Skip to content
This repository has been archived by the owner on Sep 24, 2020. It is now read-only.

Add stray patches from coreos-overlay #38

Merged
merged 2 commits into from
Feb 8, 2017
Merged

Add stray patches from coreos-overlay #38

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e3614cf
Add arm64 coreos verity hash
glevand Nov 12, 2016
e5868fc
selinux: allow context mounts on tmpfs, ramfs, devpts within user nam…
stephensmalley Jan 9, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions arch/arm64/kernel/head.S
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,6 +195,11 @@ section_table:
.short 0 // NumberOfLineNumbers (0 for executables)
.long 0xe0500020 // Characteristics (section flags)

/* CoreOS 64 byte verity hash value. */
.org _head + 512
.ascii "verity-hash"
.org _head + 512 + 64

/*
* EFI will load .text onwards at the 4k section alignment
* described in the PE/COFF header. To ensure that instruction
Expand Down
10 changes: 7 additions & 3 deletions security/selinux/hooks.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -832,10 +832,14 @@ static int selinux_set_mnt_opts(struct super_block *sb,
}

/*
* If this is a user namespace mount, no contexts are allowed
* on the command line and security labels must be ignored.
* If this is a user namespace mount and the filesystem type is not
* explicitly whitelisted, then no contexts are allowed on the command
* line and security labels must be ignored.
*/
if (sb->s_user_ns != &init_user_ns) {
if (sb->s_user_ns != &init_user_ns &&
strcmp(sb->s_type->name, "tmpfs") &&
strcmp(sb->s_type->name, "ramfs") &&
strcmp(sb->s_type->name, "devpts")) {
if (context_sid || fscontext_sid || rootcontext_sid ||
defcontext_sid) {
rc = -EACCES;
Expand Down