redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

selinux: allow context mounts on tmpfs, ramfs, devpts within user namespaces 

commit aad82892af ("selinux: Add support for
unprivileged mounts from user namespaces") prohibited any use of context
mount options within non-init user namespaces.  However, this breaks
use of context mount options for tmpfs mounts within user namespaces,
which are being used by Docker/runc.  There is no reason to block such
usage for tmpfs, ramfs or devpts.  Exempt these filesystem types
from this restriction.

Before:
sh$ userns_child_exec  -p -m -U -M '0 1000 1' -G '0 1000 1' bash
sh# mount -t tmpfs -o context=system_u:object_r:user_tmp_t:s0:c13 none /tmp
mount: tmpfs is write-protected, mounting read-only
mount: cannot mount tmpfs read-only

After:
sh$ userns_child_exec  -p -m -U -M '0 1000 1' -G '0 1000 1' bash
sh# mount -t tmpfs -o context=system_u:object_r:user_tmp_t:s0:c13 none /tmp
sh# ls -Zd /tmp
unconfined_u:object_r:user_tmp_t:s0:c13 /tmp

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
hifive-unleashed-5.1
Stephen Smalley 2017-01-09 10:07:31 -05:00 committed by Paul Moore
parent ef37979a2c
commit 01593d3299
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
security/selinux/hooks.c
View File

@ -834,10 +834,14 @@ static int selinux_set_mnt_opts(struct super_block *sb,
}
/*
* If this is a user namespace mount, no contexts are allowed
* on the command line and security labels must be ignored.
* If this is a user namespace mount and the filesystem type is not
* explicitly whitelisted, then no contexts are allowed on the command
* line and security labels must be ignored.
*/
if (sb->s_user_ns != &init_user_ns) {
if (sb->s_user_ns != &init_user_ns &&
strcmp(sb->s_type->name, "tmpfs") &&
strcmp(sb->s_type->name, "ramfs") &&
strcmp(sb->s_type->name, "devpts")) {
if (context_sid || fscontext_sid || rootcontext_sid ||
defcontext_sid) {
rc = -EACCES;