[PATCH v3 14/15] selinux: allow setxattr on rootfs so initramfs code can set them

[Stephen Smalley]

On Fri, 2018-02-16 at 20:33 +0000, Taras Kondratiuk wrote:
> From: Victor Kamensky <kamensky at cisco.com>
> 
> initramfs code supporting extended cpio format have ability to
> fill extended attributes from cpio archive, but if SELinux enabled
> and security server is not initialized yet, selinux callback would
> refuse setxattr made by initramfs code.
> 
> Solution enable SBLABEL_MNT on rootfs even if secrurity server is
> not initialized yet.

What if we were to instead skip the SBLABEL_MNT check in
selinux_inode_setxattr() if !ss_initialized?  Not dependent on
filesystem type.

> 
> Signed-off-by: Victor Kamensky <kamensky at cisco.com>
> ---
>  security/selinux/hooks.c | 12 ++++++++++++
>  1 file changed, 12 insertions(+)
> 
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 8644d864e3c1..f3fe65589f02 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -706,6 +706,18 @@ static int selinux_set_mnt_opts(struct
> super_block *sb,
>  
>  	if (!ss_initialized) {
>  		if (!num_opts) {
> +			/*
> +			 * Special handling for rootfs. Is genfs but
> supports
> +			 * setting SELinux context on in-core
> inodes.
> +			 *
> +			 * Chicken and egg problem: policy may
> reside in rootfs
> +			 * but for initramfs code to fill in
> attributes, it
> +			 * needs selinux to allow that.
> +			 */
> +			if (!strncmp(sb->s_type->name, "rootfs",
> +				     sizeof("rootfs")))
> +				sbsec->flags |= SBLABEL_MNT;
> +
>  			/* Defer initialization until
> selinux_complete_init,
>  			   after the initial policy is loaded and
> the security
>  			   server is ready to handle calls. */
--
To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
the body of a message to majordomo at vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html