tree e06b9552bec95ead56f8ba79ac4f27947866850b
parent e46e01eebbbcf2ff6d28ee7cae9f117e9d1572c8
author Ondrej Mosnacek <omosnace@redhat.com> 1545423532 +0100
committer Paul Moore <paul@paul-moore.com> 1547173419 -0500

selinux: never allow relabeling on context mounts

In the SECURITY_FS_USE_MNTPOINT case we never want to allow relabeling
files/directories, so we should never set the SBLABEL_MNT flag. The
'special handling' in selinux_is_sblabel_mnt() is only intended for when
the behavior is set to SECURITY_FS_USE_GENFS.

While there, make the logic in selinux_is_sblabel_mnt() more explicit
and add a BUILD_BUG_ON() to make sure that introducing a new
SECURITY_FS_USE_* forces a review of the logic.

Fixes: d5f3a5f6e7e7 ("selinux: add security in-core xattr support for pstore and debugfs")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Reviewed-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>