Searched hist:"134509 d54e4e98888be2697a92cb4b48957b792b" (Results 1 – 2 of 2) sorted by relevance
| /openbmc/linux/security/selinux/include/ |
| H A D | security.h | diff 134509d54e4e98888be2697a92cb4b48957b792b Thu Jun 04 15:22:17 CDT 2015 Stephen Smalley <sds@tycho.nsa.gov> selinux: enable per-file labeling for debugfs files.
Add support for per-file labeling of debugfs files so that
we can distinguish them in policy. This is particularly
important in Android where certain debugfs files have to be writable
by apps and therefore the debugfs directory tree can be read and
searched by all.
Since debugfs is entirely kernel-generated, the directory tree is
immutable by userspace, and the inodes are pinned in memory, we can
simply use the same approach as with proc and label the inodes from
policy based on pathname from the root of the debugfs filesystem.
Generalize the existing labeling support used for proc and reuse it
for debugfs too.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <pmoore@redhat.com>
|
| /openbmc/linux/security/selinux/ |
| H A D | hooks.c | diff 134509d54e4e98888be2697a92cb4b48957b792b Thu Jun 04 15:22:17 CDT 2015 Stephen Smalley <sds@tycho.nsa.gov> selinux: enable per-file labeling for debugfs files.
Add support for per-file labeling of debugfs files so that
we can distinguish them in policy. This is particularly
important in Android where certain debugfs files have to be writable
by apps and therefore the debugfs directory tree can be read and
searched by all.
Since debugfs is entirely kernel-generated, the directory tree is
immutable by userspace, and the inodes are pinned in memory, we can
simply use the same approach as with proc and label the inodes from
policy based on pathname from the root of the debugfs filesystem.
Generalize the existing labeling support used for proc and reuse it
for debugfs too.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <pmoore@redhat.com>
|