)]}'
{
  "commit": "f64410ec665479d7b4b77b7519e814253ed0f686",
  "tree": "6aedc263f0acb291bc76e1fc5fe7139049b88097",
  "parents": [
    "98883bfd9d603a2760f6d53eccfaa3ae2c053e72"
  ],
  "author": {
    "name": "Paul Moore",
    "email": "pmoore@redhat.com",
    "time": "Wed Mar 19 16:46:18 2014 -0400"
  },
  "committer": {
    "name": "Paul Moore",
    "email": "pmoore@redhat.com",
    "time": "Wed Mar 19 16:46:18 2014 -0400"
  },
  "message": "selinux: correctly label /proc inodes in use before the policy is loaded\n\nThis patch is based on an earlier patch by Eric Paris, he describes\nthe problem below:\n\n  \"If an inode is accessed before policy load it will get placed on a\n   list of inodes to be initialized after policy load.  After policy\n   load we call inode_doinit() which calls inode_doinit_with_dentry()\n   on all inodes accessed before policy load.  In the case of inodes\n   in procfs that means we\u0027ll end up at the bottom where it does:\n\n     /* Default to the fs superblock SID. */\n     isec-\u003esid \u003d sbsec-\u003esid;\n\n     if ((sbsec-\u003eflags \u0026 SE_SBPROC) \u0026\u0026 !S_ISLNK(inode-\u003ei_mode)) {\n             if (opt_dentry) {\n                     isec-\u003esclass \u003d inode_mode_to_security_class(...)\n                     rc \u003d selinux_proc_get_sid(opt_dentry,\n                                               isec-\u003esclass,\n                                               \u0026sid);\n                     if (rc)\n                             goto out_unlock;\n                     isec-\u003esid \u003d sid;\n             }\n     }\n\n   Since opt_dentry is null, we\u0027ll never call selinux_proc_get_sid()\n   and will leave the inode labeled with the label on the superblock.\n   I believe a fix would be to mimic the behavior of xattrs.  Look\n   for an alias of the inode.  If it can\u0027t be found, just leave the\n   inode uninitialized (and pick it up later) if it can be found, we\n   should be able to call selinux_proc_get_sid() ...\"\n\nOn a system exhibiting this problem, you will notice a lot of files in\n/proc with the generic \"proc_t\" type (at least the ones that were\naccessed early in the boot), for example:\n\n   # ls -Z /proc/sys/kernel/shmmax | awk \u0027{ print $4 \" \" $5 }\u0027\n   system_u:object_r:proc_t:s0 /proc/sys/kernel/shmmax\n\nHowever, with this patch in place we see the expected result:\n\n   # ls -Z /proc/sys/kernel/shmmax | awk \u0027{ print $4 \" \" $5 }\u0027\n   system_u:object_r:sysctl_kernel_t:s0 /proc/sys/kernel/shmmax\n\nCc: Eric Paris \u003ceparis@redhat.com\u003e\nSigned-off-by: Paul Moore \u003cpmoore@redhat.com\u003e\nAcked-by: Eric Paris \u003ceparis@redhat.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "1dd948485e48a15bbcb7754fc4b634324ca26133",
      "old_mode": 33188,
      "old_path": "security/selinux/hooks.c",
      "new_id": "d5d67c93b65c818af7a6f544e09eb3c8508a7e3d",
      "new_mode": 33188,
      "new_path": "security/selinux/hooks.c"
    }
  ]
}