Commit 7a4b5194 authored Jan 06, 2020 by Hridya Valsaraju Committed by Paul Moore Jan 06, 2020

selinux: allow per-file labelling for binderfs



This patch allows genfscon per-file labeling for binderfs.
This is required to have separate permissions to allow
access to binder, hwbinder and vndbinder devices which are
relocating to binderfs.

Acked-by: Jeff Vander Stoep <jeffv@google.com>
Acked-by: Mark Salyzyn <salyzyn@android.com>
Signed-off-by: Hridya Valsaraju <hridya@google.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>

parent 7e78c875

security/selinux/hooks.c

+1 −0

Original line number	Diff line number	Diff line
		@@ -752,6 +752,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,

		if (!strcmp(sb->s_type->name, "debugfs") \|\|
		!strcmp(sb->s_type->name, "tracefs") \|\|
		!strcmp(sb->s_type->name, "binderfs") \|\|
		!strcmp(sb->s_type->name, "pstore"))
		sbsec->flags \|= SE_SBGENFS;

Admin message