diff options
Diffstat (limited to 'meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0032-Smack-Label-cgroup-files-for-systemd.patch')
| -rw-r--r-- | meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0032-Smack-Label-cgroup-files-for-systemd.patch | 80 |
1 files changed, 80 insertions, 0 deletions
diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0032-Smack-Label-cgroup-files-for-systemd.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0032-Smack-Label-cgroup-files-for-systemd.patch new file mode 100644 index 0000000..cb40c2f --- /dev/null +++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0032-Smack-Label-cgroup-files-for-systemd.patch @@ -0,0 +1,80 @@ +From d7ad31586a99cf4a7715589e36e9e8cde2365ae1 Mon Sep 17 00:00:00 2001 +From: Casey Schaufler <casey@schaufler-ca.com> +Date: Mon, 28 Apr 2014 15:23:01 -0700 +Subject: [PATCH 32/54] Smack: Label cgroup files for systemd + +The cgroup filesystem isn't ready for an LSM to +properly use extented attributes. This patch makes +files created in the cgroup filesystem usable by +a system running Smack and systemd. + +Targeted for git://git.gitorious.org/smack-next/kernel.git + +Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> +--- + security/smack/smack_lsm.c | 30 ++++++++++++++++++------------ + 1 file changed, 18 insertions(+), 12 deletions(-) + +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 6776130..1085bb7 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -2821,6 +2821,15 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) + * of the superblock. + */ + if (opt_dentry->d_parent == opt_dentry) { ++ if (sbp->s_magic == CGROUP_SUPER_MAGIC) { ++ /* ++ * The cgroup filesystem is never mounted, ++ * so there's no opportunity to set the mount ++ * options. ++ */ ++ sbsp->smk_root = smack_known_star.smk_known; ++ sbsp->smk_default = smack_known_star.smk_known; ++ } + isp->smk_inode = sbsp->smk_root; + isp->smk_flags |= SMK_INODE_INSTANT; + goto unlockandout; +@@ -2834,16 +2843,20 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) + */ + switch (sbp->s_magic) { + case SMACK_MAGIC: ++ case PIPEFS_MAGIC: ++ case SOCKFS_MAGIC: ++ case CGROUP_SUPER_MAGIC: + /* + * Casey says that it's a little embarrassing + * that the smack file system doesn't do + * extended attributes. +- */ +- final = smack_known_star.smk_known; +- break; +- case PIPEFS_MAGIC: +- /* ++ * + * Casey says pipes are easy (?) ++ * ++ * Socket access is controlled by the socket ++ * structures associated with the task involved. ++ * ++ * Cgroupfs is special + */ + final = smack_known_star.smk_known; + break; +@@ -2855,13 +2868,6 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) + */ + final = ckp->smk_known; + break; +- case SOCKFS_MAGIC: +- /* +- * Socket access is controlled by the socket +- * structures associated with the task involved. +- */ +- final = smack_known_star.smk_known; +- break; + case PROC_SUPER_MAGIC: + /* + * Casey says procfs appears not to care. +-- +2.1.4 + |