-
- Downloads
Don't try to relabel tracing directory
Use the default filesystem label from genfs_contexts for the directory /sys/kernel/debug/tracing and /sys/kernel/tracing, instead of explicitly attempting to relabel it. There are three cases we need to consider: 1) Old-style tracing functionality is on debugfs 2) tracing functionality is on tracefs, but mounted under debugfs 3) tracefs is mounted at /sys/kernel/tracing For #1, the label on /sys/kernel/debug/tracing will be debugfs, and all processes are allowed debugfs:dir search, so having the label be debugfs instead of debugfs_tracing will not result in any permission change. For #2, the label on /sys/kernel/debug/tracing will be debugfs_tracing, which is the same as it is today. The empty directory /sys/kernel/tracing wlll retain the sysfs label, avoiding the denial below. For #3, /sys/kernel/debug/tracing won't exist, and /sys/kernel/tracing will have the debugfs_tracing label, where processes are allowed search access. Addresses the following denial: avc: denied { associate } for pid=1 comm="init" name="tracing" dev="sysfs" ino=95 scontext=u:object_r:debugfs_tracing:s0 tcontext=u:object_r:sysfs:s0 tclass=filesystem permissive=0 Bug: 31856701 Bug: 35197529 Test: no denials on boot Change-Id: I7233ea92c6987b8edfce9c2f1d77eb25c7df820f
Please register or sign in to comment