selinux: only filter copy-up xattrs following initialization

Browse source

Extended attribute copy-up functionality added via 19472b69d6
("selinux: Implementation for inode_copy_up_xattr() hook") sees
"security.selinux" contexts dropped, instead relying on contexts
applied via the inode_copy_up() hook.

When copy-up takes place during early boot, prior to selinux
initialization / policy load, the context stripping can be unwanted
and unexpected.

With this change, filtering of "security.selinux" xattrs will only occur
after selinux initialization.

Signed-off-by: David Disseldorp <ddiss@suse.de>
Signed-off-by: Paul Moore <paul@paul-moore.com>

...

This commit is contained in:

David Disseldorp 2024-02-02 17:40:48 +11:00 • committed by Paul Moore

parent bfda63fa22

commit 7c655bee5c

1 changed files with 3 additions and 2 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

security/selinux/hooks.c

View file