Messages in this thread | | | Subject | Re: [PATCH] security: selinux: allow per-file labelling for binderfs | From | Stephen Smalley <> | Date | Mon, 6 Jan 2020 13:34:14 -0500 |
| |
On 1/6/20 1:13 PM, Hridya Valsaraju wrote: > This patch allows genfscon per-file labeling for binderfs. > This is required to have separate permissions to allow > access to binder, hwbinder and vndbinder devices which are > relocating to binderfs. > > Acked-by: Jeff Vander Stoep <jeffv@google.com> > Acked-by: Mark Salyzyn <salyzyn@android.com> > Signed-off-by: Hridya Valsaraju <hridya@google.com>
Do you want binderfs to also support userspace labeling of files via setxattr()? If so, you'll want to also add it to selinux_is_genfs_special_handling() as well.
> --- > security/selinux/hooks.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 116b4d644f68..3f0669a708e9 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -752,6 +752,7 @@ static int selinux_set_mnt_opts(struct super_block *sb, > > if (!strcmp(sb->s_type->name, "debugfs") || > !strcmp(sb->s_type->name, "tracefs") || > + !strcmp(sb->s_type->name, "binderfs") || > !strcmp(sb->s_type->name, "pstore")) > sbsec->flags |= SE_SBGENFS; > >
| |