One purpose of the function may_context_mount_inode_relabel() is to check
if the 'associate' permission can be granted to security contexts set in
some SELinux defined mount parameters that affect the inode labeling
behavior.
For instance, the 'context' mount parameter allows to label all inodes with
the specified security context, the 'defcontext' mount parameter permits to
assign a label to inodes, in a filesystem with the 'SECURITY_FS_USE_XATTR'
labeling behavior, that do not have the getxattr() method defined or lack
the SELinux's specific extended attribute.
The 'fscontext' parameter also is involved in the inode labeling process,
specifically in case the labeling behavior is 'SECURITY_FS_USE_TRANS' and
the security_transition_sid() function returns an error or in the 'default'
case for all filesystems except 'proc'.
This patch adds the missing call of the may_context_mount_inode_relabel()
function for the security context specified with the mount parameter
'fscontext' and it should not break any existent functionality because the
required permission is already granted in the SELinux reference policy
by the following rule in the file 'policy/modules/kernel/filesystem.te':
allow filesystem_type self:filesystem associate;
Signed-off-by: Roberto Sassu <[email protected]>
---
security/selinux/hooks.c | 5 +++++
1 files changed, 5 insertions(+), 0 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 65fa8bf..9486f38 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -682,6 +682,11 @@ static int selinux_set_mnt_opts(struct super_block *sb,
if (rc)
goto out;
+ rc = may_context_mount_inode_relabel(fscontext_sid, sbsec,
+ cred);
+ if (rc)
+ goto out;
+
sbsec->sid = fscontext_sid;
}
--
1.7.3.2