Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932706AbbKRAC6 (ORCPT ); Tue, 17 Nov 2015 19:02:58 -0500 Received: from tundra.namei.org ([65.99.196.166]:49906 "EHLO namei.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932070AbbKRAC4 (ORCPT ); Tue, 17 Nov 2015 19:02:56 -0500 Date: Wed, 18 Nov 2015 11:02:25 +1100 (AEDT) From: James Morris To: Seth Forshee cc: "Eric W. Biederman" , Paul Moore , Stephen Smalley , Eric Paris , Alexander Viro , Serge Hallyn , Andy Lutomirski , linux-kernel@vger.kernel.org, linux-bcache@vger.kernel.org, dm-devel@redhat.com, linux-raid@vger.kernel.org, linux-mtd@lists.infradead.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, James Morris , "Serge E. Hallyn" Subject: Re: [PATCH v3 5/7] selinux: Add support for unprivileged mounts from user namespaces In-Reply-To: <1447778351-118699-6-git-send-email-seth.forshee@canonical.com> Message-ID: References: <1447778351-118699-1-git-send-email-seth.forshee@canonical.com> <1447778351-118699-6-git-send-email-seth.forshee@canonical.com> User-Agent: Alpine 2.20 (LRH 67 2015-01-07) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 972 Lines: 27 On Tue, 17 Nov 2015, Seth Forshee wrote: > Security labels from unprivileged mounts in user namespaces must > be ignored. Force superblocks from user namespaces whose labeling > behavior is to use xattrs to use mountpoint labeling instead. > For the mountpoint label, default to converting the current task > context into a form suitable for file objects, but also allow the > policy writer to specify a different label through policy > transition rules. > > Pieced together from code snippets provided by Stephen Smalley. > > Signed-off-by: Seth Forshee > Acked-by: Stephen Smalley Acked-by: James Morris -- James Morris -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/