diff options
author | Vivek Goyal <vgoyal@redhat.com> | 2021-02-11 13:03:03 -0500 |
---|---|---|
committer | Paul Moore <paul@paul-moore.com> | 2021-03-08 19:34:38 -0500 |
commit | 7fa2e79a6bb924fa4b2de5766dab31f0f47b5ab6 (patch) | |
tree | 7646b2b0ede6c9943b5e90c591951715b9d92040 /security/selinux/include/ima.h | |
parent | a38fd8748464831584a19438cbb3082b5a2dab15 (diff) | |
download | linux-7fa2e79a6bb924fa4b2de5766dab31f0f47b5ab6.tar.bz2 |
selinux: Allow context mounts for unpriviliged overlayfs
Now overlayfs allow unpriviliged mounts. That is root inside a non-init
user namespace can mount overlayfs. This is being added in 5.11 kernel.
Giuseppe tried to mount overlayfs with option "context" and it failed
with error -EACCESS.
$ su test
$ unshare -rm
$ mkdir -p lower upper work merged
$ mount -t overlay -o lowerdir=lower,workdir=work,upperdir=upper,userxattr,context='system_u:object_r:container_file_t:s0' none merged
This fails with -EACCESS. It works if option "-o context" is not specified.
Little debugging showed that selinux_set_mnt_opts() returns -EACCESS.
So this patch adds "overlay" to the list, where it is fine to specific
context from non init_user_ns.
Reported-by: Giuseppe Scrivano <gscrivan@redhat.com>
Signed-off-by: Vivek Goyal <vgoyal@redhat.com>
[PM: trimmed the changelog from the description]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/include/ima.h')
0 files changed, 0 insertions, 0 deletions