LSM/SELinux: show LSM mount options in /proc/mounts

This patch causes SELinux mount options to show up in /proc/mounts.  As
with other code in the area seq_put errors are ignored.  Other LSM's
will not have their mount options displayed until they fill in their own
security_sb_show_options() function.

Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
Signed-off-by: James Morris <jmorris@namei.org>

3 files changed, 65 insertions, 1 deletions

diff --git a/security/dummy.c b/security/dummy.c
index 1db712d99dc7..c155f08e9dd8 100644
--- a/security/dummy.c
+++ b/security/dummy.c
@@ -194,6 +194,11 @@ static int dummy_sb_kern_mount (struct super_block *sb, void *data)
         return 0;
 }
 
+static int dummy_sb_show_options(struct seq_file *m, struct super_block *sb)
+{
+        return 0;
+}
+
 static int dummy_sb_statfs (struct dentry *dentry)
 {
         return 0;
@@ -1088,6 +1093,7 @@ void security_fixup_ops (struct security_operations *ops)
         set_to_dummy_if_null(ops, sb_free_security);
         set_to_dummy_if_null(ops, sb_copy_data);
         set_to_dummy_if_null(ops, sb_kern_mount);
+        set_to_dummy_if_null(ops, sb_show_options);
         set_to_dummy_if_null(ops, sb_statfs);
         set_to_dummy_if_null(ops, sb_mount);
         set_to_dummy_if_null(ops, sb_check_sb);
diff --git a/security/security.c b/security/security.c
index 2c0a5876b939..de74fdccde26 100644
--- a/security/security.c
+++ b/security/security.c
@@ -292,6 +292,11 @@ int security_sb_kern_mount(struct super_block *sb, void *data)
         return security_ops->sb_kern_mount(sb, data);
 }
 
+int security_sb_show_options(struct seq_file *m, struct super_block *sb)
+{
+        return security_ops->sb_show_options(m, sb);
+}
+
 int security_sb_statfs(struct dentry *dentry)
 {
         return security_ops->sb_statfs(dentry);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 85f74f665765..33dee83fdd2f 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -9,7 +9,8 @@
  *            James Morris <jmorris@redhat.com>
  *
  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
- *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
+ *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
+ *                                         Eric Paris <eparis@redhat.com>
  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  *                          <dgoeddel@trustedcs.com>
  *  Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
@@ -970,6 +971,57 @@ out_err:
         return rc;
 }
 
+void selinux_write_opts(struct seq_file *m, struct security_mnt_opts *opts)
+{
+        int i;
+        char *prefix;
+
+        for (i = 0; i < opts->num_mnt_opts; i++) {
+                char *has_comma = strchr(opts->mnt_opts[i], ',');
+
+                switch (opts->mnt_opts_flags[i]) {
+                case CONTEXT_MNT:
+                        prefix = CONTEXT_STR;
+                        break;
+                case FSCONTEXT_MNT:
+                        prefix = FSCONTEXT_STR;
+                        break;
+                case ROOTCONTEXT_MNT:
+                        prefix = ROOTCONTEXT_STR;
+                        break;
+                case DEFCONTEXT_MNT:
+                        prefix = DEFCONTEXT_STR;
+                        break;
+                default:
+                        BUG();
+                };
+                /* we need a comma before each option */
+                seq_putc(m, ',');
+                seq_puts(m, prefix);
+                if (has_comma)
+                        seq_putc(m, '\"');
+                seq_puts(m, opts->mnt_opts[i]);
+                if (has_comma)
+                        seq_putc(m, '\"');
+        }
+}
+
+static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
+{
+        struct security_mnt_opts opts;
+        int rc;
+
+        rc = selinux_get_mnt_opts(sb, &opts);
+        if (rc)
+                return rc;
+
+        selinux_write_opts(m, &opts);
+
+        security_free_mnt_opts(&opts);
+
+        return rc;
+}
+
 static inline u16 inode_mode_to_security_class(umode_t mode)
 {
         switch (mode & S_IFMT) {
@@ -5365,6 +5417,7 @@ static struct security_operations selinux_ops = {
         .sb_free_security =             selinux_sb_free_security,
         .sb_copy_data =                 selinux_sb_copy_data,
         .sb_kern_mount =                selinux_sb_kern_mount,
+        .sb_show_options =              selinux_sb_show_options,
         .sb_statfs =                    selinux_sb_statfs,
         .sb_mount =                     selinux_mount,
         .sb_umount =                    selinux_umount,