Re: [PATCH v2 7/7] Smack: Handle labels consistently in untrusted mounts

2015-10-15 Thread Seth Forshee
On Wed, Oct 14, 2015 at 10:46:47PM -0700, Casey Schaufler wrote: > On 10/13/2015 10:04 AM, Seth Forshee wrote: > > The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled > > differently in untrusted mounts. This is confusing and > > potentically problematic. Change this to handle them

Re: [PATCH v2 7/7] Smack: Handle labels consistently in untrusted mounts

2015-10-15 Thread Seth Forshee
On Wed, Oct 14, 2015 at 10:46:47PM -0700, Casey Schaufler wrote: > On 10/13/2015 10:04 AM, Seth Forshee wrote: > > The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled > > differently in untrusted mounts. This is confusing and > > potentically problematic. Change this to handle them

Re: [PATCH v2 7/7] Smack: Handle labels consistently in untrusted mounts

2015-10-14 Thread Casey Schaufler
On 10/13/2015 10:04 AM, Seth Forshee wrote: > The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled > differently in untrusted mounts. This is confusing and > potentically problematic. Change this to handle them all the same > way that SMACK64 is currently handled; that is, read the

Re: [PATCH v2 7/7] Smack: Handle labels consistently in untrusted mounts

2015-10-14 Thread Casey Schaufler
On 10/13/2015 10:04 AM, Seth Forshee wrote: > The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled > differently in untrusted mounts. This is confusing and > potentically problematic. Change this to handle them all the same > way that SMACK64 is currently handled; that is, read the

[PATCH v2 7/7] Smack: Handle labels consistently in untrusted mounts

2015-10-13 Thread Seth Forshee
The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled differently in untrusted mounts. This is confusing and potentically problematic. Change this to handle them all the same way that SMACK64 is currently handled; that is, read the label from disk and check it at use time. For SMACK64

[PATCH v2 7/7] Smack: Handle labels consistently in untrusted mounts

2015-10-13 Thread Seth Forshee
The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled differently in untrusted mounts. This is confusing and potentically problematic. Change this to handle them all the same way that SMACK64 is currently handled; that is, read the label from disk and check it at use time. For SMACK64