[PATCH v2 0/2] Inode security label invalidation

[Andreas Gruenbacher <agruenba@redhat.com>]

Since the first attempt at making selinux work on top of gfs2 and similar file
systems [1] was met with resistance by Christoph, here is another attempt that
doesn't require any additional inode operations, but also doesn't guarantee
full consistency of inode security labels: in case we cannot reload an invalid
label immediately, we keep using the old one.

The xattr cleanups that were part of [1] have been split off and posted
separately [2]; they seem to be okay.

Any thoughts?

Thanks,
Andreas

[1] https://lwn.net/Articles/655294/
[2] https://lkml.org/lkml/2015/10/4/137

Andreas Gruenbacher (2):
  security: Add hook to invalidate inode security labels
  gfs2: Invalide security labels of inodes that go invalid

 fs/gfs2/glops.c                   |  2 ++
 include/linux/lsm_hooks.h         |  6 ++++++
 include/linux/security.h          |  5 +++++
 security/security.c               |  8 ++++++++
 security/selinux/hooks.c          | 23 +++++++++++++++++++++--
 security/selinux/include/objsec.h |  3 ++-
 6 files changed, 44 insertions(+), 3 deletions(-)

-- 
2.5.0