SELinux: don't check permissions for kernel mounts



Don't bother checking permissions when the kernel performs an
internal mount, as this should always be allowed.

Signed-off-by: James Morris <jmorris@namei.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>

parent 12204e24

security/selinux/hooks.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -2484,6 +2484,10 @@ static int selinux_sb_kern_mount(struct super_block sb, int flags, void data)
		if (rc)
		return rc;

		/* Allow all mounts performed by the kernel */
		if (flags & MS_KERNMOUNT)
		return 0;

		AVC_AUDIT_DATA_INIT(&ad, FS);
		ad.u.fs.path.dentry = sb->s_root;
		return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);