提交 383795c2 编写于 作者: E Eric Paris 提交者: James Morris

SELinux: /proc/mounts should show what it can

Given a hosed SELinux config in which a system never loads policy or
disables SELinux we currently just return -EINVAL for anyone trying to
read /proc/mounts.  This is a configuration problem but we can certainly
be more graceful.  This patch just ignores -EINVAL when displaying LSM
options and causes /proc/mounts display everything else it can.  If
policy isn't loaded the obviously there are no options, so we aren't
really loosing any information here.

This is safe as the only other return of EINVAL comes from
security_sid_to_context_core() in the case of an invalid sid.  Even if a
FS was mounted with a now invalidated context that sid should have been
remapped to unlabeled and so we won't hit the EINVAL and will work like
we should.  (yes, I tested to make sure it worked like I thought)
Signed-off-by: NEric Paris <eparis@redhat.com>
Tested-by: NMarc Dionne <marc.c.dionne@gmail.com>
Signed-off-by: NJames Morris <jmorris@namei.org>
上级 6e86841d
...@@ -998,8 +998,12 @@ static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb) ...@@ -998,8 +998,12 @@ static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
int rc; int rc;
rc = selinux_get_mnt_opts(sb, &opts); rc = selinux_get_mnt_opts(sb, &opts);
if (rc) if (rc) {
/* before policy load we may get EINVAL, don't show anything */
if (rc == -EINVAL)
rc = 0;
return rc; return rc;
}
selinux_write_opts(m, &opts); selinux_write_opts(m, &opts);
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册