Commit 74192246 authored by James Morris's avatar James Morris
Browse files

SELinux: don't check permissions for kernel mounts 



Don't bother checking permissions when the kernel performs an
internal mount, as this should always be allowed.

Signed-off-by: default avatarJames Morris <jmorris@namei.org>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
parent 12204e24

security/selinux/hooks.c

+4 −0
Original line number Diff line number Diff line
@@ -2484,6 +2484,10 @@ static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data) 
	if (rc)

		return rc;



	/* Allow all mounts performed by the kernel */

	if (flags & MS_KERNMOUNT)

		return 0;



	AVC_AUDIT_DATA_INIT(&ad, FS);

	ad.u.fs.path.dentry = sb->s_root;

	return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);