summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJames Morris <jmorris@namei.org>2008-12-19 11:41:10 +1100
committerJames Morris <jmorris@namei.org>2008-12-20 09:03:39 +1100
commit74192246910ff4fb95309ba1a683215644beeb62 (patch)
treeff6daed6c494ac83afad70049a28f20ec5770b44
parent12204e24b1330428c3062faee10a0d80b8a5cb61 (diff)
downloadtalos-op-linux-74192246910ff4fb95309ba1a683215644beeb62.tar.gz
talos-op-linux-74192246910ff4fb95309ba1a683215644beeb62.zip
SELinux: don't check permissions for kernel mounts
Don't bother checking permissions when the kernel performs an internal mount, as this should always be allowed. Signed-off-by: James Morris <jmorris@namei.org> Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
-rw-r--r--security/selinux/hooks.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 7465d713b531..853b58c8b2cb 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2484,6 +2484,10 @@ static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
if (rc)
return rc;
+ /* Allow all mounts performed by the kernel */
+ if (flags & MS_KERNMOUNT)
+ return 0;
+
AVC_AUDIT_DATA_INIT(&ad, FS);
ad.u.fs.path.dentry = sb->s_root;
return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
OpenPOWER on IntegriCloud