selinux: consider filesystem subtype in policies
authorAnand Avati <avati@redhat.com>
Tue, 16 Apr 2013 22:56:19 +0000 (18:56 -0400)
committerEric Paris <eparis@redhat.com>
Wed, 28 Aug 2013 18:44:52 +0000 (14:44 -0400)
commit102aefdda4d8275ce7d7100bc16c88c74272b260
tree808ea5ebeb04abbf5e8d9c024f261225a41420d7
parent2be4d74f2fd45460d70d4fe65cc1972ef45bf849
selinux: consider filesystem subtype in policies

Not considering sub filesystem has the following limitation. Support
for SELinux in FUSE is dependent on the particular userspace
filesystem, which is identified by the subtype. For e.g, GlusterFS,
a FUSE based filesystem supports SELinux (by mounting and processing
FUSE requests in different threads, avoiding the mount time
deadlock), whereas other FUSE based filesystems (identified by a
different subtype) have the mount time deadlock.

By considering the subtype of the filesytem in the SELinux policies,
allows us to specify a filesystem subtype, in the following way:

fs_use_xattr fuse.glusterfs gen_context(system_u:object_r:fs_t,s0);

This way not all FUSE filesystems are put in the same bucket and
subjected to the limitations of the other subtypes.

Signed-off-by: Anand Avati <avati@redhat.com>
Signed-off-by: Eric Paris <eparis@redhat.com>
security/selinux/hooks.c
security/selinux/ss/services.c