Enable reading of /sys/fs/selinux/unshare as a way to detect whether a process is in a non-init SELinux namespace. This is to allow the selinux-testsuite to adapt based on whether it is run within a child SELinux namespace. Whether or not we want to retain this as a userspace API is an open question. Signed-off-by: Stephen Smalley --- security/selinux/selinuxfs.c | 16 +++++++++++++++- 1 file changed, 15 insertions(+), 1 deletion(-) diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index 3c2e828e0967..c8bc0c34a248 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -321,6 +321,19 @@ static const struct file_operations sel_disable_ops = { .llseek = generic_file_llseek, }; +static ssize_t sel_read_unshare(struct file *filp, char __user *buf, + size_t count, loff_t *ppos) +{ + const struct task_security_struct *tsec = selinux_cred(current_cred()); + char tmpbuf[1]; + + if (tsec->state == init_selinux_state) + tmpbuf[0] = '0'; + else + tmpbuf[0] = '1'; + return simple_read_from_buffer(buf, count, ppos, tmpbuf, 1); +} + static ssize_t sel_write_unshare(struct file *file, const char __user *buf, size_t count, loff_t *ppos) @@ -373,6 +386,7 @@ static ssize_t sel_write_unshare(struct file *file, const char __user *buf, } static const struct file_operations sel_unshare_ops = { + .read = sel_read_unshare, .write = sel_write_unshare, .llseek = generic_file_llseek, }; @@ -2237,7 +2251,7 @@ static int sel_fill_super(struct super_block *sb, struct fs_context *fc) [SEL_POLICY] = {"policy", &sel_policy_ops, S_IRUGO}, [SEL_VALIDATE_TRANS] = {"validatetrans", &sel_transition_ops, S_IWUGO}, - [SEL_UNSHARE] = {"unshare", &sel_unshare_ops, 0200}, + [SEL_UNSHARE] = {"unshare", &sel_unshare_ops, 0600}, [SEL_MAXNS] = {"maxns", &sel_maxns_ops, 0600}, [SEL_MAXNSDEPTH] = {"maxnsdepth", &sel_maxnsdepth_ops, 0600}, /* last one */ {"", NULL, 0} -- 2.50.1