Lucian Adrian Grijincu 8e6c96935f security/selinux: fix /proc/sys/ labeling ... This fixes an old (2007) selinux regression: filesystem labeling for /proc/sys returned -r--r--r-- unknown /proc/sys/fs/file-nr instead of -r--r--r-- system_u:object_r:sysctl_fs_t:s0 /proc/sys/fs/file-nr Events that lead to breaking of /proc/sys/ selinux labeling: 1) sysctl was reimplemented to route all calls through /proc/sys/ commit 77b14db502 [PATCH] sysctl: reimplement the sysctl proc support 2) proc_dir_entry was removed from ctl_table: commit 3fbfa98112 [PATCH] sysctl: remove the proc_dir_entry member for the sysctl tables 3) selinux still walked the proc_dir_entry tree to apply labeling. Because ctl_tables don't have a proc_dir_entry, we did not label /proc/sys/ inodes any more. To achieve this the /proc/sys/ inodes were marked private and private inodes were ignored by selinux. commit bbaca6c2e7 [PATCH] selinux: enhance selinux to always ignore private inodes commit 86a71dbd3e [PATCH] sysctl: hide the sysctl proc inodes from selinux Access control checks have been done by means of a special sysctl hook that was called for read/write accesses to any /proc/sys/ entry. We don't have to do this because, instead of walking the proc_dir_entry tree we can walk the dentry tree (as done in this patch). With this patch: * we don't mark /proc/sys/ inodes as private * we don't need the sysclt security hook * we walk the dentry tree to find the path to the inode. We have to strip the PID in /proc/PID/ entries that have a proc_dir_entry because selinux does not know how to label paths like '/1/net/rpc/nfsd.fh' (and defaults to 'proc_t' labeling). Selinux does know of '/net/rpc/nfsd.fh' (and applies the 'sysctl_rpc_t' label). PID stripping from the path was done implicitly in the previous code because the proc_dir_entry tree had the root in '/net' in the example from above. The dentry tree has the root in '/1'. Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> Signed-off-by: Lucian Adrian Grijincu <lucian.grijincu@gmail.com> Signed-off-by: Eric Paris <eparis@redhat.com>		2011-02-01 11:53:54 -05:00
..
include	SELinux: Use dentry name in new object labeling	2011-02-01 11:12:30 -05:00
ss	SELinux: Use dentry name in new object labeling	2011-02-01 11:12:30 -05:00
.gitignore	SELinux: add .gitignore files for dynamic classes	2009-10-24 09:42:27 +08:00
avc.c	SELinux: special dontaudit for access checks	2010-08-02 15:35:07 +10:00
exports.c	secmark: make secmark object handling generic	2010-10-21 10:12:48 +11:00
hooks.c	security/selinux: fix /proc/sys/ labeling	2011-02-01 11:53:54 -05:00
Kconfig	selinux: Deprecate and schedule the removal of the the compat_net functionality	2008-12-31 12:54:11 -05:00
Makefile	selinux: change to new flag variable	2010-10-21 10:12:40 +11:00
netif.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
netlabel.c	Merge branch 'master' into next	2010-05-06 10:56:07 +10:00
netlink.c	Merge branch 'master' into next	2010-05-06 10:56:07 +10:00
netnode.c	selinux: remove all rcu head initializations	2010-08-02 15:33:35 +10:00
netport.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00
nlmsgtab.c	SELinux: define permissions for DCB netlink messages	2010-12-16 12:50:17 -05:00
selinuxfs.c	Merge branch 'master' of git://git.infradead.org/users/eparis/selinux into next	2011-01-10 10:40:42 +11:00
xfrm.c	include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h	2010-03-30 22:02:32 +09:00