summaryrefslogtreecommitdiffstats
path: root/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch
diff options
context:
space:
mode:
Diffstat (limited to 'meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch')
-rw-r--r--meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch82
1 files changed, 82 insertions, 0 deletions
diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch
new file mode 100644
index 0000000..802c575
--- /dev/null
+++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch
@@ -0,0 +1,82 @@
+From f2b14844c3072a3f58ddd8096569e189afc308aa Mon Sep 17 00:00:00 2001
+From: Casey Schaufler <casey@schaufler-ca.com>
+Date: Thu, 21 Nov 2013 10:55:10 +0200
+Subject: [PATCH 22/39] Smack: Cgroup filesystem access
+
+The cgroup filesystems are not mounted using conventional
+mechanisms. This prevents the use of mount options to
+set Smack attributes. This patch makes the behavior
+of cgroup filesystems compatable with the way systemd
+uses them.
+
+Change-Id: I1e0429f133db9e14117dc754d682dec08221354c
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
+Signed-off-by: Stephane Desneux <stephane.desneux@iot.bzh>
+---
+ security/smack/smack_lsm.c | 30 ++++++++++++++++++------------
+ 1 file changed, 18 insertions(+), 12 deletions(-)
+
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 14f52be..acd8574 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -2713,6 +2713,15 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
+ * of the superblock.
+ */
+ if (opt_dentry->d_parent == opt_dentry) {
++ if (sbp->s_magic == CGROUP_SUPER_MAGIC) {
++ /*
++ * The cgroup filesystem is never mounted,
++ * so there's no opportunity to set the mount
++ * options.
++ */
++ sbsp->smk_root = smack_known_star.smk_known;
++ sbsp->smk_default = smack_known_star.smk_known;
++ }
+ isp->smk_inode = sbsp->smk_root;
+ isp->smk_flags |= SMK_INODE_INSTANT;
+ goto unlockandout;
+@@ -2726,16 +2735,20 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
+ */
+ switch (sbp->s_magic) {
+ case SMACK_MAGIC:
++ case PIPEFS_MAGIC:
++ case SOCKFS_MAGIC:
++ case CGROUP_SUPER_MAGIC:
+ /*
+ * Casey says that it's a little embarrassing
+ * that the smack file system doesn't do
+ * extended attributes.
+- */
+- final = smack_known_star.smk_known;
+- break;
+- case PIPEFS_MAGIC:
+- /*
++ *
+ * Casey says pipes are easy (?)
++ *
++ * Socket access is controlled by the socket
++ * structures associated with the task involved.
++ *
++ * Cgroupfs is special
+ */
+ final = smack_known_star.smk_known;
+ break;
+@@ -2747,13 +2760,6 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
+ */
+ final = ckp->smk_known;
+ break;
+- case SOCKFS_MAGIC:
+- /*
+- * Socket access is controlled by the socket
+- * structures associated with the task involved.
+- */
+- final = smack_known_star.smk_known;
+- break;
+ case PROC_SUPER_MAGIC:
+ /*
+ * Casey says procfs appears not to care.
+--
+1.9.1
+