• C
    [PATCH] SELinux: support mls categories for context mounts · 3528a953
    Cory Olmo 提交于
    Allows commas to be embedded into context mount options (i.e.  "-o
    context=some_selinux_context_t"), to better support multiple categories,
    which are separated by commas and confuse mount.
    
    For example, with the current code:
    
      mount -t iso9660 /dev/cdrom /media/cdrom -o \
      ro,context=system_u:object_r:iso9660_t:s0:c1,c3,c4,exec
    
    The context option that will be interpreted by SELinux is
    context=system_u:object_r:iso9660_t:s0:c1
    
    instead of
    context=system_u:object_r:iso9660_t:s0:c1,c3,c4
    
    The options that will be passed on to the file system will be
    ro,c3,c4,exec.
    
    The proposed solution is to allow/require the SELinux context option
    specified to mount to use quotes when the context contains a comma.
    
    This patch modifies the option parsing in parse_opts(), contained in
    mount.c, to take options after finding a comma only if it hasn't seen a
    quote or if the quotes are matched.  It also introduces a new function that
    will strip the quotes from the context option prior to translation.  The
    quotes are replaced after the translation is completed to insure that in
    the event the raw context contains commas the kernel will be able to
    interpret the correct context.
    Signed-off-by: NCory Olmo <colmo@TrustedCS.com>
    Signed-off-by: NJames Morris <jmorris@namei.org>
    Acked-by: NStephen Smalley <sds@tycho.nsa.gov>
    Signed-off-by: NAndrew Morton <akpm@osdl.org>
    Signed-off-by: NLinus Torvalds <torvalds@osdl.org>
    3528a953
hooks.c 117.9 KB