Seth Forshee 809c02e091 Smack: Handle labels consistently in untrusted mounts ... The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled differently in untrusted mounts. This is confusing and potentically problematic. Change this to handle them all the same way that SMACK64 is currently handled; that is, read the label from disk and check it at use time. For SMACK64 and SMACK64MMAP access is denied if the label does not match smk_root. To be consistent with suid, a SMACK64EXEC label which does not match smk_root will still allow execution of the file but will not run with the label supplied in the xattr. Signed-off-by: Seth Forshee <seth.forshee@canonical.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com>		2016-06-24 11:02:22 -05:00
..
Kconfig
Makefile
smack_access.c
smack_lsm.c	Smack: Handle labels consistently in untrusted mounts	2016-06-24 11:02:22 -05:00
smack_netfilter.c
smack.h	Smack: Add support for unprivileged mounts from user namespaces	2016-06-24 10:40:42 -05:00
smackfs.c	convert a bunch of open-coded instances of memdup_user_nul()	2016-01-04 10:26:58 -05:00