]> git.baikalelectronics.ru Git - kernel.git/commit
selinux: allow kernfs symlinks to inherit parent directory context
authorChristian Göttsche <cgzones@googlemail.com>
Tue, 28 Jan 2020 19:16:48 +0000 (20:16 +0100)
committerPaul Moore <paul@paul-moore.com>
Mon, 10 Feb 2020 15:49:01 +0000 (10:49 -0500)
commitd595be5428d5f2e2223482189c4ce2d23bbe8be1
treed39d3d44ae8407d80d2751b83ee6680d7dc4f45c
parent30b04723051a2ca2bd2c46419b4252d5fc07e83c
selinux: allow kernfs symlinks to inherit parent directory context

Currently symlinks on kernel filesystems, like sysfs, are labeled on
creation with the parent filesystem root sid.

Allow symlinks to inherit the parent directory context, so fine-grained
kernfs labeling can be applied to symlinks too and checking contexts
doesn't complain about them.

For backward-compatibility this behavior is contained in a new policy
capability: genfs_seclabel_symlinks

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
security/selinux/hooks.c
security/selinux/include/security.h
security/selinux/ss/services.c