Commit aa9a90bf authored by Andrew Morton's avatar Andrew Morton Committed by Linus Torvalds

[PATCH] SELINUX: add policyvers to selinuxfs

From: James Morris <jmorris@redhat.com>

This patch adds a file to the root selinuxfs directory which returns the
security policy version associated with the currently running kernel.  Its
purpose is to allow scripts to determine which version of policy to load.
parent 517251c1
...@@ -13,6 +13,7 @@ ...@@ -13,6 +13,7 @@
#define SECCLASS_NULL 0x0000 /* no class */ #define SECCLASS_NULL 0x0000 /* no class */
#define SELINUX_MAGIC 0xf97cff8c #define SELINUX_MAGIC 0xf97cff8c
#define POLICYDB_VERSION 15
#ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
extern int selinux_enabled; extern int selinux_enabled;
......
...@@ -37,7 +37,8 @@ enum sel_inos { ...@@ -37,7 +37,8 @@ enum sel_inos {
SEL_ACCESS, /* compute access decision */ SEL_ACCESS, /* compute access decision */
SEL_CREATE, /* compute create labeling decision */ SEL_CREATE, /* compute create labeling decision */
SEL_RELABEL, /* compute relabeling decision */ SEL_RELABEL, /* compute relabeling decision */
SEL_USER /* compute reachable user contexts */ SEL_USER, /* compute reachable user contexts */
SEL_POLICYVERS /* return policy version for this kernel */
}; };
static ssize_t sel_read_enforce(struct file *filp, char *buf, static ssize_t sel_read_enforce(struct file *filp, char *buf,
...@@ -125,6 +126,46 @@ static struct file_operations sel_enforce_ops = { ...@@ -125,6 +126,46 @@ static struct file_operations sel_enforce_ops = {
.write = sel_write_enforce, .write = sel_write_enforce,
}; };
static ssize_t sel_read_policyvers(struct file *filp, char *buf,
size_t count, loff_t *ppos)
{
char *page;
ssize_t length;
ssize_t end;
if (count < 0 || count > PAGE_SIZE)
return -EINVAL;
if (!(page = (char*)__get_free_page(GFP_KERNEL)))
return -ENOMEM;
memset(page, 0, PAGE_SIZE);
length = snprintf(page, PAGE_SIZE, "%u", POLICYDB_VERSION);
if (length < 0) {
free_page((unsigned long)page);
return length;
}
if (*ppos >= length) {
free_page((unsigned long)page);
return 0;
}
if (count + *ppos > length)
count = length - *ppos;
end = count + *ppos;
if (copy_to_user(buf, (char *) page + *ppos, count)) {
count = -EFAULT;
goto out;
}
*ppos = end;
out:
free_page((unsigned long)page);
return count;
}
static struct file_operations sel_policyvers_ops = {
.read = sel_read_policyvers,
};
static ssize_t sel_write_load(struct file * file, const char * buf, static ssize_t sel_write_load(struct file * file, const char * buf,
size_t count, loff_t *ppos) size_t count, loff_t *ppos)
...@@ -568,6 +609,7 @@ static int sel_fill_super(struct super_block * sb, void * data, int silent) ...@@ -568,6 +609,7 @@ static int sel_fill_super(struct super_block * sb, void * data, int silent)
[SEL_CREATE] = {"create", &transaction_ops, S_IRUGO|S_IWUGO}, [SEL_CREATE] = {"create", &transaction_ops, S_IRUGO|S_IWUGO},
[SEL_RELABEL] = {"relabel", &transaction_ops, S_IRUGO|S_IWUGO}, [SEL_RELABEL] = {"relabel", &transaction_ops, S_IRUGO|S_IWUGO},
[SEL_USER] = {"user", &transaction_ops, S_IRUGO|S_IWUGO}, [SEL_USER] = {"user", &transaction_ops, S_IRUGO|S_IWUGO},
[SEL_POLICYVERS] = {"policyvers", &sel_policyvers_ops, S_IRUGO},
/* last one */ {""} /* last one */ {""}
}; };
return simple_fill_super(sb, SELINUX_MAGIC, selinux_files); return simple_fill_super(sb, SELINUX_MAGIC, selinux_files);
......
...@@ -225,7 +225,6 @@ extern int policydb_read(struct policydb *p, void *fp); ...@@ -225,7 +225,6 @@ extern int policydb_read(struct policydb *p, void *fp);
#define PERM_SYMTAB_SIZE 32 #define PERM_SYMTAB_SIZE 32
#define POLICYDB_VERSION 15
#define POLICYDB_CONFIG_MLS 1 #define POLICYDB_CONFIG_MLS 1
#define OBJECT_R "object_r" #define OBJECT_R "object_r"
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment