linux/security
Cory Olmo 3528a95322 [PATCH] SELinux: support mls categories for context mounts
Allows commas to be embedded into context mount options (i.e.  "-o
context=some_selinux_context_t"), to better support multiple categories,
which are separated by commas and confuse mount.

For example, with the current code:

  mount -t iso9660 /dev/cdrom /media/cdrom -o \
  ro,context=system_u:object_r:iso9660_t:s0:c1,c3,c4,exec

The context option that will be interpreted by SELinux is
context=system_u:object_r:iso9660_t:s0:c1

instead of
context=system_u:object_r:iso9660_t:s0:c1,c3,c4

The options that will be passed on to the file system will be
ro,c3,c4,exec.

The proposed solution is to allow/require the SELinux context option
specified to mount to use quotes when the context contains a comma.

This patch modifies the option parsing in parse_opts(), contained in
mount.c, to take options after finding a comma only if it hasn't seen a
quote or if the quotes are matched.  It also introduces a new function that
will strip the quotes from the context option prior to translation.  The
quotes are replaced after the translation is completed to insure that in
the event the raw context contains commas the kernel will be able to
interpret the correct context.

Signed-off-by: Cory Olmo <colmo@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-09-29 09:18:03 -07:00
..
keys [PATCH] Keys: Allow in-kernel key requestor to pass auxiliary data to upcaller 2006-06-29 10:26:20 -07:00
selinux [PATCH] SELinux: support mls categories for context mounts 2006-09-29 09:18:03 -07:00
Kconfig [PATCH] keys: restrict contents of /proc/keys to Viewable keys 2006-06-26 09:58:18 -07:00
Makefile [PATCH] add securityfs for all LSMs to use 2005-07-08 18:48:41 -07:00
capability.c Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00
commoncap.c Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00
dummy.c [NetLabel]: SELinux support 2006-09-22 14:53:36 -07:00
inode.c [PATCH] inode-diet: Eliminate i_blksize from the inode structure 2006-09-27 08:26:18 -07:00
root_plug.c Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00
seclvl.c [CRYPTO] users: Use crypto_hash interface instead of crypto_digest 2006-09-21 11:46:21 +10:00
security.c Remove obsolete #include <linux/config.h> 2006-06-30 19:25:36 +02:00