELinux attribute. See my > other email about ecryptfs and supporting per-file labeling and > consistent access control over the upper and lower inodes.
Yes. That's why there are two operations. inode_copy_up() should set the label appropriately and inode_copy_up_xattr() should prevent the label set by inode_copy_up() from being clobbered.
Note that inode_copy_up() has access to the lower file label and can perform some sort of incantation to transmute it before applying it.
David
| |