Re: [PATCH v2 1/2] security: Add hook to invalidate inode security labels

[Andreas Gruenbacher]

On Mon, Oct 5, 2015 at 5:08 PM, Stephen Smalley <sds@xxxxxxxxxxxxx> wrote:
> Not fond of these magic initialized values.

That should be a solvable problem.

> Is it always safe to call inode_doinit() from all callers of
> inode_has_perm()?

As long as inode_has_perm is only used in contexts in which a file
permission check / acl check would be possible, I don't see why not.

> What about the cases where isec->sid is used without going through
> inode_has_perm()?

inode_has_perm seems to be called frequently and invalid labels seem
to be reload quickly, so this change may make SELinux work well enough
to be useful on top of gfs2 or similar. More checks would of course be
better. The ideal case would be to always reload invalid labels, but
that currently won't be possible because we don't have dentries
everywhere.

I can't tell if this is this good enough to provide a useful level of
protection. In any case, without a patch like this, on gfs2 and
similar file systems, SELinux currently doesn't work at all.

How we can make progress with this problem?

Thanks,
Andreas
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/