summaryrefslogtreecommitdiff
path: root/security/selinux/include
diff options
context:
space:
mode:
authorStephen Smalley <sds@tycho.nsa.gov>2015-06-04 16:22:17 -0400
committerPaul Moore <pmoore@redhat.com>2015-06-04 16:22:17 -0400
commit134509d54e4e98888be2697a92cb4b48957b792b (patch)
treebd4d47b5287f2b3e846d377e21bb5ad77486d774 /security/selinux/include
parent6c6d2e9bde1c1c87a7ead806f8f5e2181d41a652 (diff)
selinux: enable per-file labeling for debugfs files.
Add support for per-file labeling of debugfs files so that we can distinguish them in policy. This is particularly important in Android where certain debugfs files have to be writable by apps and therefore the debugfs directory tree can be read and searched by all. Since debugfs is entirely kernel-generated, the directory tree is immutable by userspace, and the inodes are pinned in memory, we can simply use the same approach as with proc and label the inodes from policy based on pathname from the root of the debugfs filesystem. Generalize the existing labeling support used for proc and reuse it for debugfs too. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <pmoore@redhat.com>
Diffstat (limited to 'security/selinux/include')
-rw-r--r--security/selinux/include/security.h1
1 files changed, 1 insertions, 0 deletions
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index d1e0b239b602..36993ad1c067 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -56,6 +56,7 @@
/* Non-mount related flags */
#define SE_SBINITIALIZED 0x0100
#define SE_SBPROC 0x0200
+#define SE_SBGENFS 0x0400
#define CONTEXT_STR "context="
#define FSCONTEXT_STR "fscontext="