SELinux: don't check permissions for kernel mounts
Don't bother checking permissions when the kernel performs an
internal mount, as this should always be allowed.
Signed-off-by: James Morris <jmorris@namei.org>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 7465d71..853b58c 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2484,6 +2484,10 @@
if (rc)
return rc;
+ /* Allow all mounts performed by the kernel */
+ if (flags & MS_KERNMOUNT)
+ return 0;
+
AVC_AUDIT_DATA_INIT(&ad, FS);
ad.u.fs.path.dentry = sb->s_root;
return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);