Messages in this thread | | | Subject | Re: SELinux change in 3.13 causes sync hang | From | Eric Paris <> | Date | Tue, 10 Dec 2013 15:25:23 -0500 |
| |
I still believe (assuming Josh says it tests ok) that a revert is a reasonable fix until next window. But I might know the actual problem:
Lets assume policy says: fuse.gluster == use_xattr
Lets assume this function is called with sb->s_type->name == fuse sb->s_subtype == NULL
int security_fs_use(struct super_block *sb) { int rc = 0; struct ocontext *c; struct superblock_security_struct *sbsec = sb->s_security; const char *fstype = sb->s_type->name; const char *subtype = (sb->s_subtype && sb->s_subtype[0]) ? sb->s_subtype : NULL; struct ocontext *base = NULL;
read_lock(&policy_rwlock);
for (c = policydb.ocontexts[OCON_FSUSE]; c; c = c->next) { char *sub; int baselen;
baselen = strlen(fstype);
********** assume c == the above rule name = fuse.gluster
/* if base does not match, this is not the one */ if (strncmp(fstype, c->u.name, baselen)) <----------- this will match continue;
/* if there is no subtype, this is the one! */ if (!subtype) <--------------------------------------- we will break here! break; [snip] } [snip] if (c) { sbsec->behavior = c->v.behavior;
So we just matched on the fuse.gluster rule even though the mount in question was fstype=fuse subtype=NULL So we will try to use xattrs on a fuse FS that can/will deadlock.
I'll try to write a patch to fix that logic...
-Eric
| |