summaryrefslogtreecommitdiffstats
path: root/security/selinux
diff options
context:
space:
mode:
authorDavid Quigley <dpquigl@davequigley.com>2013-05-22 12:50:35 -0400
committerTrond Myklebust <Trond.Myklebust@netapp.com>2013-06-08 16:20:11 -0400
commit746df9b59c8a5f162c907796c7295d3c4c0d8995 (patch)
tree6c0e7ae018bfb33f482afdc74d0c77d6b9edd152 /security/selinux
parentd47be3dfecaf20255af89a57460285c82d5271ad (diff)
downloadlinux-746df9b59c8a5f162c907796c7295d3c4c0d8995.tar.gz
linux-746df9b59c8a5f162c907796c7295d3c4c0d8995.tar.bz2
linux-746df9b59c8a5f162c907796c7295d3c4c0d8995.zip
Security: Add Hook to test if the particular xattr is part of a MAC model.
The interface to request security labels from user space is the xattr interface. When requesting the security label from an NFS server it is important to make sure the requested xattr actually is a MAC label. This allows us to make sure that we get the desired semantics from the attribute instead of something else such as capabilities or a time based LSM. Acked-by: Eric Paris <eparis@redhat.com> Acked-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Matthew N. Dodd <Matthew.Dodd@sparta.com> Signed-off-by: Miguel Rodel Felipe <Rodel_FM@dsi.a-star.edu.sg> Signed-off-by: Phua Eu Gene <PHUA_Eu_Gene@dsi.a-star.edu.sg> Signed-off-by: Khin Mi Mi Aung <Mi_Mi_AUNG@dsi.a-star.edu.sg> Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
Diffstat (limited to 'security/selinux')
-rw-r--r--security/selinux/hooks.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index b1f7bd727bd9..bbf219a494d0 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5454,6 +5454,11 @@ abort_change:
return error;
}
+static int selinux_ismaclabel(const char *name)
+{
+ return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
+}
+
static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
{
return security_sid_to_context(secid, secdata, seclen);
@@ -5692,6 +5697,7 @@ static struct security_operations selinux_ops = {
.getprocattr = selinux_getprocattr,
.setprocattr = selinux_setprocattr,
+ .ismaclabel = selinux_ismaclabel,
.secid_to_secctx = selinux_secid_to_secctx,
.secctx_to_secid = selinux_secctx_to_secid,
.release_secctx = selinux_release_secctx,