From mboxrd@z Thu Jan 1 00:00:00 1970 From: dhowells@redhat.com (David Howells) Date: Wed, 11 Jul 2018 00:19:53 +0100 Subject: [PATCH 08/32] smack: Implement filesystem context security hooks [ver #9] In-Reply-To: References: <153126248868.14533.9751473662727327569.stgit@warthog.procyon.org.uk> <153126254346.14533.14191961720018099798.stgit@warthog.procyon.org.uk> Message-ID: <16480.1531264793@warthog.procyon.org.uk> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org Casey Schaufler wrote: > > Implement filesystem context security hooks for the smack LSM. > > > > Question: Should the ->fs_context_parse_source() hook be implemented to > > check the labels on any source devices specified? > > Checking the label on a block device when doing a mount > is just going to end in tears. If you're remounting from > an already mounted filesystem it might make sense to check > that the new mount doesn't provide greater access than the > existing mount. If the original mount has smackfsdefault="_" > I could see prohibiting the additional mount having > smackfsdefault="*" on a filesystem that doesn't support > xattrs. But that requires that a (hopefully) privileged > process be involved, and we expect them to have a clue. > So no, I don't see it necessary. I think I may have meant the device file rather than the actual device content. David -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html