Invalidate selinux security label during inode invalidation.#145
Conversation
|
could you add a bit more detail in the commit message? |
|
@kchen-ddn Could you submit to upstream linux? |
Add security_inode_invalidate_secctx() call to invalidate cached security context when inode attributes change. This ensures that SELinux security labels are properly refreshed and prevents stale security context from being used after inode modifications. Signed-off-by: Kevin Chen <kchen@ddn.com>
kchen-ddn
force-pushed
the
selinux_label_inval_new
branch
from
46407a5 to
44061e6
Compare
Done. |
Sure, I'll create a PR. |
|
@bsbernd @kchen-ddn what other linux versions will need this? I'm not entirely sure this will actually work for RHEL9_4 etc. |
Sorry, why is that? This security_inode_invalidate_secctx() is introduced in kernel version 4.5, so I think RHEL9_4 should also have it. |
I was worried about semantics, but if you checked, we're fine. |
3 participants
Setting SELinux security label on one client node should invalidate cached security label on other nodes.
Add security_inode_invalidate_secctx() in fuse_reverse_inval_inode() to do so.