Commit 4d546f81 authored by Paul Moore's avatar Paul Moore
Browse files

selinux: revert 102aefdd 



Revert "selinux: consider filesystem subtype in policies"

This reverts commit 102aefdd.

Explanation from Eric Paris:

	SELinux policy can specify if it should use a filesystem's
	xattrs or not.  In current policy we have a specification that
	fuse should not use xattrs but fuse.glusterfs should use
	xattrs.  This patch has a bug in which non-glusterfs
	filesystems would match the rule saying fuse.glusterfs should
	use xattrs.  If both fuse and the particular filesystem in
	question are not written to handle xattr calls during the mount
	command, they will deadlock.

	I have fixed the bug to do proper matching, however I believe a
	revert is still the correct solution.  The reason I believe
	that is because the code still does not work.  The s_subtype is
	not set until after the SELinux hook which attempts to match on
	the ".gluster" portion of the rule.  So we cannot match on the
	rule in question.  The code is useless.

Signed-off-by: default avatarPaul Moore <pmoore@redhat.com>
parent 598cdbcf

security/selinux/hooks.c

+18 −22
Original line number Diff line number Diff line
@@ -96,10 +96,6 @@ 
#include "audit.h"

#include "avc_ss.h"



#define SB_TYPE_FMT "%s%s%s"

#define SB_SUBTYPE(sb) (sb->s_subtype && sb->s_subtype[0])

#define SB_TYPE_ARGS(sb) sb->s_type->name, SB_SUBTYPE(sb) ? "." : "", SB_SUBTYPE(sb) ? sb->s_subtype : ""



extern struct security_operations *security_ops;



/* SECMARK reference count */
@@ -414,8 +410,8 @@ static int sb_finish_set_opts(struct super_block *sb) 
		   the first boot of the SELinux kernel before we have

		   assigned xattr values to the filesystem. */

		if (!root_inode->i_op->getxattr) {

			printk(KERN_WARNING "SELinux: (dev %s, type "SB_TYPE_FMT") has no "

			       "xattr support\n", sb->s_id, SB_TYPE_ARGS(sb));

			printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "

			       "xattr support\n", sb->s_id, sb->s_type->name);

			rc = -EOPNOTSUPP;

			goto out;

		}
@@ -423,22 +419,22 @@ static int sb_finish_set_opts(struct super_block *sb) 
		if (rc < 0 && rc != -ENODATA) {

			if (rc == -EOPNOTSUPP)

				printk(KERN_WARNING "SELinux: (dev %s, type "

				       SB_TYPE_FMT") has no security xattr handler\n",

				       sb->s_id, SB_TYPE_ARGS(sb));

				       "%s) has no security xattr handler\n",

				       sb->s_id, sb->s_type->name);

			else

				printk(KERN_WARNING "SELinux: (dev %s, type "

				       SB_TYPE_FMT") getxattr errno %d\n", sb->s_id,

				       SB_TYPE_ARGS(sb), -rc);

				       "%s) getxattr errno %d\n", sb->s_id,

				       sb->s_type->name, -rc);

			goto out;

		}

	}



	if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))

		printk(KERN_ERR "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), unknown behavior\n",

		       sb->s_id, SB_TYPE_ARGS(sb));

		printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",

		       sb->s_id, sb->s_type->name);

	else

		printk(KERN_DEBUG "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), %s\n",

		       sb->s_id, SB_TYPE_ARGS(sb),

		printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",

		       sb->s_id, sb->s_type->name,

		       labeling_behaviors[sbsec->behavior-1]);



	sbsec->flags |= SE_SBINITIALIZED;
@@ -601,6 +597,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, 
	const struct cred *cred = current_cred();

	int rc = 0, i;

	struct superblock_security_struct *sbsec = sb->s_security;

	const char *name = sb->s_type->name;

	struct inode *inode = sbsec->sb->s_root->d_inode;

	struct inode_security_struct *root_isec = inode->i_security;

	u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
@@ -659,8 +656,8 @@ static int selinux_set_mnt_opts(struct super_block *sb, 
					     strlen(mount_options[i]), &sid);

		if (rc) {

			printk(KERN_WARNING "SELinux: security_context_to_sid"

			       "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",

			       mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);

			       "(%s) failed for (dev %s, type %s) errno=%d\n",

			       mount_options[i], sb->s_id, name, rc);

			goto out;

		}

		switch (flags[i]) {
@@ -807,8 +804,7 @@ out: 
out_double_mount:

	rc = -EINVAL;

	printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "

	       "security settings for (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,

	       SB_TYPE_ARGS(sb));

	       "security settings for (dev %s, type %s)\n", sb->s_id, name);

	goto out;

}
@@ -2481,8 +2477,8 @@ static int selinux_sb_remount(struct super_block *sb, void *data) 
		rc = security_context_to_sid(mount_options[i], len, &sid);

		if (rc) {

			printk(KERN_WARNING "SELinux: security_context_to_sid"

			       "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",

			       mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);

			       "(%s) failed for (dev %s, type %s) errno=%d\n",

			       mount_options[i], sb->s_id, sb->s_type->name, rc);

			goto out_free_opts;

		}

		rc = -EINVAL;
@@ -2520,8 +2516,8 @@ out_free_secdata: 
	return rc;

out_bad_option:

	printk(KERN_WARNING "SELinux: unable to change security options "

	       "during remount (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,

	       SB_TYPE_ARGS(sb));

	       "during remount (dev %s, type=%s)\n", sb->s_id,

	       sb->s_type->name);

	goto out_free_opts;

}

security/selinux/ss/services.c

+4 −38
Original line number Diff line number Diff line
@@ -2344,50 +2344,16 @@ int security_fs_use(struct super_block *sb) 
	struct ocontext *c;

	struct superblock_security_struct *sbsec = sb->s_security;

	const char *fstype = sb->s_type->name;

	const char *subtype = (sb->s_subtype && sb->s_subtype[0]) ? sb->s_subtype : NULL;

	struct ocontext *base = NULL;



	read_lock(&policy_rwlock);



	for (c = policydb.ocontexts[OCON_FSUSE]; c; c = c->next) {

		char *sub;

		int baselen;



		baselen = strlen(fstype);



		/* if base does not match, this is not the one */

		if (strncmp(fstype, c->u.name, baselen))

			continue;



		/* if there is no subtype, this is the one! */

		if (!subtype)

			break;



		/* skip past the base in this entry */

		sub = c->u.name + baselen;



		/* entry is only a base. save it. keep looking for subtype */

		if (sub[0] == '\0') {

			base = c;

			continue;

		}



		/* entry is not followed by a subtype, so it is not a match */

		if (sub[0] != '.')

			continue;



		/* whew, we found a subtype of this fstype */

		sub++; /* move past '.' */



		/* exact match of fstype AND subtype */

		if (!strcmp(subtype, sub))

	c = policydb.ocontexts[OCON_FSUSE];

	while (c) {

		if (strcmp(fstype, c->u.name) == 0)

			break;

		c = c->next;

	}



	/* in case we had found an fstype match but no subtype match */

	if (!c)

		c = base;



	if (c) {

		sbsec->behavior = c->v.behavior;

		if (!c->sid[0]) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE