diff options
Diffstat (limited to 'meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch')
| -rw-r--r-- | meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch | 82 |
1 files changed, 82 insertions, 0 deletions
diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch new file mode 100644 index 0000000..802c575 --- /dev/null +++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0022-Smack-Cgroup-filesystem-access.patch @@ -0,0 +1,82 @@ +From f2b14844c3072a3f58ddd8096569e189afc308aa Mon Sep 17 00:00:00 2001 +From: Casey Schaufler <casey@schaufler-ca.com> +Date: Thu, 21 Nov 2013 10:55:10 +0200 +Subject: [PATCH 22/39] Smack: Cgroup filesystem access + +The cgroup filesystems are not mounted using conventional +mechanisms. This prevents the use of mount options to +set Smack attributes. This patch makes the behavior +of cgroup filesystems compatable with the way systemd +uses them. + +Change-Id: I1e0429f133db9e14117dc754d682dec08221354c +Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> +Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com> +Signed-off-by: Stephane Desneux <stephane.desneux@iot.bzh> +--- + security/smack/smack_lsm.c | 30 ++++++++++++++++++------------ + 1 file changed, 18 insertions(+), 12 deletions(-) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 14f52be..acd8574 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2713,6 +2713,15 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) + * of the superblock. + */ + if (opt_dentry->d_parent == opt_dentry) { ++ if (sbp->s_magic == CGROUP_SUPER_MAGIC) { ++ /* ++ * The cgroup filesystem is never mounted, ++ * so there's no opportunity to set the mount ++ * options. ++ */ ++ sbsp->smk_root = smack_known_star.smk_known; ++ sbsp->smk_default = smack_known_star.smk_known; ++ } + isp->smk_inode = sbsp->smk_root; + isp->smk_flags |= SMK_INODE_INSTANT; + goto unlockandout; +@@ -2726,16 +2735,20 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) + */ + switch (sbp->s_magic) { + case SMACK_MAGIC: ++ case PIPEFS_MAGIC: ++ case SOCKFS_MAGIC: ++ case CGROUP_SUPER_MAGIC: + /* + * Casey says that it's a little embarrassing + * that the smack file system doesn't do + * extended attributes. +- */ +- final = smack_known_star.smk_known; +- break; +- case PIPEFS_MAGIC: +- /* ++ * + * Casey says pipes are easy (?) ++ * ++ * Socket access is controlled by the socket ++ * structures associated with the task involved. ++ * ++ * Cgroupfs is special + */ + final = smack_known_star.smk_known; + break; +@@ -2747,13 +2760,6 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) + */ + final = ckp->smk_known; + break; +- case SOCKFS_MAGIC: +- /* +- * Socket access is controlled by the socket +- * structures associated with the task involved. +- */ +- final = smack_known_star.smk_known; +- break; + case PROC_SUPER_MAGIC: + /* + * Casey says procfs appears not to care. +-- +1.9.1 + |