diff options
author | Thorsten Leemhuis <fedora@leemhuis.info> | 2020-08-13 20:17:57 +0200 |
---|---|---|
committer | Thorsten Leemhuis <fedora@leemhuis.info> | 2020-08-13 20:17:57 +0200 |
commit | f05c02032c007399078784ea2ace322385f869b9 (patch) | |
tree | 7c1bd28f37be1d28a3c8ace051c55472ba8bdd63 /0001-selinux-allow-reading-labels-before-policy-is-loaded.patch | |
parent | 55576abe986db86a9f4e2b105d2451800d652217 (diff) | |
parent | f7a3bf654752fa0e92c7ab3e57e48d3415632852 (diff) | |
download | kernel-f05c02032c007399078784ea2ace322385f869b9.tar.gz kernel-f05c02032c007399078784ea2ace322385f869b9.tar.xz kernel-f05c02032c007399078784ea2ace322385f869b9.zip |
Merge remote-tracking branch 'origin/master' into rawhide-user-thl-vanilla-fedora
Diffstat (limited to '0001-selinux-allow-reading-labels-before-policy-is-loaded.patch')
-rw-r--r-- | 0001-selinux-allow-reading-labels-before-policy-is-loaded.patch | 49 |
1 files changed, 0 insertions, 49 deletions
diff --git a/0001-selinux-allow-reading-labels-before-policy-is-loaded.patch b/0001-selinux-allow-reading-labels-before-policy-is-loaded.patch deleted file mode 100644 index 5c2384cd6..000000000 --- a/0001-selinux-allow-reading-labels-before-policy-is-loaded.patch +++ /dev/null @@ -1,49 +0,0 @@ -From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 -From: Jonathan Lebon <jlebon@redhat.com> -Date: Thu, 28 May 2020 10:39:40 -0400 -Subject: [PATCH] selinux: allow reading labels before policy is loaded - -This patch does for `getxattr` what commit 3e3e24b42043 ("selinux: allow -labeling before policy is loaded") did for `setxattr`; it allows -querying the current SELinux label on disk before the policy is loaded. - -One of the motivations described in that commit message also drives this -patch: for Fedora CoreOS (and eventually RHEL CoreOS), we want to be -able to move the root filesystem for example, from xfs to ext4 on RAID, -on first boot, at initrd time.[1] - -Because such an operation works at the filesystem level, we need to be -able to read the SELinux labels first from the original root, and apply -them to the files of the new root. The previous commit enabled the -second part of this process; this commit enables the first part. - -[1] https://github.com/coreos/fedora-coreos-tracker/issues/94 - -Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> -Signed-off-by: Jonathan Lebon <jlebon@redhat.com> -Signed-off-by: Paul Moore <paul@paul-moore.com> ---- - security/selinux/hooks.c | 7 ++++++- - 1 file changed, 6 insertions(+), 1 deletion(-) - -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index efa6108b1ce9..ca901025802a 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -3332,7 +3332,12 @@ static int selinux_inode_getsecurity(struct inode *inode, const char *name, void - char *context = NULL; - struct inode_security_struct *isec; - -- if (strcmp(name, XATTR_SELINUX_SUFFIX)) -+ /* -+ * If we're not initialized yet, then we can't validate contexts, so -+ * just let vfs_getxattr fall back to using the on-disk xattr. -+ */ -+ if (!selinux_initialized(&selinux_state) || -+ strcmp(name, XATTR_SELINUX_SUFFIX)) - return -EOPNOTSUPP; - - /* --- -2.26.2 - |