summaryrefslogtreecommitdiff
path: root/security
diff options
context:
space:
mode:
authorCasey Schaufler <casey@schaufler-ca.com>2013-11-21 10:55:10 +0200
committerChanho Park <chanho61.park@samsung.com>2014-11-18 11:46:06 +0900
commitf58c85a39e2cc22b401e08f68887b1b6136d2339 (patch)
tree73e26e743534f77dab6bb9484ed101ea9f948708 /security
parentc1583766db4a15236ac10ffa7cd402f7cff93f5a (diff)
downloadlinux-3.10-f58c85a39e2cc22b401e08f68887b1b6136d2339.tar.gz
linux-3.10-f58c85a39e2cc22b401e08f68887b1b6136d2339.tar.bz2
linux-3.10-f58c85a39e2cc22b401e08f68887b1b6136d2339.zip
Smack: Cgroup filesystem access
The cgroup filesystems are not mounted using conventional mechanisms. This prevents the use of mount options to set Smack attributes. This patch makes the behavior of cgroup filesystems compatable with the way systemd uses them. Change-Id: I1e0429f133db9e14117dc754d682dec08221354c Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> Signed-off-by: Ɓukasz Stelmach <l.stelmach@samsung.com>
Diffstat (limited to 'security')
-rw-r--r--security/smack/smack_lsm.c30
1 files changed, 18 insertions, 12 deletions
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index b0be893ad44..3f01cf51f25 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -2726,6 +2726,15 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
* of the superblock.
*/
if (opt_dentry->d_parent == opt_dentry) {
+ if (sbp->s_magic == CGROUP_SUPER_MAGIC) {
+ /*
+ * The cgroup filesystem is never mounted,
+ * so there's no opportunity to set the mount
+ * options.
+ */
+ sbsp->smk_root = smack_known_star.smk_known;
+ sbsp->smk_default = smack_known_star.smk_known;
+ }
isp->smk_inode = sbsp->smk_root;
isp->smk_flags |= SMK_INODE_INSTANT;
goto unlockandout;
@@ -2739,16 +2748,20 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
*/
switch (sbp->s_magic) {
case SMACK_MAGIC:
+ case PIPEFS_MAGIC:
+ case SOCKFS_MAGIC:
+ case CGROUP_SUPER_MAGIC:
/*
* Casey says that it's a little embarrassing
* that the smack file system doesn't do
* extended attributes.
- */
- final = smack_known_star.smk_known;
- break;
- case PIPEFS_MAGIC:
- /*
+ *
* Casey says pipes are easy (?)
+ *
+ * Socket access is controlled by the socket
+ * structures associated with the task involved.
+ *
+ * Cgroupfs is special
*/
final = smack_known_star.smk_known;
break;
@@ -2760,13 +2773,6 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
*/
final = ckp->smk_known;
break;
- case SOCKFS_MAGIC:
- /*
- * Socket access is controlled by the socket
- * structures associated with the task involved.
- */
- final = smack_known_star.smk_known;
- break;
case PROC_SUPER_MAGIC:
/*
* Casey says procfs appears not to care.