From patchwork Tue Mar 20 15:59:11 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stephen Smalley X-Patchwork-Id: 10297387 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 54E93602B3 for ; Tue, 20 Mar 2018 16:00:16 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 410E628B10 for ; Tue, 20 Mar 2018 16:00:16 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 347A529546; Tue, 20 Mar 2018 16:00:16 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.2 required=2.0 tests=BAYES_00, RCVD_IN_DNSWL_MED autolearn=ham version=3.3.1 Received: from UCOL19PA10.eemsg.mail.mil (ucol19pa10.eemsg.mail.mil [214.24.24.83]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 158A128B10 for ; Tue, 20 Mar 2018 16:00:13 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.48,336,1517875200"; d="scan'208";a="470288269" Received: from emsm-gh1-uea10.ncsc.mil ([214.29.60.2]) by UCOL19PA10.eemsg.mail.mil with ESMTP; 20 Mar 2018 16:00:10 +0000 X-IronPort-AV: E=Sophos;i="5.48,336,1517875200"; d="scan'208";a="9918396" IronPort-PHdr: =?us-ascii?q?9a23=3AG05H4RyMWC9bD1rXCy+O+j09IxM/srCxBDY+r6Qd?= =?us-ascii?q?1u8XLfad9pjvdHbS+e9qxAeQG9mDsLQc06L/iOPJYSQ4+5GPsXQPItRndiQuro?= =?us-ascii?q?EopTEmG9OPEkbhLfTnPGQQFcVGU0J5rTngaRAGUMnxaEfPrXKs8DUcBgvwNRZv?= =?us-ascii?q?JuTyB4Xek9m72/q99pHPbQhEniaxba9vJxiqsAvdsdUbj5F/Iagr0BvJpXVIe+?= =?us-ascii?q?VSxWx2IF+Yggjx6MSt8pN96ipco/0u+dJOXqX8ZKQ4UKdXDC86PGAv5c3krgfM?= =?us-ascii?q?QA2S7XYBSGoWkx5IAw/Y7BHmW5r6ryX3uvZh1CScIMb5Q6o0WTC/5Kl1ThHmhj?= =?us-ascii?q?oMOzog/G3JlsB8iaRWqw+jqRNi2Y7ZeIGbOuRwcK3eet0VR2RBUNtJVyFDH4+x?= =?us-ascii?q?YZUAD/EaMOpEs4XwvUcCoAGiCQWwAu7k1z9GhmXx3a0/y+kvDB3G0xI4H9IOrn?= =?us-ascii?q?vUqsj+OroXUe+vyKnIySvMbvNL0jr684jHbwshrOqQXbNwbcXRyU4vGxnDjlWL?= =?us-ascii?q?s4PpJTyV1uMTs2WC6edrSOGhi3Y/pg1srTWiyd0gh4nUio4P1FzJ+jt1zJwoKd?= =?us-ascii?q?C+VUV1e8SrEIFKuCGfL4Z2R8QiTHx2tysi0b0GvIK7fDANyJQ62x7Tc/yHfJaM?= =?us-ascii?q?4hLkTOuRPS13hGhkeLKinBa+61Sgy+3gWcm011ZGtCxFncXXtn8RzRDT78mHSv?= =?us-ascii?q?9l8keg3zaAyRzT5/lZLU07mqfXMZ4szqMqmpYNvknPADX6lFjugK+TbEok++yo?= =?us-ascii?q?6+r9YrXho5+RL5R0hR/6MqQvnMy/HOs5PhEVUGic5OS80qHs8lPiQLhRkv03kr?= =?us-ascii?q?XWsJDdJcgBoK65GBVa3pws6xa4ETeqyM4YkmUfLFJZZBKHiJDkO1PJIPD+F/i/?= =?us-ascii?q?n1Ssny1tx/3dPL3hBZPNLn3Zn7f6YbZy9VRcyBEpwdBY/ZJUBakLIOjvVU/pqN?= =?us-ascii?q?zYEhg5PhS2w+blEtpyyoAeWXmIAq+fMaPSr0SF5uwrI+mRa44aoyv9K/455/7z?= =?us-ascii?q?l3M5nkUdfaax15sNdH+4BuhmI1meYXf0jNYBEGMKvg8gQ+zwk1CCXyBcaGu1X6?= =?us-ascii?q?Im/D47EJimDYDBRo+znLOBwD23HppMZmBJElqMC2vnd52YW/cQbyKfOtJunSAB?= =?us-ascii?q?VbimTY8hyQyiuRTky7V5NOrU+ywZtZXl1NRv4e3ciw0y/yRuD8uBy2GNU310nm?= =?us-ascii?q?QQSjArwKBwu1Z9x0yf3qh/hvxXCcZc5+hVUgsgM57T0fB6AcjoWg3dZteJVEqm?= =?us-ascii?q?QtK+DDAxT9MxxNkObl14G9WmlxzD3iyqD6UTl7ORHpw08aPc32bvKMpnzXbJyr?= =?us-ascii?q?UhhUE8QsRTLW2mmrJ/9w/LCo7HiUWWjaCqergd3C7W72qDyHKOvEBBXA5rX6TF?= =?us-ascii?q?RmoTZkzMrdT2/knCVaOhCaw7Mgtdzs6PMqhKZcfqjVVBWffuI9febHiym2e3GB?= =?us-ascii?q?aE3LSMbJDle28FxiXSFFAEkxwP/XaBLQUxHDquo3jfDDNwD1LieFnj/vV7qH+h?= =?us-ascii?q?SU801Q6KZVV717Wp4h4VmeCcS/QL07IepSguti55HFm439PZEdaAoRRufLlEa9?= =?us-ascii?q?Mn/FhHzX7ZtxB6PpG4NKBiiEQecwNsv0PyzBh3EYNAkc8krXMv1gVyL7iU0FVf?= =?us-ascii?q?eDOExZrwIKHYKnHu/BCzbK7bwl/f38yS+qcT9vs4sU7jsRq3FkU86XVoyMRV03?= =?us-ascii?q?6G6pXNFgoSXor7Ulwr+Bhiu7Hafi496pvS1X1tNam0tiHN28kyCeQ/1BmgZdBf?= =?us-ascii?q?PLmDFA/oHM0QH9KuJ/Aym1i1chIEO/hf9LA1P8y6a/uG37SrMPx8kzKmimRH5o?= =?us-ascii?q?9931mI9yp9TO7HxYwFw/aC0guATTf8g0+rstrrloBceTESAm2/xDDgBI5Qfa1y?= =?us-ascii?q?YZ8HCXywLM2zx9V+gYPtWnFD+V64H1MG2cmpeRuOYFzmxwFQ01oYoWC/kyui0z?= =?us-ascii?q?N0iy0prraY3CHW2eTicx4HOmpVS2l4kVjsJoa1gssBXEi1cwcpjwGp5UHgx6hU?= =?us-ascii?q?vK5/NXXcQV9UfyjqKGFvSqiwuaSEY85U854osjtYUOKnYVCcVLH9vwEW0yT5H2?= =?us-ascii?q?tR3Do7bS2luo3lnxxmj2KQNG5zo2DEecF02xjf/MbTRfhN3jUYXil1kiTXBkOi?= =?us-ascii?q?MNmz5tWYjYzDsuejV2K7SpJcbyfrzYSatCu0+2JmGxu/kO6vmtf/Cwg1zTf718?= =?us-ascii?q?V2VSXPtBv8fI/r2LmhPOJ5eElnGV/859B8Go5gjos6nIsQ1mQChpWJ4XoHln/+?= =?us-ascii?q?Mc1B1qLjaHoAXiIEw9/J4AnlwUFjIGiGx4TjWnWa2MthaMGwYnkK1SIl88BKFK?= =?us-ascii?q?CU4aRKnSRvpFq4sQXRYf1mkzcT1/Qh9Xkag/sTtwo11CWdBbISEldEMizwjRiI?= =?us-ascii?q?6Mq+rKpPbma1bbewzFZ+ncymDLyapwFTQnL5epM8Ei9s8sVwKkjD3Wb16o76ZN?= =?us-ascii?q?nQds4cuQeMkxjeleRVLow+luYSjyp9JW39pWEly/I8jRF205G6ppaIJHh2/K2j?= =?us-ascii?q?BB5YKjr1Z9gI9z73kalem9ya34e1HpVuAj8LRofnTeq0EDIOsvTqLwCOECcmpX?= =?us-ascii?q?eDAbrSBgGf6EZ8r3LUD5CrOXCXJH8DwtVkWBadJVZQgAQOUDU9hJ45GRigxNb9?= =?us-ascii?q?f0dh+jAR+ln4pwNUyu12LBbwTGHfpAa0ajczU5WfLQRZ4R9c6EvPNsye9O1zFT?= =?us-ascii?q?lC/pK9tAyNNnCbZwNQAG4SQUOIAFTjPri15dnc6OiUHPG+IOXSbrmUsuxRSfOI?= =?us-ascii?q?xZOp0ot78DeBLdmAP3l4D/0mwUpPR354FN7FmzUUTCwXkTjBb8mBpBez4id3tN?= =?us-ascii?q?yw8Oz3WALz4ouCE6BdMdRg+xCxh6eOLPOfizhiJjZZzJwMw2XEyL8F3F4dkytu?= =?us-ascii?q?bSWiEawctS7RS6LdgrVYDxEBZCNtKsRF9KU83hFTNs7dj9P6zL94jvouBFdCWl?= =?us-ascii?q?3tgMapZdYFI2ulLlPIGF6LNKiaJT3M28z3faS8SbhKgOVOsB2xuCiUE0n4MTSZ?= =?us-ascii?q?kDnmSROvPPpQgyGcORxRpJuycg1xCWT5StLpdAG7OsdtjTIq2b00mm/KNWkEPD?= =?us-ascii?q?h+c0NMrqWQ7SRcgvV+B2xO8GFoLeyFmyaF9enXNIwasfxxAiR7j+ha+mg1y6NJ?= =?us-ascii?q?7CFYQ/x4gCjSr95qo164ieSPzz1nUBRAqjlVmIKLoUViOaLc9pZeQ3rE+gwC7X?= =?us-ascii?q?mIARQQu9RlEsHvu7xXytXXiq3zMC1N88jV/csHHMXUMNiIMGAgMRryAD7UCBEK?= =?us-ascii?q?QiK1Om3FgExdiv6S/GWPrpcmspjshIYOSrhDWVwzCPwVEEBlEccBIJdwRTMkja?= =?us-ascii?q?SUjMgT5Xq9rRndXsNasY7bVviKG/XgNC6ZjaVYZxsP2b74N5ocNpbl1EN4cFl1?= =?us-ascii?q?gITKFlHLUtBMuC1ucwg0oEtV8HhkUGIy21jpagWz738PDfS0hAI5ihNiYeQx8z?= =?us-ascii?q?fh+0o4Jl3MpCs2jUY+h9HlgTGKfTHrMqiwR4ZWBzDzt0grPZPxWxx1YhGqnUx4?= =?us-ascii?q?KDfEQKpcgKZ6emB1iQ/TpIBPFOVGQq1eeh8Qwv+WZ+423ltAtyWn305H5ffFCJ?= =?us-ascii?q?d4kgslb4KspWpa2w1/dN41ObDQJK1Rw1hUgaKOpDGn1uYwwQ8ZPEsN/2WSeDMS?= =?us-ascii?q?tEwPLLkmKDKi/vZw5gyahztDZG8MWuIxov108kM9OuKAzz/v0rNYNk+xMOmfIL?= =?us-ascii?q?+DtGjbic6EWFUw2V0Ul0Nd57h5zd8jc1aIV0Ao1LaRCxUJNc/FKQFJb8pT9GPe?= =?us-ascii?q?cjuPseTN2516JJ+xFub2Qu+SrKwUmF6rHB41H4QQ6cQMBoOj0EXZLcj7MrEK0R?= =?us-ascii?q?At5QTtJFWCCvRGYgmGnywGo86lyp97xIddJiwHDWV7Lyq3+q7dphU2j/qbQNc2?= =?us-ascii?q?fnAaU5MfOX0oXs23gDRWsGleDDapyOIZ0xKN7yX8pyjKCzn8ddVjbu+OZRxwEN?= =?us-ascii?q?G25Sk/86+uhF7Y75XeJmX6NdB8td/K8u4VuoiIBOhVTbZntUfQgY5YR2alU2TX?= =?us-ascii?q?C966O4Dwa5UwbdzzEnu6SFq/izMpQMfxO9atKrOIjxnxS4hJqoeWwDctONShGT?= =?us-ascii?q?EZHhd/u/sM5LlgZQEZZZo0fwLovRwkN6OjOAeYzsmuQ2G1JDtMVfZf1+K6aKdM?= =?us-ascii?q?wiowdO+10mUgQY8+z+m2904NS5UKjhDRxfaje4leXzL8GmZYewnVoyo2iXRhPP?= =?us-ascii?q?4owugj2BPIrUUcMzeTee1ncmBLo9E8BVKXIXV3EGU4RESRjYvd7QGywb8e5Sxd?= =?us-ascii?q?n8xb0eddqnjxooffYC6wWKyssZjVtjAvbcIlo6JvLYzjI82GtJzFkz3RVpbQtB?= =?us-ascii?q?GKUCq9F/pHh9dQOzhUQP9WlmE5IcYGo5ZO6VItVsciILxCELMjpqq3aTpiFyIS?= =?us-ascii?q?zjQUV4KB3DwDnuezwKHWlhGOf5Q+KBYEqolNgsMBUy5qZSMTvK6jV4PKl2CaTm?= =?us-ascii?q?gEPgIT4hpQ5AIalo59Zefl4JLWQ59Kzj5ZufN0Ui/QGZlv+Fr3UGaWgUL3SP+5?= =?us-ascii?q?ieymwRpSzO7w0tkcQBN/FU9dx+NNm0s0NL13LrIfspTMsjCWaUPwpHjtx/e+JF?= =?us-ascii?q?lN1c3UcEX1DIrfumrmSCIc/WAbSJRSx37BDZQSixR2aKI1q1VWOoymfVz+5zM8?= =?us-ascii?q?zYRzA7a4Tdyrx0oirXseRSeqFMROBvp7v13JQz1qfYqrqIn7NJpPWGNQ/oOSq0?= =?us-ascii?q?tBmkV3LyG50YZcK91K4jMUQDhAvCiSvNqoR81HwsJ5E5gMItJjtHjnA6NEJIKd?= =?us-ascii?q?o3sotbzz0nXZ4SwzsE+mxDWvHK+1V/lW/2MCFQk1JWmSt0ciAvAw/WfV91DCrk?= =?us-ascii?q?p7//xHBrSVi0V+vip9FIhUBjlVzXClM0hzTH5evuVANqvabsxcTOMuZRK0Pxw+?= =?us-ascii?q?EuAm0FKX8U5omnf2fjJ9uhFc+y/DQwk+TTMVjav1mT0CtsGnPicXS4pTbTU9dS?= =?us-ascii?q?jKNh6blDtMvBZYdkFqQYwWDchD+7EHx4tb5M7CRVyrKSEfUxxoLhg43uZHlU5f?= =?us-ascii?q?rEWYfjjQDRaydfnRrBJ4YNycrNOtLPTl5gdIkJ3nsOE/96UHWXKmhRehQdfEr4?= =?us-ascii?q?/zrteKrFeBdL/kM+2gZn/MVDrMggqqhbcjFJnK+zLcMBRAJpl/1HokZYThCW/X?= =?us-ascii?q?MhRHPa0bIVFbWbp9adVcreBQf9Vkd7oR+a9xGhKHQQviGI61o/lAIFbTXzPeID?= =?us-ascii?q?if/eGkvYLc97rdSfPnZsCWwXbIXb53NI9g6TbnA7fqzZNe+k3u1/dr8kN3UlnG?= =?us-ascii?q?MyaErNj7JwML4seidlH4sZ0yATPWGopwn2bxxkFdbcoYXTem8JMCyJNW8HzwU/?= =?us-ascii?q?530lDvsO1O8Llp8Y8347F1xsezIafdM+9avVVmAhiTAQVq7Y4tDXN6R21ebe4d?= =?us-ascii?q?MvDRfb4Wjcr2seD4C7QX6AGJ++xecdbIO1vOms2hBTGHVRxFnAABpCUBLgSA1v?= =?us-ascii?q?6Khal0SdqkpefjwE4t5UaxLgIexrB3+YiE4raIpPPQbxbJybgEQa3qS8Poo7Qi?= =?us-ascii?q?pUyd+PoklKQUdWxteQ2nF+odWdAByWf816wqyjgsE8zbFbL65PFDT245ni7nm5?= =?us-ascii?q?1lHVUWG/YUEKGO/YtAnmY3hfbZNtwQcqBNgGqPEwCrEqMaw36x9ySXOHVlgg3J?= =?us-ascii?q?0xzoQGOy7UX5ojVkTibX1NfsjFZVWaerCktIWCqpI0B4uiuVPAX0rNr3pbg17E?= =?us-ascii?q?YuP2P/tdKNj2WgN6lVH83+ONycOTM7pE8TjJAqWtOv3p0UFsSnL9cM6nF+aeHe?= =?us-ascii?q?5Hmxny9GuadHiJLU4tuJ9fXPAXmgk6qapq2VxD9C1ng3oVE/696nNvHU5N2GWu?= =?us-ascii?q?+o2HgVTyd+vQvBQhG0p6fDr18OJUyEzEfLmYINPtFD3nk0zELm6/Y5QNI16gpe?= =?us-ascii?q?EpzMZ/QYpTD8IDH020qQY8orVimC1DtaBl31HkNiGKcixGLwvNnElXPR+100WI?= =?us-ascii?q?Zwd1bohQFsD4kiL0Ii9kQXyDIZEQcRcRCbEK2oBUP9IIsLS0cDbwiH3L+9eqsw?= =?us-ascii?q?xk183Lev5O7VbexhCKsALfJdgRCUnFlbAJ0aq6seT6xge1VF7q7YuhDiC5T7X/?= =?us-ascii?q?jhjXc/Kf+1TdpG/s0Cq3Qi5QK/Rx6h6Zhd9bYblI6HebJEYZTWu8B89Uhn7yYV?= =?us-ascii?q?diNRmBh/kw+5UecEqeDm5djbtoao6umwW6s2QuUX9gI7B2JggJvsjlEjpsvX1+?= =?us-ascii?q?RHSoHPj4Tw7hxNKWaQuInGyxl8NfYOK4WzcbZv63oHPDMeK2sTM9SZbfc84ilt?= =?us-ascii?q?MCjc5lFZDcMMYMkXPMzTlgxOjU3pQr5T/NLBGlCEE4dza9wo723vxTA39ps8Uu?= =?us-ascii?q?Dg5CWqKpDf61FNIu5MjSRtlNLEv+gVwvvSBTMJ4XmYdRh62CeCxISMC/rq++WD?= =?us-ascii?q?1s3UXUscHiEqS4ddOCaC+Qu/S+q0ipXmSAWU59T3gJIjaU2QR3uxnL8fvqZLC+?= =?us-ascii?q?5AhT3x3iJCGYDtm/KVr92s5XNVtlJZHoZz4xnFFb5RP5phPxT3iNWrSlJ6BiTh?= =?us-ascii?q?ZMHebgAut/aOxucQ/+V+MFPzZYAfIhIDxbP1935VTg91Rb7tuVaZW+MRa8d8RP?= =?us-ascii?q?PCsH9V9ZpqK7UTM1iFuJzqsjBIpUgzAA8oa78wrTtae1LMnAJPWKb0v7gAhRUa?= =?us-ascii?q?UdJjv09DB36wMnok5zXbTaRVkLWRCPsN/zqIUKMOVVloPzhlQxOx35VuZ6epne?= =?us-ascii?q?5ZvWxbhC99p+Iq0zN+ThumpSLsv74N2S4n+LygrDUBvnhFQf+EkybGDlVDyPoK?= =?us-ascii?q?gLwZC3bl7ly8e2cMY5fo4LlgPsTg7ogh43IwYRk5eC0GR+ugATnqj6yUGoyPrM?= =?us-ascii?q?5chBmVtcXAc7CzKSkSNqwjxh/4Rnl90w3enBN2/2sRRjWv8sUoJIKnOcYq3iCo?= =?us-ascii?q?A3TUdE4Q4qNVt8v8rVAKTPMsaVNg3GpszNOKRigMRMzTAWY6kBIoaWJecJJM8R?= =?us-ascii?q?UaDbUngi6Uvqla+QEZeDDUEoC79YTLhcfI3WMyTcx2xmLXuqKFmokq32N7lN9u?= =?us-ascii?q?6C6BpmgSffTCU8BwGnjzyptfyevmavWps+AHTpZmybu4XP8GM8mj4ne22I5xV0?= =?us-ascii?q?+k3LseGV25PPUExrfBXCevUXeYVviTc2iQgzY5NVb/5RyyIVIraMdKrkk9MuzZ?= =?us-ascii?q?i55Clg3hV617RiGRpV/d0WwiPvkWdwUsuIeoYwYKVvIeZ/CAJegyx/0zEFkMYG?= =?us-ascii?q?XKHStxEOC7qkOtnI5nO3Vg5kX6fOvt8gD6MNeIHBkLD5LapIZr+fOmXmKBJWNg?= =?us-ascii?q?zBpqMUlv+effEkg+u+5ffpuKg9jfmc570e8EdvdqNy0xoNgTlZx/6drc7MDfah?= =?us-ascii?q?zVz5DvNfnJs/OYBLvZ1E1sdWZEAZQDZgag3Jk3Jt40XfXoGLJduRkNTfwhTIcJ?= =?us-ascii?q?K3b69KYyKhh6NAHWeuLn0YHRuuuXa84M9Dft5VUqIXKZ4UUO?= X-IPAS-Result: =?us-ascii?q?A2D3AADBLrFa/wHyM5BeGQEBAQEBAQEBAQEBAQcBAQEBAYM?= =?us-ascii?q?jLYFYFRONeHKNDYMZlAeCDyaISCE0GAECAQEBAQEBAgFqKII4JIJKAwMBAhcBD?= =?us-ascii?q?FIDAwkBAUgIAwFTGQWCY1uBSg2rLjqEboNsgg6FN4IVgymIEIV/A4c/B4R1gS6?= =?us-ascii?q?KVAmPKw+NNpFkHjiBUisIAhgIIQ+CfYIyG446WJBrAQEB?= Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by EMSM-GH1-UEA10.NCSC.MIL with ESMTP; 20 Mar 2018 16:00:09 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w2KG07Ar011964; Tue, 20 Mar 2018 12:00:08 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id w2KFvrED129697 for ; Tue, 20 Mar 2018 11:57:53 -0400 Received: from moss-pluto.infosec.tycho.ncsc.mil (moss-pluto [192.168.25.131]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id w2KFvsHg010209; Tue, 20 Mar 2018 11:57:56 -0400 From: Stephen Smalley To: selinux@tycho.nsa.gov Date: Tue, 20 Mar 2018 11:59:11 -0400 Message-Id: <20180320155911.7271-2-sds@tycho.nsa.gov> X-Mailer: git-send-email 2.14.3 In-Reply-To: <20180320155911.7271-1-sds@tycho.nsa.gov> References: <20180320155911.7271-1-sds@tycho.nsa.gov> Subject: [PATCH 2/2] selinux: wrap selinuxfs state X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.21 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: Stephen Smalley , peter.enderborg@sony.com Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP Move global selinuxfs state to a per-instance structure (selinux_fs_info), and include a pointer to the selinux_state in this structure. Pass this selinux_state to all security server operations, thereby ensuring that each selinuxfs instance presents a view of and acts as an interface to a particular selinux_state instance. This change should have no effect on SELinux behavior or APIs (userspace or LSM). It merely wraps the selinuxfs global state, links it to a particular selinux_state (currently always the single global selinux_state) and uses that state for all operations. Signed-off-by: Stephen Smalley --- security/selinux/selinuxfs.c | 438 ++++++++++++++++++++++++++----------------- 1 file changed, 261 insertions(+), 177 deletions(-) diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index 0dbd5fd6a396..41099cc3d5e2 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -19,6 +19,7 @@ #include #include #include +#include #include #include #include @@ -41,23 +42,6 @@ #include "objsec.h" #include "conditional.h" -static DEFINE_MUTEX(sel_mutex); - -/* global data for booleans */ -static struct dentry *bool_dir; -static int bool_num; -static char **bool_pending_names; -static int *bool_pending_values; - -/* global data for classes */ -static struct dentry *class_dir; -static unsigned long last_class_ino; - -static char policy_opened; - -/* global data for policy capabilities */ -static struct dentry *policycap_dir; - enum sel_inos { SEL_ROOT_INO = 2, SEL_LOAD, /* load policy */ @@ -82,7 +66,51 @@ enum sel_inos { SEL_INO_NEXT, /* The next inode number to use */ }; -static unsigned long sel_last_ino = SEL_INO_NEXT - 1; +struct selinux_fs_info { + struct dentry *bool_dir; + unsigned int bool_num; + char **bool_pending_names; + unsigned int *bool_pending_values; + struct dentry *class_dir; + unsigned long last_class_ino; + bool policy_opened; + struct dentry *policycap_dir; + struct mutex mutex; + unsigned long last_ino; + struct selinux_state *state; + struct super_block *sb; +}; + +static int selinux_fs_info_create(struct super_block *sb) +{ + struct selinux_fs_info *fsi; + + fsi = kzalloc(sizeof(*fsi), GFP_KERNEL); + if (!fsi) + return -ENOMEM; + + mutex_init(&fsi->mutex); + fsi->last_ino = SEL_INO_NEXT - 1; + fsi->state = &selinux_state; + fsi->sb = sb; + sb->s_fs_info = fsi; + return 0; +} + +static void selinux_fs_info_free(struct super_block *sb) +{ + struct selinux_fs_info *fsi = sb->s_fs_info; + int i; + + if (fsi) { + for (i = 0; i < fsi->bool_num; i++) + kfree(fsi->bool_pending_names[i]); + kfree(fsi->bool_pending_names); + kfree(fsi->bool_pending_values); + } + kfree(sb->s_fs_info); + sb->s_fs_info = NULL; +} #define SEL_INITCON_INO_OFFSET 0x01000000 #define SEL_BOOL_INO_OFFSET 0x02000000 @@ -94,11 +122,12 @@ static unsigned long sel_last_ino = SEL_INO_NEXT - 1; static ssize_t sel_read_enforce(struct file *filp, char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info; char tmpbuf[TMPBUFLEN]; ssize_t length; length = scnprintf(tmpbuf, TMPBUFLEN, "%d", - enforcing_enabled(&selinux_state)); + enforcing_enabled(fsi->state)); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); } @@ -107,6 +136,8 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; + struct selinux_state *state = fsi->state; char *page = NULL; ssize_t length; int old_value, new_value; @@ -128,8 +159,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf, new_value = !!new_value; - old_value = enforcing_enabled(&selinux_state); - + old_value = enforcing_enabled(state); if (new_value != old_value) { length = avc_has_perm(current_sid(), SECINITSID_SECURITY, SECCLASS_SECURITY, SECURITY__SETENFORCE, @@ -141,12 +171,11 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf, new_value, old_value, from_kuid(&init_user_ns, audit_get_loginuid(current)), audit_get_sessionid(current)); - enforcing_set(&selinux_state, new_value); + enforcing_set(state, new_value); if (new_value) avc_ss_reset(0); selnl_notify_setenforce(new_value); - selinux_status_update_setenforce(&selinux_state, - new_value); + selinux_status_update_setenforce(state, new_value); if (!new_value) call_lsm_notifier(LSM_POLICY_CHANGE, NULL); } @@ -168,12 +197,14 @@ static const struct file_operations sel_enforce_ops = { static ssize_t sel_read_handle_unknown(struct file *filp, char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info; + struct selinux_state *state = fsi->state; char tmpbuf[TMPBUFLEN]; ssize_t length; ino_t ino = file_inode(filp)->i_ino; int handle_unknown = (ino == SEL_REJECT_UNKNOWN) ? - security_get_reject_unknown(&selinux_state) : - !security_get_allow_unknown(&selinux_state); + security_get_reject_unknown(state) : + !security_get_allow_unknown(state); length = scnprintf(tmpbuf, TMPBUFLEN, "%d", handle_unknown); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); @@ -186,7 +217,8 @@ static const struct file_operations sel_handle_unknown_ops = { static int sel_open_handle_status(struct inode *inode, struct file *filp) { - struct page *status = selinux_kernel_status_page(&selinux_state); + struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info; + struct page *status = selinux_kernel_status_page(fsi->state); if (!status) return -ENOMEM; @@ -242,6 +274,7 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; char *page; ssize_t length; int new_value; @@ -262,7 +295,7 @@ static ssize_t sel_write_disable(struct file *file, const char __user *buf, goto out; if (new_value) { - length = selinux_disable(&selinux_state); + length = selinux_disable(fsi->state); if (length) goto out; audit_log(current->audit_context, GFP_KERNEL, AUDIT_MAC_STATUS, @@ -301,9 +334,9 @@ static const struct file_operations sel_policyvers_ops = { }; /* declaration for sel_write_load */ -static int sel_make_bools(void); -static int sel_make_classes(void); -static int sel_make_policycap(void); +static int sel_make_bools(struct selinux_fs_info *fsi); +static int sel_make_classes(struct selinux_fs_info *fsi); +static int sel_make_policycap(struct selinux_fs_info *fsi); /* declaration for sel_make_class_dirs */ static struct dentry *sel_make_dir(struct dentry *dir, const char *name, @@ -312,11 +345,12 @@ static struct dentry *sel_make_dir(struct dentry *dir, const char *name, static ssize_t sel_read_mls(struct file *filp, char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info; char tmpbuf[TMPBUFLEN]; ssize_t length; length = scnprintf(tmpbuf, TMPBUFLEN, "%d", - security_mls_enabled(&selinux_state)); + security_mls_enabled(fsi->state)); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); } @@ -332,12 +366,14 @@ struct policy_load_memory { static int sel_open_policy(struct inode *inode, struct file *filp) { + struct selinux_fs_info *fsi = inode->i_sb->s_fs_info; + struct selinux_state *state = fsi->state; struct policy_load_memory *plm = NULL; int rc; BUG_ON(filp->private_data); - mutex_lock(&sel_mutex); + mutex_lock(&fsi->mutex); rc = avc_has_perm(current_sid(), SECINITSID_SECURITY, SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL); @@ -345,7 +381,7 @@ static int sel_open_policy(struct inode *inode, struct file *filp) goto err; rc = -EBUSY; - if (policy_opened) + if (fsi->policy_opened) goto err; rc = -ENOMEM; @@ -353,25 +389,25 @@ static int sel_open_policy(struct inode *inode, struct file *filp) if (!plm) goto err; - if (i_size_read(inode) != security_policydb_len(&selinux_state)) { + if (i_size_read(inode) != security_policydb_len(state)) { inode_lock(inode); - i_size_write(inode, security_policydb_len(&selinux_state)); + i_size_write(inode, security_policydb_len(state)); inode_unlock(inode); } - rc = security_read_policy(&selinux_state, &plm->data, &plm->len); + rc = security_read_policy(state, &plm->data, &plm->len); if (rc) goto err; - policy_opened = 1; + fsi->policy_opened = 1; filp->private_data = plm; - mutex_unlock(&sel_mutex); + mutex_unlock(&fsi->mutex); return 0; err: - mutex_unlock(&sel_mutex); + mutex_unlock(&fsi->mutex); if (plm) vfree(plm->data); @@ -381,11 +417,12 @@ static int sel_open_policy(struct inode *inode, struct file *filp) static int sel_release_policy(struct inode *inode, struct file *filp) { + struct selinux_fs_info *fsi = inode->i_sb->s_fs_info; struct policy_load_memory *plm = filp->private_data; BUG_ON(!plm); - policy_opened = 0; + fsi->policy_opened = 0; vfree(plm->data); kfree(plm); @@ -396,10 +433,11 @@ static int sel_release_policy(struct inode *inode, struct file *filp) static ssize_t sel_read_policy(struct file *filp, char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info; struct policy_load_memory *plm = filp->private_data; int ret; - mutex_lock(&sel_mutex); + mutex_lock(&fsi->mutex); ret = avc_has_perm(current_sid(), SECINITSID_SECURITY, SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL); @@ -408,7 +446,7 @@ static ssize_t sel_read_policy(struct file *filp, char __user *buf, ret = simple_read_from_buffer(buf, count, ppos, plm->data, plm->len); out: - mutex_unlock(&sel_mutex); + mutex_unlock(&fsi->mutex); return ret; } @@ -462,14 +500,40 @@ static const struct file_operations sel_policy_ops = { .llseek = generic_file_llseek, }; +static int sel_make_policy_nodes(struct selinux_fs_info *fsi) +{ + int ret; + + ret = sel_make_bools(fsi); + if (ret) { + pr_err("SELinux: failed to load policy booleans\n"); + return ret; + } + + ret = sel_make_classes(fsi); + if (ret) { + pr_err("SELinux: failed to load policy classes\n"); + return ret; + } + + ret = sel_make_policycap(fsi); + if (ret) { + pr_err("SELinux: failed to load policy capabilities\n"); + return ret; + } + + return 0; +} + static ssize_t sel_write_load(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; ssize_t length; void *data = NULL; - mutex_lock(&sel_mutex); + mutex_lock(&fsi->mutex); length = avc_has_perm(current_sid(), SECINITSID_SECURITY, SECCLASS_SECURITY, SECURITY__LOAD_POLICY, NULL); @@ -494,29 +558,15 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, if (copy_from_user(data, buf, count) != 0) goto out; - length = security_load_policy(&selinux_state, data, count); + length = security_load_policy(fsi->state, data, count); if (length) { pr_warn_ratelimited("SELinux: failed to load policy\n"); goto out; } - length = sel_make_bools(); - if (length) { - pr_err("SELinux: failed to load policy booleans\n"); - goto out1; - } - - length = sel_make_classes(); - if (length) { - pr_err("SELinux: failed to load policy classes\n"); - goto out1; - } - - length = sel_make_policycap(); - if (length) { - pr_err("SELinux: failed to load policy capabilities\n"); + length = sel_make_policy_nodes(fsi); + if (length) goto out1; - } length = count; @@ -526,7 +576,7 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, from_kuid(&init_user_ns, audit_get_loginuid(current)), audit_get_sessionid(current)); out: - mutex_unlock(&sel_mutex); + mutex_unlock(&fsi->mutex); vfree(data); return length; } @@ -538,6 +588,8 @@ static const struct file_operations sel_load_ops = { static ssize_t sel_write_context(struct file *file, char *buf, size_t size) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; + struct selinux_state *state = fsi->state; char *canon = NULL; u32 sid, len; ssize_t length; @@ -547,12 +599,11 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size) if (length) goto out; - length = security_context_to_sid(&selinux_state, buf, size, - &sid, GFP_KERNEL); + length = security_context_to_sid(state, buf, size, &sid, GFP_KERNEL); if (length) goto out; - length = security_sid_to_context(&selinux_state, sid, &canon, &len); + length = security_sid_to_context(state, sid, &canon, &len); if (length) goto out; @@ -573,16 +624,18 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size) static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info; char tmpbuf[TMPBUFLEN]; ssize_t length; - length = scnprintf(tmpbuf, TMPBUFLEN, "%u", selinux_state.checkreqprot); + length = scnprintf(tmpbuf, TMPBUFLEN, "%u", fsi->state->checkreqprot); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); } static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; char *page; ssize_t length; unsigned int new_value; @@ -608,7 +661,7 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf, if (sscanf(page, "%u", &new_value) != 1) goto out; - selinux_state.checkreqprot = new_value ? 1 : 0; + fsi->state->checkreqprot = new_value ? 1 : 0; length = count; out: kfree(page); @@ -624,6 +677,8 @@ static ssize_t sel_write_validatetrans(struct file *file, const char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; + struct selinux_state *state = fsi->state; char *oldcon = NULL, *newcon = NULL, *taskcon = NULL; char *req = NULL; u32 osid, nsid, tsid; @@ -668,23 +723,19 @@ static ssize_t sel_write_validatetrans(struct file *file, if (sscanf(req, "%s %s %hu %s", oldcon, newcon, &tclass, taskcon) != 4) goto out; - rc = security_context_str_to_sid(&selinux_state, oldcon, &osid, - GFP_KERNEL); + rc = security_context_str_to_sid(state, oldcon, &osid, GFP_KERNEL); if (rc) goto out; - rc = security_context_str_to_sid(&selinux_state, newcon, &nsid, - GFP_KERNEL); + rc = security_context_str_to_sid(state, newcon, &nsid, GFP_KERNEL); if (rc) goto out; - rc = security_context_str_to_sid(&selinux_state, taskcon, &tsid, - GFP_KERNEL); + rc = security_context_str_to_sid(state, taskcon, &tsid, GFP_KERNEL); if (rc) goto out; - rc = security_validate_transition_user(&selinux_state, osid, nsid, - tsid, tclass); + rc = security_validate_transition_user(state, osid, nsid, tsid, tclass); if (!rc) rc = count; out: @@ -754,6 +805,8 @@ static const struct file_operations transaction_ops = { static ssize_t sel_write_access(struct file *file, char *buf, size_t size) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; + struct selinux_state *state = fsi->state; char *scon = NULL, *tcon = NULL; u32 ssid, tsid; u16 tclass; @@ -779,17 +832,15 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size) if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) goto out; - length = security_context_str_to_sid(&selinux_state, scon, &ssid, - GFP_KERNEL); + length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL); if (length) goto out; - length = security_context_str_to_sid(&selinux_state, tcon, &tsid, - GFP_KERNEL); + length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL); if (length) goto out; - security_compute_av_user(&selinux_state, ssid, tsid, tclass, &avd); + security_compute_av_user(state, ssid, tsid, tclass, &avd); length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT, "%x %x %x %x %u %x", @@ -804,6 +855,8 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size) static ssize_t sel_write_create(struct file *file, char *buf, size_t size) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; + struct selinux_state *state = fsi->state; char *scon = NULL, *tcon = NULL; char *namebuf = NULL, *objname = NULL; u32 ssid, tsid, newsid; @@ -869,23 +922,20 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size) objname = namebuf; } - length = security_context_str_to_sid(&selinux_state, scon, &ssid, - GFP_KERNEL); + length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL); if (length) goto out; - length = security_context_str_to_sid(&selinux_state, tcon, &tsid, - GFP_KERNEL); + length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL); if (length) goto out; - length = security_transition_sid_user(&selinux_state, ssid, tsid, - tclass, objname, &newsid); + length = security_transition_sid_user(state, ssid, tsid, tclass, + objname, &newsid); if (length) goto out; - length = security_sid_to_context(&selinux_state, newsid, &newcon, - &len); + length = security_sid_to_context(state, newsid, &newcon, &len); if (length) goto out; @@ -908,6 +958,8 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size) static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; + struct selinux_state *state = fsi->state; char *scon = NULL, *tcon = NULL; u32 ssid, tsid, newsid; u16 tclass; @@ -935,23 +987,19 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size) if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) goto out; - length = security_context_str_to_sid(&selinux_state, scon, &ssid, - GFP_KERNEL); + length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL); if (length) goto out; - length = security_context_str_to_sid(&selinux_state, tcon, &tsid, - GFP_KERNEL); + length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL); if (length) goto out; - length = security_change_sid(&selinux_state, ssid, tsid, tclass, - &newsid); + length = security_change_sid(state, ssid, tsid, tclass, &newsid); if (length) goto out; - length = security_sid_to_context(&selinux_state, newsid, &newcon, - &len); + length = security_sid_to_context(state, newsid, &newcon, &len); if (length) goto out; @@ -970,6 +1018,8 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size) static ssize_t sel_write_user(struct file *file, char *buf, size_t size) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; + struct selinux_state *state = fsi->state; char *con = NULL, *user = NULL, *ptr; u32 sid, *sids = NULL; ssize_t length; @@ -997,21 +1047,18 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size) if (sscanf(buf, "%s %s", con, user) != 2) goto out; - length = security_context_str_to_sid(&selinux_state, con, &sid, - GFP_KERNEL); + length = security_context_str_to_sid(state, con, &sid, GFP_KERNEL); if (length) goto out; - length = security_get_user_sids(&selinux_state, sid, user, &sids, - &nsids); + length = security_get_user_sids(state, sid, user, &sids, &nsids); if (length) goto out; length = sprintf(buf, "%u", nsids) + 1; ptr = buf + length; for (i = 0; i < nsids; i++) { - rc = security_sid_to_context(&selinux_state, sids[i], - &newcon, &len); + rc = security_sid_to_context(state, sids[i], &newcon, &len); if (rc) { length = rc; goto out; @@ -1035,6 +1082,8 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size) static ssize_t sel_write_member(struct file *file, char *buf, size_t size) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; + struct selinux_state *state = fsi->state; char *scon = NULL, *tcon = NULL; u32 ssid, tsid, newsid; u16 tclass; @@ -1062,23 +1111,19 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size) if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3) goto out; - length = security_context_str_to_sid(&selinux_state, scon, &ssid, - GFP_KERNEL); + length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL); if (length) goto out; - length = security_context_str_to_sid(&selinux_state, tcon, &tsid, - GFP_KERNEL); + length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL); if (length) goto out; - length = security_member_sid(&selinux_state, ssid, tsid, tclass, - &newsid); + length = security_member_sid(state, ssid, tsid, tclass, &newsid); if (length) goto out; - length = security_sid_to_context(&selinux_state, newsid, &newcon, - &len); + length = security_sid_to_context(state, newsid, &newcon, &len); if (length) goto out; @@ -1112,6 +1157,7 @@ static struct inode *sel_make_inode(struct super_block *sb, int mode) static ssize_t sel_read_bool(struct file *filep, char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info; char *page = NULL; ssize_t length; ssize_t ret; @@ -1119,10 +1165,11 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf, unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK; const char *name = filep->f_path.dentry->d_name.name; - mutex_lock(&sel_mutex); + mutex_lock(&fsi->mutex); ret = -EINVAL; - if (index >= bool_num || strcmp(name, bool_pending_names[index])) + if (index >= fsi->bool_num || strcmp(name, + fsi->bool_pending_names[index])) goto out; ret = -ENOMEM; @@ -1130,16 +1177,16 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf, if (!page) goto out; - cur_enforcing = security_get_bool_value(&selinux_state, index); + cur_enforcing = security_get_bool_value(fsi->state, index); if (cur_enforcing < 0) { ret = cur_enforcing; goto out; } length = scnprintf(page, PAGE_SIZE, "%d %d", cur_enforcing, - bool_pending_values[index]); + fsi->bool_pending_values[index]); ret = simple_read_from_buffer(buf, count, ppos, page, length); out: - mutex_unlock(&sel_mutex); + mutex_unlock(&fsi->mutex); free_page((unsigned long)page); return ret; } @@ -1147,13 +1194,14 @@ static ssize_t sel_read_bool(struct file *filep, char __user *buf, static ssize_t sel_write_bool(struct file *filep, const char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info; char *page = NULL; ssize_t length; int new_value; unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK; const char *name = filep->f_path.dentry->d_name.name; - mutex_lock(&sel_mutex); + mutex_lock(&fsi->mutex); length = avc_has_perm(current_sid(), SECINITSID_SECURITY, SECCLASS_SECURITY, SECURITY__SETBOOL, @@ -1162,7 +1210,8 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf, goto out; length = -EINVAL; - if (index >= bool_num || strcmp(name, bool_pending_names[index])) + if (index >= fsi->bool_num || strcmp(name, + fsi->bool_pending_names[index])) goto out; length = -ENOMEM; @@ -1188,11 +1237,11 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf, if (new_value) new_value = 1; - bool_pending_values[index] = new_value; + fsi->bool_pending_values[index] = new_value; length = count; out: - mutex_unlock(&sel_mutex); + mutex_unlock(&fsi->mutex); kfree(page); return length; } @@ -1207,11 +1256,12 @@ static ssize_t sel_commit_bools_write(struct file *filep, const char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info; char *page = NULL; ssize_t length; int new_value; - mutex_lock(&sel_mutex); + mutex_lock(&fsi->mutex); length = avc_has_perm(current_sid(), SECINITSID_SECURITY, SECCLASS_SECURITY, SECURITY__SETBOOL, @@ -1240,15 +1290,15 @@ static ssize_t sel_commit_bools_write(struct file *filep, goto out; length = 0; - if (new_value && bool_pending_values) - length = security_set_bools(&selinux_state, bool_num, - bool_pending_values); + if (new_value && fsi->bool_pending_values) + length = security_set_bools(fsi->state, fsi->bool_num, + fsi->bool_pending_values); if (!length) length = count; out: - mutex_unlock(&sel_mutex); + mutex_unlock(&fsi->mutex); kfree(page); return length; } @@ -1266,12 +1316,12 @@ static void sel_remove_entries(struct dentry *de) #define BOOL_DIR_NAME "booleans" -static int sel_make_bools(void) +static int sel_make_bools(struct selinux_fs_info *fsi) { int i, ret; ssize_t len; struct dentry *dentry = NULL; - struct dentry *dir = bool_dir; + struct dentry *dir = fsi->bool_dir; struct inode *inode = NULL; struct inode_security_struct *isec; char **names = NULL, *page; @@ -1280,13 +1330,13 @@ static int sel_make_bools(void) u32 sid; /* remove any existing files */ - for (i = 0; i < bool_num; i++) - kfree(bool_pending_names[i]); - kfree(bool_pending_names); - kfree(bool_pending_values); - bool_num = 0; - bool_pending_names = NULL; - bool_pending_values = NULL; + for (i = 0; i < fsi->bool_num; i++) + kfree(fsi->bool_pending_names[i]); + kfree(fsi->bool_pending_names); + kfree(fsi->bool_pending_values); + fsi->bool_num = 0; + fsi->bool_pending_names = NULL; + fsi->bool_pending_values = NULL; sel_remove_entries(dir); @@ -1295,7 +1345,7 @@ static int sel_make_bools(void) if (!page) goto out; - ret = security_get_bools(&selinux_state, &num, &names, &values); + ret = security_get_bools(fsi->state, &num, &names, &values); if (ret) goto out; @@ -1316,7 +1366,7 @@ static int sel_make_bools(void) goto out; isec = (struct inode_security_struct *)inode->i_security; - ret = security_genfs_sid(&selinux_state, "selinuxfs", page, + ret = security_genfs_sid(fsi->state, "selinuxfs", page, SECCLASS_FILE, &sid); if (ret) { pr_warn_ratelimited("SELinux: no sid found, defaulting to security isid for %s\n", @@ -1330,9 +1380,9 @@ static int sel_make_bools(void) inode->i_ino = i|SEL_BOOL_INO_OFFSET; d_add(dentry, inode); } - bool_num = num; - bool_pending_names = names; - bool_pending_values = values; + fsi->bool_num = num; + fsi->bool_pending_names = names; + fsi->bool_pending_values = values; free_page((unsigned long)page); return 0; @@ -1350,10 +1400,6 @@ static int sel_make_bools(void) return ret; } -#define NULL_FILE_NAME "null" - -struct path selinux_null; - static ssize_t sel_read_avc_cache_threshold(struct file *filp, char __user *buf, size_t count, loff_t *ppos) { @@ -1503,6 +1549,8 @@ static const struct file_operations sel_avc_cache_stats_ops = { static int sel_make_avc_files(struct dentry *dir) { + struct super_block *sb = dir->d_sb; + struct selinux_fs_info *fsi = sb->s_fs_info; int i; static const struct tree_descr files[] = { { "cache_threshold", @@ -1526,7 +1574,7 @@ static int sel_make_avc_files(struct dentry *dir) return -ENOMEM; inode->i_fop = files[i].ops; - inode->i_ino = ++sel_last_ino; + inode->i_ino = ++fsi->last_ino; d_add(dentry, inode); } @@ -1536,12 +1584,13 @@ static int sel_make_avc_files(struct dentry *dir) static ssize_t sel_read_initcon(struct file *file, char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; char *con; u32 sid, len; ssize_t ret; sid = file_inode(file)->i_ino&SEL_INO_MASK; - ret = security_sid_to_context(&selinux_state, sid, &con, &len); + ret = security_sid_to_context(fsi->state, sid, &con, &len); if (ret) return ret; @@ -1629,13 +1678,13 @@ static const struct file_operations sel_perm_ops = { static ssize_t sel_read_policycap(struct file *file, char __user *buf, size_t count, loff_t *ppos) { + struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info; int value; char tmpbuf[TMPBUFLEN]; ssize_t length; unsigned long i_ino = file_inode(file)->i_ino; - value = security_policycap_supported(&selinux_state, - i_ino & SEL_INO_MASK); + value = security_policycap_supported(fsi->state, i_ino & SEL_INO_MASK); length = scnprintf(tmpbuf, TMPBUFLEN, "%d", value); return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); @@ -1649,11 +1698,11 @@ static const struct file_operations sel_policycap_ops = { static int sel_make_perm_files(char *objclass, int classvalue, struct dentry *dir) { + struct selinux_fs_info *fsi = dir->d_sb->s_fs_info; int i, rc, nperms; char **perms; - rc = security_get_permissions(&selinux_state, objclass, &perms, - &nperms); + rc = security_get_permissions(fsi->state, objclass, &perms, &nperms); if (rc) return rc; @@ -1687,6 +1736,8 @@ static int sel_make_perm_files(char *objclass, int classvalue, static int sel_make_class_dir_entries(char *classname, int index, struct dentry *dir) { + struct super_block *sb = dir->d_sb; + struct selinux_fs_info *fsi = sb->s_fs_info; struct dentry *dentry = NULL; struct inode *inode = NULL; int rc; @@ -1703,7 +1754,7 @@ static int sel_make_class_dir_entries(char *classname, int index, inode->i_ino = sel_class_to_ino(index); d_add(dentry, inode); - dentry = sel_make_dir(dir, "perms", &last_class_ino); + dentry = sel_make_dir(dir, "perms", &fsi->last_class_ino); if (IS_ERR(dentry)) return PTR_ERR(dentry); @@ -1712,26 +1763,27 @@ static int sel_make_class_dir_entries(char *classname, int index, return rc; } -static int sel_make_classes(void) +static int sel_make_classes(struct selinux_fs_info *fsi) { + int rc, nclasses, i; char **classes; /* delete any existing entries */ - sel_remove_entries(class_dir); + sel_remove_entries(fsi->class_dir); - rc = security_get_classes(&selinux_state, &classes, &nclasses); + rc = security_get_classes(fsi->state, &classes, &nclasses); if (rc) return rc; /* +2 since classes are 1-indexed */ - last_class_ino = sel_class_to_ino(nclasses + 2); + fsi->last_class_ino = sel_class_to_ino(nclasses + 2); for (i = 0; i < nclasses; i++) { struct dentry *class_name_dir; - class_name_dir = sel_make_dir(class_dir, classes[i], - &last_class_ino); + class_name_dir = sel_make_dir(fsi->class_dir, classes[i], + &fsi->last_class_ino); if (IS_ERR(class_name_dir)) { rc = PTR_ERR(class_name_dir); goto out; @@ -1751,25 +1803,25 @@ static int sel_make_classes(void) return rc; } -static int sel_make_policycap(void) +static int sel_make_policycap(struct selinux_fs_info *fsi) { unsigned int iter; struct dentry *dentry = NULL; struct inode *inode = NULL; - sel_remove_entries(policycap_dir); + sel_remove_entries(fsi->policycap_dir); for (iter = 0; iter <= POLICYDB_CAPABILITY_MAX; iter++) { if (iter < ARRAY_SIZE(selinux_policycap_names)) - dentry = d_alloc_name(policycap_dir, + dentry = d_alloc_name(fsi->policycap_dir, selinux_policycap_names[iter]); else - dentry = d_alloc_name(policycap_dir, "unknown"); + dentry = d_alloc_name(fsi->policycap_dir, "unknown"); if (dentry == NULL) return -ENOMEM; - inode = sel_make_inode(policycap_dir->d_sb, S_IFREG | S_IRUGO); + inode = sel_make_inode(fsi->sb, S_IFREG | 0444); if (inode == NULL) return -ENOMEM; @@ -1808,8 +1860,11 @@ static struct dentry *sel_make_dir(struct dentry *dir, const char *name, return dentry; } +#define NULL_FILE_NAME "null" + static int sel_fill_super(struct super_block *sb, void *data, int silent) { + struct selinux_fs_info *fsi; int ret; struct dentry *dentry; struct inode *inode; @@ -1837,14 +1892,20 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent) S_IWUGO}, /* last one */ {""} }; + + ret = selinux_fs_info_create(sb); + if (ret) + goto err; + ret = simple_fill_super(sb, SELINUX_MAGIC, selinux_files); if (ret) goto err; - bool_dir = sel_make_dir(sb->s_root, BOOL_DIR_NAME, &sel_last_ino); - if (IS_ERR(bool_dir)) { - ret = PTR_ERR(bool_dir); - bool_dir = NULL; + fsi = sb->s_fs_info; + fsi->bool_dir = sel_make_dir(sb->s_root, BOOL_DIR_NAME, &fsi->last_ino); + if (IS_ERR(fsi->bool_dir)) { + ret = PTR_ERR(fsi->bool_dir); + fsi->bool_dir = NULL; goto err; } @@ -1858,7 +1919,7 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent) if (!inode) goto err; - inode->i_ino = ++sel_last_ino; + inode->i_ino = ++fsi->last_ino; isec = (struct inode_security_struct *)inode->i_security; isec->sid = SECINITSID_DEVNULL; isec->sclass = SECCLASS_CHR_FILE; @@ -1866,9 +1927,8 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent) init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO, MKDEV(MEM_MAJOR, 3)); d_add(dentry, inode); - selinux_null.dentry = dentry; - dentry = sel_make_dir(sb->s_root, "avc", &sel_last_ino); + dentry = sel_make_dir(sb->s_root, "avc", &fsi->last_ino); if (IS_ERR(dentry)) { ret = PTR_ERR(dentry); goto err; @@ -1878,7 +1938,7 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent) if (ret) goto err; - dentry = sel_make_dir(sb->s_root, "initial_contexts", &sel_last_ino); + dentry = sel_make_dir(sb->s_root, "initial_contexts", &fsi->last_ino); if (IS_ERR(dentry)) { ret = PTR_ERR(dentry); goto err; @@ -1888,23 +1948,31 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent) if (ret) goto err; - class_dir = sel_make_dir(sb->s_root, "class", &sel_last_ino); - if (IS_ERR(class_dir)) { - ret = PTR_ERR(class_dir); - class_dir = NULL; + fsi->class_dir = sel_make_dir(sb->s_root, "class", &fsi->last_ino); + if (IS_ERR(fsi->class_dir)) { + ret = PTR_ERR(fsi->class_dir); + fsi->class_dir = NULL; goto err; } - policycap_dir = sel_make_dir(sb->s_root, "policy_capabilities", &sel_last_ino); - if (IS_ERR(policycap_dir)) { - ret = PTR_ERR(policycap_dir); - policycap_dir = NULL; + fsi->policycap_dir = sel_make_dir(sb->s_root, "policy_capabilities", + &fsi->last_ino); + if (IS_ERR(fsi->policycap_dir)) { + ret = PTR_ERR(fsi->policycap_dir); + fsi->policycap_dir = NULL; goto err; } + + ret = sel_make_policy_nodes(fsi); + if (ret) + goto err; return 0; err: printk(KERN_ERR "SELinux: %s: failed while creating inodes\n", __func__); + + selinux_fs_info_free(sb); + return ret; } @@ -1914,16 +1982,25 @@ static struct dentry *sel_mount(struct file_system_type *fs_type, return mount_single(fs_type, flags, data, sel_fill_super); } +static void sel_kill_sb(struct super_block *sb) +{ + selinux_fs_info_free(sb); + kill_litter_super(sb); +} + static struct file_system_type sel_fs_type = { .name = "selinuxfs", .mount = sel_mount, - .kill_sb = kill_litter_super, + .kill_sb = sel_kill_sb, }; struct vfsmount *selinuxfs_mount; +struct path selinux_null; static int __init init_sel_fs(void) { + struct qstr null_name = QSTR_INIT(NULL_FILE_NAME, + sizeof(NULL_FILE_NAME)-1); int err; if (!selinux_enabled) @@ -1945,6 +2022,13 @@ static int __init init_sel_fs(void) err = PTR_ERR(selinuxfs_mount); selinuxfs_mount = NULL; } + selinux_null.dentry = d_hash_and_lookup(selinux_null.mnt->mnt_root, + &null_name); + if (IS_ERR(selinux_null.dentry)) { + pr_err("selinuxfs: could not lookup null!\n"); + err = PTR_ERR(selinux_null.dentry); + selinux_null.dentry = NULL; + } return err; }