From mboxrd@z Thu Jan 1 00:00:00 1970 From: Zakaria ElQotbi Subject: [PATCH] overlayfs: copyup security inode field Date: Wed, 19 Mar 2014 16:20:07 +0100 Message-ID: <20140319152007.GF7642@w-fr-zakariae> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Cc: To: Return-path: Received: from mail2.redbend.com ([212.143.186.103]:53447 "EHLO moon.redbend.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S933896AbaCSPZk (ORCPT ); Wed, 19 Mar 2014 11:25:40 -0400 Content-Disposition: inline Sender: linux-fsdevel-owner@vger.kernel.org List-ID: SELinux (and maybe other security frameworks) relies on inode->i_security field to perform audit of security contexts. I think this field must be the same as the underlying filesystem, instead of creating new fresh one at ovl_new_inode() which give an UNLABELED sid. The issue rised when certain process (for instance Zygote) fails to perform some actions (for instance getxattr) on Android using SEAndroid and overlyafs with empty uppdir mounted on /system, but it succeeds in case there is not overlayfs. Signed-off-by: Zakaria ElQotbi --- fs/overlayfs/overlayfs.h | 3 +++ 1 file changed, 3 insertions(+) diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h index 3495a55..d28023a 100644 --- a/fs/overlayfs/overlayfs.h +++ b/fs/overlayfs/overlayfs.h @@ -60,6 +60,9 @@ static inline void ovl_copyattr(struct inode *from, struct inode *to) { to->i_uid = from->i_uid; to->i_gid = from->i_gid; +#ifdef CONFIG_SECURITY + to->i_security = from->i_security; +#endif } /* dir.c */ -- 1.7.9.5