Re: [PATCH v3 7/7] Smack: Handle labels consistently in untrusted mounts

2015-11-17 Thread Seth Forshee
On Wed, Nov 18, 2015 at 11:12:51AM +1100, James Morris wrote: > On Tue, 17 Nov 2015, Seth Forshee wrote: > > > + sbsp = inode->i_sb->s_security; > > + if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) && > > Where is SMK_SB_UNTRUSTED defined? > > I can't see it in this patch series, mainline or secur

Re: [PATCH v3 7/7] Smack: Handle labels consistently in untrusted mounts

2015-11-17 Thread James Morris
On Tue, 17 Nov 2015, Seth Forshee wrote: > + sbsp = inode->i_sb->s_security; > + if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) && Where is SMK_SB_UNTRUSTED defined? I can't see it in this patch series, mainline or security next. -- James Morris -- To unsubscribe from this list: send the

Re: [PATCH v3 7/7] Smack: Handle labels consistently in untrusted mounts

2015-11-17 Thread Casey Schaufler
On 11/17/2015 8:39 AM, Seth Forshee wrote: The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled differently in untrusted mounts. This is confusing and potentically problematic. Change this to handle them all the same way that SMACK64 is currently handled; that is, read the label from

[PATCH v3 7/7] Smack: Handle labels consistently in untrusted mounts

2015-11-17 Thread Seth Forshee
The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled differently in untrusted mounts. This is confusing and potentically problematic. Change this to handle them all the same way that SMACK64 is currently handled; that is, read the label from disk and check it at use time. For SMACK64 an