Skip to content
Snippets Groups Projects
  • Nick Kralevich's avatar
    585d9767
    fsck: allow stat access on /dev/block files · 585d9767
    Nick Kralevich authored
    To determine if it is safe to run fsck on a filesystem, e2fsck
    must first determine if the filesystem is mounted. To do that,
    e2fsck scans through /proc/mounts and collects all the mounted
    block devices. With that information, it runs stat() on each block
    device, comparing the major and minor numbers to the filesystem
    passed in on the command line. If there is a match, then the filesystem
    is currently mounted and running fsck is dangerous.
    Allow stat access to all block devices so that fsck can compare
    major/minor values.
    
    Addresses the following denials:
    
    avc: denied { getattr } for comm="e2fsck" path="/dev/block/sde5"
    dev="tmpfs" ino=15649 scontext=u:r:fsck:s0
    tcontext=u:object_r:metadata_block_device:s0 tclass=blk_file
    permissive=0
    
    avc: denied { getattr } for comm="e2fsck" path="/dev/block/sda25"
    dev="tmpfs" ino=15528 scontext=u:r:fsck:s0
    tcontext=u:object_r:modem_block_device:s0 tclass=blk_file permissive=0
    
    avc: denied { getattr } for comm="e2fsck" path="/dev/block/sda31"
    dev="tmpfs" ino=15552 scontext=u:r:fsck:s0
    tcontext=u:object_r:system_block_device:s0 tclass=blk_file permissive=0
    
    avc: denied { getattr } for comm="e2fsck" path="/dev/block/sdd3"
    dev="tmpfs" ino=15600 scontext=u:r:fsck:s0
    tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=0
    
    Bug: 35324014
    Bug: 33781554
    Test: device boots and no SELinux denials.
    Change-Id: I5af4a334ec41952887914eec4eee5c60cc441a66
    585d9767
    History
    fsck: allow stat access on /dev/block files
    Nick Kralevich authored
    To determine if it is safe to run fsck on a filesystem, e2fsck
    must first determine if the filesystem is mounted. To do that,
    e2fsck scans through /proc/mounts and collects all the mounted
    block devices. With that information, it runs stat() on each block
    device, comparing the major and minor numbers to the filesystem
    passed in on the command line. If there is a match, then the filesystem
    is currently mounted and running fsck is dangerous.
    Allow stat access to all block devices so that fsck can compare
    major/minor values.
    
    Addresses the following denials:
    
    avc: denied { getattr } for comm="e2fsck" path="/dev/block/sde5"
    dev="tmpfs" ino=15649 scontext=u:r:fsck:s0
    tcontext=u:object_r:metadata_block_device:s0 tclass=blk_file
    permissive=0
    
    avc: denied { getattr } for comm="e2fsck" path="/dev/block/sda25"
    dev="tmpfs" ino=15528 scontext=u:r:fsck:s0
    tcontext=u:object_r:modem_block_device:s0 tclass=blk_file permissive=0
    
    avc: denied { getattr } for comm="e2fsck" path="/dev/block/sda31"
    dev="tmpfs" ino=15552 scontext=u:r:fsck:s0
    tcontext=u:object_r:system_block_device:s0 tclass=blk_file permissive=0
    
    avc: denied { getattr } for comm="e2fsck" path="/dev/block/sdd3"
    dev="tmpfs" ino=15600 scontext=u:r:fsck:s0
    tcontext=u:object_r:block_device:s0 tclass=blk_file permissive=0
    
    Bug: 35324014
    Bug: 33781554
    Test: device boots and no SELinux denials.
    Change-Id: I5af4a334ec41952887914eec4eee5c60cc441a66