[PATCH] selinux: enable per-file labeling for debugfs files.

[PATCH] selinux: enable per-file labeling for debugfs files.

[Stephen Smalley]

Add support for per-file labeling of debugfs files so that
we can distinguish them in policy.  This is particularly
important in Android where certain debugfs files have to be writable
by apps and therefore the debugfs directory tree can be read and
searched by all.

Since debugfs is entirely kernel-generated, the directory tree is
immutable by userspace, and the inodes are pinned in memory, we can
simply use the same approach as with proc and label the inodes from
policy based on pathname from the root of the debugfs filesystem.
Generalize the existing labeling support used for proc and reuse it
for debugfs too.

Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
 security/selinux/hooks.c            | 43 ++++++++++++++++++-------------------
 security/selinux/include/security.h |  1 +
 2 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 7dade28..56c90dd 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -724,7 +724,10 @@ static int selinux_set_mnt_opts(struct super_block *sb,
 	}
 
 	if (strcmp(sb->s_type->name, "proc") == 0)
-		sbsec->flags |= SE_SBPROC;
+		sbsec->flags |= SE_SBPROC | SE_SBGENFS;
+
+	if (strcmp(sb->s_type->name, "debugfs") == 0)
+		sbsec->flags |= SE_SBGENFS;
 
 	if (!sbsec->behavior) {
 		/*
@@ -1220,12 +1223,13 @@ static inline u16 socket_type_to_security_class(int family, int type, int protoc
 	return SECCLASS_SOCKET;
 }
 
-#ifdef CONFIG_PROC_FS
-static int selinux_proc_get_sid(struct dentry *dentry,
-				u16 tclass,
-				u32 *sid)
+static int selinux_genfs_get_sid(struct dentry *dentry,
+				 u16 tclass,
+				 u16 flags,
+				 u32 *sid)
 {
 	int rc;
+	struct super_block *sb = dentry->d_inode->i_sb;
 	char *buffer, *path;
 
 	buffer = (char *)__get_free_page(GFP_KERNEL);
@@ -1236,26 +1240,20 @@ static int selinux_proc_get_sid(struct dentry *dentry,
 	if (IS_ERR(path))
 		rc = PTR_ERR(path);
 	else {
-		/* each process gets a /proc/PID/ entry. Strip off the
-		 * PID part to get a valid selinux labeling.
-		 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
-		while (path[1] >= '0' && path[1] <= '9') {
-			path[1] = '/';
-			path++;
+		if (flags & SE_SBPROC) {
+			/* each process gets a /proc/PID/ entry. Strip off the
+			 * PID part to get a valid selinux labeling.
+			 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
+			while (path[1] >= '0' && path[1] <= '9') {
+				path[1] = '/';
+				path++;
+			}
 		}
-		rc = security_genfs_sid("proc", path, tclass, sid);
+		rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
 	}
 	free_page((unsigned long)buffer);
 	return rc;
 }
-#else
-static int selinux_proc_get_sid(struct dentry *dentry,
-				u16 tclass,
-				u32 *sid)
-{
-	return -EINVAL;
-}
-#endif
 
 /* The inode's security attributes must be initialized before first use. */
 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
@@ -1412,7 +1410,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 		/* Default to the fs superblock SID. */
 		isec->sid = sbsec->sid;
 
-		if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
+		if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
 			/* We must have a dentry to determine the label on
 			 * procfs inodes */
 			if (opt_dentry)
@@ -1435,7 +1433,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
 			if (!dentry)
 				goto out_unlock;
 			isec->sclass = inode_mode_to_security_class(inode->i_mode);
-			rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
+			rc = selinux_genfs_get_sid(dentry, isec->sclass,
+						   sbsec->flags, &sid);
 			dput(dentry);
 			if (rc)
 				goto out_unlock;
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index d1e0b23..36993ad 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -56,6 +56,7 @@
 /* Non-mount related flags */
 #define SE_SBINITIALIZED	0x0100
 #define SE_SBPROC		0x0200
+#define SE_SBGENFS		0x0400
 
 #define CONTEXT_STR	"context="
 #define FSCONTEXT_STR	"fscontext="
-- 
2.1.0

Re: [PATCH] selinux: enable per-file labeling for debugfs files.

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 956 bytes --]

On Tue, May 19, 2015 at 03:46:06PM -0400, Stephen Smalley wrote:
> Add support for per-file labeling of debugfs files so that
> we can distinguish them in policy.  This is particularly
> important in Android where certain debugfs files have to be writable
> by apps and therefore the debugfs directory tree can be read and
> searched by all.
> 
> Since debugfs is entirely kernel-generated, the directory tree is
> immutable by userspace, and the inodes are pinned in memory, we can
> simply use the same approach as with proc and label the inodes from
> policy based on pathname from the root of the debugfs filesystem.
> Generalize the existing labeling support used for proc and reuse it
> for debugfs too.

Was there a compelling reason not to implement something similar for /sys?

-- 
02DFF788
4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift

[-- Attachment #2: Type: application/pgp-signature, Size: 648 bytes --]

Re: [PATCH] selinux: enable per-file labeling for debugfs files.

[Stephen Smalley]

On 05/20/2015 11:51 AM, Dominick Grift wrote:
> On Tue, May 19, 2015 at 03:46:06PM -0400, Stephen Smalley wrote:
>> Add support for per-file labeling of debugfs files so that
>> we can distinguish them in policy.  This is particularly
>> important in Android where certain debugfs files have to be writable
>> by apps and therefore the debugfs directory tree can be read and
>> searched by all.
>>
>> Since debugfs is entirely kernel-generated, the directory tree is
>> immutable by userspace, and the inodes are pinned in memory, we can
>> simply use the same approach as with proc and label the inodes from
>> policy based on pathname from the root of the debugfs filesystem.
>> Generalize the existing labeling support used for proc and reuse it
>> for debugfs too.
> 
> Was there a compelling reason not to implement something similar for /sys?

The original motivating use case for per-file labeling for sysfs was
libvirt labeling of specific sysfs nodes to make them accessible to
specific virtual machines (qemu instances).  In that scenario, we needed
userspace to be able to drive the labeling based on more than just the
pathname and so genfs_contexts wasn't suitable.

That said, Android is labeling all of /sys at boot based on
file_contexts entries, so it might be argued that it would benefit from
similar support for sysfs.  Although genfs_contexts isn't as flexible as
file_contexts (simple path prefix matching vs pathname regex matching).

Re: [PATCH] selinux: enable per-file labeling for debugfs files.

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 2098 bytes --]

On Wed, May 20, 2015 at 11:59:34AM -0400, Stephen Smalley wrote:
> On 05/20/2015 11:51 AM, Dominick Grift wrote:
> > On Tue, May 19, 2015 at 03:46:06PM -0400, Stephen Smalley wrote:
> >> Add support for per-file labeling of debugfs files so that
> >> we can distinguish them in policy.  This is particularly
> >> important in Android where certain debugfs files have to be writable
> >> by apps and therefore the debugfs directory tree can be read and
> >> searched by all.
> >>
> >> Since debugfs is entirely kernel-generated, the directory tree is
> >> immutable by userspace, and the inodes are pinned in memory, we can
> >> simply use the same approach as with proc and label the inodes from
> >> policy based on pathname from the root of the debugfs filesystem.
> >> Generalize the existing labeling support used for proc and reuse it
> >> for debugfs too.
> > 
> > Was there a compelling reason not to implement something similar for /sys?
> 
> The original motivating use case for per-file labeling for sysfs was
> libvirt labeling of specific sysfs nodes to make them accessible to
> specific virtual machines (qemu instances).  In that scenario, we needed
> userspace to be able to drive the labeling based on more than just the
> pathname and so genfs_contexts wasn't suitable.
> 
> That said, Android is labeling all of /sys at boot based on
> file_contexts entries, so it might be argued that it would benefit from
> similar support for sysfs.  Although genfs_contexts isn't as flexible as
> file_contexts (simple path prefix matching vs pathname regex matching).
> 

I alway's considered labeling files in /sys based on file_contexts to be a rather fragile solution

Fedora for example uses systemd-tmpfiles to label specified files in /sys on boot

Currently in my personal policy i decided to leave everything with the default sysfs fs type whilst waiting for a "genfscon" solution to arrive.

-- 
02DFF788
4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift

[-- Attachment #2: Type: application/pgp-signature, Size: 648 bytes --]

Re: [PATCH] selinux: enable per-file labeling for debugfs files.

[Stephen Smalley]

On 05/20/2015 12:04 PM, Dominick Grift wrote:
> On Wed, May 20, 2015 at 11:59:34AM -0400, Stephen Smalley wrote:
>> On 05/20/2015 11:51 AM, Dominick Grift wrote:
>>> On Tue, May 19, 2015 at 03:46:06PM -0400, Stephen Smalley wrote:
>>>> Add support for per-file labeling of debugfs files so that
>>>> we can distinguish them in policy.  This is particularly
>>>> important in Android where certain debugfs files have to be writable
>>>> by apps and therefore the debugfs directory tree can be read and
>>>> searched by all.
>>>>
>>>> Since debugfs is entirely kernel-generated, the directory tree is
>>>> immutable by userspace, and the inodes are pinned in memory, we can
>>>> simply use the same approach as with proc and label the inodes from
>>>> policy based on pathname from the root of the debugfs filesystem.
>>>> Generalize the existing labeling support used for proc and reuse it
>>>> for debugfs too.
>>>
>>> Was there a compelling reason not to implement something similar for /sys?
>>
>> The original motivating use case for per-file labeling for sysfs was
>> libvirt labeling of specific sysfs nodes to make them accessible to
>> specific virtual machines (qemu instances).  In that scenario, we needed
>> userspace to be able to drive the labeling based on more than just the
>> pathname and so genfs_contexts wasn't suitable.
>>
>> That said, Android is labeling all of /sys at boot based on
>> file_contexts entries, so it might be argued that it would benefit from
>> similar support for sysfs.  Although genfs_contexts isn't as flexible as
>> file_contexts (simple path prefix matching vs pathname regex matching).
>>
> 
> I alway's considered labeling files in /sys based on file_contexts to be a rather fragile solution
> 
> Fedora for example uses systemd-tmpfiles to label specified files in /sys on boot
> 
> Currently in my personal policy i decided to leave everything with the default sysfs fs type whilst waiting for a "genfscon" solution to arrive.

The Android init program does a restorecon_recursive("/sys") on boot,
and specific optimizations have been introduced to prune the tree walk
when there are no relevant file_contexts entries.

We could certainly add full genfs_context support for sysfs, even if we
do not switch to using it in Android.  Some of the current /sys
file_contexts entries for Android however can't be represented in
genfs_contexts, e.g.:
/sys/devices/virtual/smdpkt/smdcntl([0-9])+/open_timeout
u:object_r:sysfs_smdcntl_open_timeout:s0

Also, genfs_contexts is always a prefix match, so e.g.
/sys/foo system_u:object_r:foo_t:s0
will match /sys/foo, /sys/foobar, and /sys/foo/bar.

In contrast, file_contexts is an anchored match, so e.g.
/sys/foo system_u:object_r:foo_t:s0
will only match /sys/foo,
/sys/foo(/.*)? system_u:object_r:foo_t:s0
will match /sys/foo and anything under it if it is a directory, and
/sys/foo.* will match anything beginning with /sys/foo.

So they aren't quite the same.

Re: [PATCH] selinux: enable per-file labeling for debugfs files.

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 2163 bytes --]

On Wed, May 20, 2015 at 12:13:18PM -0400, Stephen Smalley wrote:
> On 05/20/2015 12:04 PM, Dominick Grift wrote:
> > On Wed, May 20, 2015 at 11:59:34AM -0400, Stephen Smalley wrote:
> >> On 05/20/2015 11:51 AM, Dominick Grift wrote:
> >>> On Tue, May 19, 2015 at 03:46:06PM -0400, Stephen Smalley wrote:

> >> The original motivating use case for per-file labeling for sysfs was
> >> libvirt labeling of specific sysfs nodes to make them accessible to
> >> specific virtual machines (qemu instances).  In that scenario, we needed
> >> userspace to be able to drive the labeling based on more than just the
> >> pathname and so genfs_contexts wasn't suitable.

I do not think that is applicable anymore (although i may be wrong)


> 
> The Android init program does a restorecon_recursive("/sys") on boot,
> and specific optimizations have been introduced to prune the tree walk
> when there are no relevant file_contexts entries.
> 
> We could certainly add full genfs_context support for sysfs, even if we
> do not switch to using it in Android.  Some of the current /sys
> file_contexts entries for Android however can't be represented in
> genfs_contexts, e.g.:
> /sys/devices/virtual/smdpkt/smdcntl([0-9])+/open_timeout
> u:object_r:sysfs_smdcntl_open_timeout:s0
> 
> Also, genfs_contexts is always a prefix match, so e.g.
> /sys/foo system_u:object_r:foo_t:s0
> will match /sys/foo, /sys/foobar, and /sys/foo/bar.
> 
> In contrast, file_contexts is an anchored match, so e.g.
> /sys/foo system_u:object_r:foo_t:s0
> will only match /sys/foo,
> /sys/foo(/.*)? system_u:object_r:foo_t:s0
> will match /sys/foo and anything under it if it is a directory, and
> /sys/foo.* will match anything beginning with /sys/foo.
> 
> So they aren't quite the same.
> 

That sounds troublesome. Then again, just because one implements genfscon support that does not mean that labeling based on file_contexts can't be used for stuff that cannot be tackled with genfscon. Right?

-- 
02DFF788
4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift

[-- Attachment #2: Type: application/pgp-signature, Size: 648 bytes --]

Re: [PATCH] selinux: enable per-file labeling for debugfs files.

[Stephen Smalley]

On 05/20/2015 12:20 PM, Dominick Grift wrote:
> On Wed, May 20, 2015 at 12:13:18PM -0400, Stephen Smalley wrote:
>> On 05/20/2015 12:04 PM, Dominick Grift wrote:
>>> On Wed, May 20, 2015 at 11:59:34AM -0400, Stephen Smalley wrote:
>>>> On 05/20/2015 11:51 AM, Dominick Grift wrote:
>>>>> On Tue, May 19, 2015 at 03:46:06PM -0400, Stephen Smalley wrote:
> 
>>>> The original motivating use case for per-file labeling for sysfs was
>>>> libvirt labeling of specific sysfs nodes to make them accessible to
>>>> specific virtual machines (qemu instances).  In that scenario, we needed
>>>> userspace to be able to drive the labeling based on more than just the
>>>> pathname and so genfs_contexts wasn't suitable.
> 
> I do not think that is applicable anymore (although i may be wrong)

Not sure what you mean, but to clarify, I mean that libvirt has to set
the context (at least the categories for MCS and possibly the type as
well) on any sysfs node that needs to be accessible by the qemu
instance.  At least that used to be the case.

>>
>> The Android init program does a restorecon_recursive("/sys") on boot,
>> and specific optimizations have been introduced to prune the tree walk
>> when there are no relevant file_contexts entries.
>>
>> We could certainly add full genfs_context support for sysfs, even if we
>> do not switch to using it in Android.  Some of the current /sys
>> file_contexts entries for Android however can't be represented in
>> genfs_contexts, e.g.:
>> /sys/devices/virtual/smdpkt/smdcntl([0-9])+/open_timeout
>> u:object_r:sysfs_smdcntl_open_timeout:s0
>>
>> Also, genfs_contexts is always a prefix match, so e.g.
>> /sys/foo system_u:object_r:foo_t:s0
>> will match /sys/foo, /sys/foobar, and /sys/foo/bar.
>>
>> In contrast, file_contexts is an anchored match, so e.g.
>> /sys/foo system_u:object_r:foo_t:s0
>> will only match /sys/foo,
>> /sys/foo(/.*)? system_u:object_r:foo_t:s0
>> will match /sys/foo and anything under it if it is a directory, and
>> /sys/foo.* will match anything beginning with /sys/foo.
>>
>> So they aren't quite the same.
>>
> 
> That sounds troublesome. Then again, just because one implements genfscon support that does not mean that labeling based on file_contexts can't be used for stuff that cannot be tackled with genfscon. Right?

True.  genfscon would be applied when the dentry is first instantiated,
and then if userspace comes along and changes it via
restorecon/setxattr, then that value will be used (assuming the
relabeling is allowed).

Re: [PATCH] selinux: enable per-file labeling for debugfs files.

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 1265 bytes --]

On Wed, May 20, 2015 at 12:24:50PM -0400, Stephen Smalley wrote:
> On 05/20/2015 12:20 PM, Dominick Grift wrote:
> > On Wed, May 20, 2015 at 12:13:18PM -0400, Stephen Smalley wrote:
> >> On 05/20/2015 12:04 PM, Dominick Grift wrote:
> >>> On Wed, May 20, 2015 at 11:59:34AM -0400, Stephen Smalley wrote:
> >>>> On 05/20/2015 11:51 AM, Dominick Grift wrote:
> >>>>> On Tue, May 19, 2015 at 03:46:06PM -0400, Stephen Smalley wrote:
> > 
> >>>> The original motivating use case for per-file labeling for sysfs was
> >>>> libvirt labeling of specific sysfs nodes to make them accessible to
> >>>> specific virtual machines (qemu instances).  In that scenario, we needed
> >>>> userspace to be able to drive the labeling based on more than just the
> >>>> pathname and so genfs_contexts wasn't suitable.
> > 
> > I do not think that is applicable anymore (although i may be wrong)
> 
> Not sure what you mean, but to clarify, I mean that libvirt has to set
> the context (at least the categories for MCS and possibly the type as
> well) on any sysfs node that needs to be accessible by the qemu
> instance.  At least that used to be the case.
> 

That is what i mean. I am not aware of any such scenario's today. Again, I might be overlooking it.

[-- Attachment #2: Type: application/pgp-signature, Size: 648 bytes --]

Re: [PATCH] selinux: enable per-file labeling for debugfs files.

[Stephen Smalley]

On 05/20/2015 12:28 PM, Dominick Grift wrote:
> On Wed, May 20, 2015 at 12:24:50PM -0400, Stephen Smalley wrote:
>> On 05/20/2015 12:20 PM, Dominick Grift wrote:
>>> On Wed, May 20, 2015 at 12:13:18PM -0400, Stephen Smalley wrote:
>>>> On 05/20/2015 12:04 PM, Dominick Grift wrote:
>>>>> On Wed, May 20, 2015 at 11:59:34AM -0400, Stephen Smalley wrote:
>>>>>> On 05/20/2015 11:51 AM, Dominick Grift wrote:
>>>>>>> On Tue, May 19, 2015 at 03:46:06PM -0400, Stephen Smalley wrote:
>>>
>>>>>> The original motivating use case for per-file labeling for sysfs was
>>>>>> libvirt labeling of specific sysfs nodes to make them accessible to
>>>>>> specific virtual machines (qemu instances).  In that scenario, we needed
>>>>>> userspace to be able to drive the labeling based on more than just the
>>>>>> pathname and so genfs_contexts wasn't suitable.
>>>
>>> I do not think that is applicable anymore (although i may be wrong)
>>
>> Not sure what you mean, but to clarify, I mean that libvirt has to set
>> the context (at least the categories for MCS and possibly the type as
>> well) on any sysfs node that needs to be accessible by the qemu
>> instance.  At least that used to be the case.
>>
> 
> That is what i mean. I am not aware of any such scenario's today. Again, I might be overlooking it.

Would only show up if you are doing PCI passthrough, I believe.

Also possible that they never leveraged the support in libvirt even
after we got the kernel support merged.  But not to say that it wouldn't
improve their security nonetheless today...

Re: [PATCH] selinux: enable per-file labeling for debugfs files.

[Dominick Grift]

[-- Attachment #1: Type: text/plain, Size: 2119 bytes --]

On Wed, May 20, 2015 at 01:25:58PM -0400, Stephen Smalley wrote:
> On 05/20/2015 12:28 PM, Dominick Grift wrote:
> > On Wed, May 20, 2015 at 12:24:50PM -0400, Stephen Smalley wrote:
> >> On 05/20/2015 12:20 PM, Dominick Grift wrote:
> >>> On Wed, May 20, 2015 at 12:13:18PM -0400, Stephen Smalley wrote:
> >>>> On 05/20/2015 12:04 PM, Dominick Grift wrote:
> >>>>> On Wed, May 20, 2015 at 11:59:34AM -0400, Stephen Smalley wrote:
> >>>>>> On 05/20/2015 11:51 AM, Dominick Grift wrote:
> >>>>>>> On Tue, May 19, 2015 at 03:46:06PM -0400, Stephen Smalley wrote:
> >>>
> >>>>>> The original motivating use case for per-file labeling for sysfs was
> >>>>>> libvirt labeling of specific sysfs nodes to make them accessible to
> >>>>>> specific virtual machines (qemu instances).  In that scenario, we needed
> >>>>>> userspace to be able to drive the labeling based on more than just the
> >>>>>> pathname and so genfs_contexts wasn't suitable.
> >>>
> >>> I do not think that is applicable anymore (although i may be wrong)
> >>
> >> Not sure what you mean, but to clarify, I mean that libvirt has to set
> >> the context (at least the categories for MCS and possibly the type as
> >> well) on any sysfs node that needs to be accessible by the qemu
> >> instance.  At least that used to be the case.
> >>
> > 
> > That is what i mean. I am not aware of any such scenario's today. Again, I might be overlooking it.
> 
> Would only show up if you are doing PCI passthrough, I believe.
> 
> Also possible that they never leveraged the support in libvirt even
> after we got the kernel support merged.  But not to say that it wouldn't
> improve their security nonetheless today...
> 
> 

Thanks, I haven't noticed that. Your patch would not break that functionality.

Thanks for your patch, i will allow me to start labeling some files in /sys as well

I just really did not feel comfortable by relying on systemd-tmpfiles for that.

-- 
02DFF788
4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift

[-- Attachment #2: Type: application/pgp-signature, Size: 648 bytes --]

Re: [PATCH] selinux: enable per-file labeling for debugfs files.

[Paul Moore]

On Tuesday, May 19, 2015 03:46:06 PM Stephen Smalley wrote:
> Add support for per-file labeling of debugfs files so that
> we can distinguish them in policy.  This is particularly
> important in Android where certain debugfs files have to be writable
> by apps and therefore the debugfs directory tree can be read and
> searched by all.
> 
> Since debugfs is entirely kernel-generated, the directory tree is
> immutable by userspace, and the inodes are pinned in memory, we can
> simply use the same approach as with proc and label the inodes from
> policy based on pathname from the root of the debugfs filesystem.
> Generalize the existing labeling support used for proc and reuse it
> for debugfs too.
> 
> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>

Also applied.  Thanks.

> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 7dade28..56c90dd 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -724,7 +724,10 @@ static int selinux_set_mnt_opts(struct super_block *sb,
> }
> 
>  	if (strcmp(sb->s_type->name, "proc") == 0)
> -		sbsec->flags |= SE_SBPROC;
> +		sbsec->flags |= SE_SBPROC | SE_SBGENFS;
> +
> +	if (strcmp(sb->s_type->name, "debugfs") == 0)
> +		sbsec->flags |= SE_SBGENFS;
> 
>  	if (!sbsec->behavior) {
>  		/*
> @@ -1220,12 +1223,13 @@ static inline u16 socket_type_to_security_class(int
> family, int type, int protoc return SECCLASS_SOCKET;
>  }
> 
> -#ifdef CONFIG_PROC_FS
> -static int selinux_proc_get_sid(struct dentry *dentry,
> -				u16 tclass,
> -				u32 *sid)
> +static int selinux_genfs_get_sid(struct dentry *dentry,
> +				 u16 tclass,
> +				 u16 flags,
> +				 u32 *sid)
>  {
>  	int rc;
> +	struct super_block *sb = dentry->d_inode->i_sb;
>  	char *buffer, *path;
> 
>  	buffer = (char *)__get_free_page(GFP_KERNEL);
> @@ -1236,26 +1240,20 @@ static int selinux_proc_get_sid(struct dentry
> *dentry, if (IS_ERR(path))
>  		rc = PTR_ERR(path);
>  	else {
> -		/* each process gets a /proc/PID/ entry. Strip off the
> -		 * PID part to get a valid selinux labeling.
> -		 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
> -		while (path[1] >= '0' && path[1] <= '9') {
> -			path[1] = '/';
> -			path++;
> +		if (flags & SE_SBPROC) {
> +			/* each process gets a /proc/PID/ entry. Strip off the
> +			 * PID part to get a valid selinux labeling.
> +			 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
> +			while (path[1] >= '0' && path[1] <= '9') {
> +				path[1] = '/';
> +				path++;
> +			}
>  		}
> -		rc = security_genfs_sid("proc", path, tclass, sid);
> +		rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
>  	}
>  	free_page((unsigned long)buffer);
>  	return rc;
>  }
> -#else
> -static int selinux_proc_get_sid(struct dentry *dentry,
> -				u16 tclass,
> -				u32 *sid)
> -{
> -	return -EINVAL;
> -}
> -#endif
> 
>  /* The inode's security attributes must be initialized before first use. */
> static int inode_doinit_with_dentry(struct inode *inode, struct dentry
> *opt_dentry) @@ -1412,7 +1410,7 @@ static int
> inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent /*
> Default to the fs superblock SID. */
>  		isec->sid = sbsec->sid;
> 
> -		if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
> +		if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
>  			/* We must have a dentry to determine the label on
>  			 * procfs inodes */
>  			if (opt_dentry)
> @@ -1435,7 +1433,8 @@ static int inode_doinit_with_dentry(struct inode
> *inode, struct dentry *opt_dent if (!dentry)
>  				goto out_unlock;
>  			isec->sclass = inode_mode_to_security_class(inode->i_mode);
> -			rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
> +			rc = selinux_genfs_get_sid(dentry, isec->sclass,
> +						   sbsec->flags, &sid);
>  			dput(dentry);
>  			if (rc)
>  				goto out_unlock;
> diff --git a/security/selinux/include/security.h
> b/security/selinux/include/security.h index d1e0b23..36993ad 100644
> --- a/security/selinux/include/security.h
> +++ b/security/selinux/include/security.h
> @@ -56,6 +56,7 @@
>  /* Non-mount related flags */
>  #define SE_SBINITIALIZED	0x0100
>  #define SE_SBPROC		0x0200
> +#define SE_SBGENFS		0x0400
> 
>  #define CONTEXT_STR	"context="
>  #define FSCONTEXT_STR	"fscontext="

-- 
paul moore
www.paul-moore.com