Skip to content
Snippets Groups Projects
  • Nick Kralevich's avatar
    6ebcfe47
    Don't try to relabel tracing directory · 6ebcfe47
    Nick Kralevich authored
    Use the default filesystem label from genfs_contexts for the directory
    /sys/kernel/debug/tracing and /sys/kernel/tracing, instead of explicitly
    attempting to relabel it.
    
    There are three cases we need to consider:
    
    1) Old-style tracing functionality is on debugfs
    2) tracing functionality is on tracefs, but mounted under debugfs
    3) tracefs is mounted at /sys/kernel/tracing
    
    For #1, the label on /sys/kernel/debug/tracing will be debugfs, and all
    processes are allowed debugfs:dir search, so having the label be debugfs
    instead of debugfs_tracing will not result in any permission change.
    
    For #2, the label on /sys/kernel/debug/tracing will be debugfs_tracing,
    which is the same as it is today. The empty directory
    /sys/kernel/tracing wlll retain the sysfs label, avoiding the denial
    below.
    
    For #3, /sys/kernel/debug/tracing won't exist, and /sys/kernel/tracing
    will have the debugfs_tracing label, where processes are allowed search
    access.
    
    Addresses the following denial:
    
    avc:  denied  { associate } for  pid=1 comm="init" name="tracing"
    dev="sysfs" ino=95 scontext=u:object_r:debugfs_tracing:s0
    tcontext=u:object_r:sysfs:s0 tclass=filesystem permissive=0
    
    Bug: 31856701
    Bug: 35197529
    Test: no denials on boot
    Change-Id: I7233ea92c6987b8edfce9c2f1d77eb25c7df820f
    6ebcfe47
    History
    Don't try to relabel tracing directory
    Nick Kralevich authored
    Use the default filesystem label from genfs_contexts for the directory
    /sys/kernel/debug/tracing and /sys/kernel/tracing, instead of explicitly
    attempting to relabel it.
    
    There are three cases we need to consider:
    
    1) Old-style tracing functionality is on debugfs
    2) tracing functionality is on tracefs, but mounted under debugfs
    3) tracefs is mounted at /sys/kernel/tracing
    
    For #1, the label on /sys/kernel/debug/tracing will be debugfs, and all
    processes are allowed debugfs:dir search, so having the label be debugfs
    instead of debugfs_tracing will not result in any permission change.
    
    For #2, the label on /sys/kernel/debug/tracing will be debugfs_tracing,
    which is the same as it is today. The empty directory
    /sys/kernel/tracing wlll retain the sysfs label, avoiding the denial
    below.
    
    For #3, /sys/kernel/debug/tracing won't exist, and /sys/kernel/tracing
    will have the debugfs_tracing label, where processes are allowed search
    access.
    
    Addresses the following denial:
    
    avc:  denied  { associate } for  pid=1 comm="init" name="tracing"
    dev="sysfs" ino=95 scontext=u:object_r:debugfs_tracing:s0
    tcontext=u:object_r:sysfs:s0 tclass=filesystem permissive=0
    
    Bug: 31856701
    Bug: 35197529
    Test: no denials on boot
    Change-Id: I7233ea92c6987b8edfce9c2f1d77eb25c7df820f