Re: [PATCH] libselinux: Do not fall back to /selinux on a sysfs mount failure

[Petr Lautrbach <lautrbach@redhat.com>]

Stephen Smalley <stephen.smalley.work@gmail.com> writes:

> Even if we cannot mount sysfs ourselves (e.g. in a user namespace),
> we can still try to mount on /sys/fs/selinux first prior to falling
> back to /selinux.
>
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Acked-by: Petr Lautrbach <lautrbach@redhat.com>


> ---
>  libselinux/src/load_policy.c | 15 +++++----------
>  1 file changed, 5 insertions(+), 10 deletions(-)
>
> diff --git a/libselinux/src/load_policy.c b/libselinux/src/load_policy.c
> index 8e737a23..bb7f2dd0 100644
> --- a/libselinux/src/load_policy.c
> +++ b/libselinux/src/load_policy.c
> @@ -290,16 +290,11 @@ int selinux_init_load_policy(int *enforce)
>  	 */
>  	const char *mntpoint = NULL;
>  	/* First make sure /sys is mounted */
> -	if (mount("sysfs", "/sys", "sysfs", 0, 0) == 0 || errno == EBUSY) {
> -		/* MS_NODEV can't be set because of /sys/fs/selinux/null device, used by Android */
> -		if (mount(SELINUXFS, SELINUXMNT, SELINUXFS, MS_NOEXEC | MS_NOSUID, 0) == 0 || errno == EBUSY) {
> -			mntpoint = SELINUXMNT;
> -		} else {
> -			/* check old mountpoint */
> -			if (mount(SELINUXFS, OLDSELINUXMNT, SELINUXFS, 0, 0) == 0 || errno == EBUSY) {
> -				mntpoint = OLDSELINUXMNT;
> -			}
> -		}
> +	(void) mount("sysfs", "/sys", "sysfs", 0, 0);
> +
> +	/* MS_NODEV can't be set because of /sys/fs/selinux/null device, used by Android */
> +	if (mount(SELINUXFS, SELINUXMNT, SELINUXFS, MS_NOEXEC | MS_NOSUID, 0) == 0 || errno == EBUSY) {
> +		mntpoint = SELINUXMNT;
>  	} else {
>  		/* check old mountpoint */
>  		if (mount(SELINUXFS, OLDSELINUXMNT, SELINUXFS, 0, 0) == 0 || errno == EBUSY) {
> -- 
> 2.52.0