{"push_id":673202778,"size":1,"distinct_size":1,"ref":"refs/heads/lollipop-caf","head":"39d2454b9399cff35b00e6a233195810e38c030e","before":"fe774ad5cdf8ef2793f7633d3035647af2f23f54","commits":[{"sha":"39d2454b9399cff35b00e6a233195810e38c030e","author":{"email":"d6e1285e1c84d3d5885c2124fdacc780e9fc0a94@tycho.nsa.gov","name":"Stephen Smalley"},"message":"selinux: enable per-file labeling for debugfs files.\n\nupstream commit 6f29997f4a3117169eeabd41dbea4c1bd94a739c\n\nAdd support for per-file labeling of debugfs files so that\nwe can distinguish them in policy.  This is particularly\nimportant in Android where certain debugfs files have to be writable\nby apps and therefore the debugfs directory tree can be read and\nsearched by all.\n\nSince debugfs is entirely kernel-generated, the directory tree is\nimmutable by userspace, and the inodes are pinned in memory, we can\nsimply use the same approach as with proc and label the inodes from\npolicy based on pathname from the root of the debugfs filesystem.\nGeneralize the existing labeling support used for proc and reuse it\nfor debugfs too.\n\n[sds:  Back-ported to 3.4.  superblock_security_struct flags field\nis only unsigned char in 3.4 so we have to redefine SE_SBGENFS.\nHowever, this definition is kernel-private, not exposed to userspace\nor stored anywhere persistent.  Also depends on\nI7742b4b7e53b45e4dd13d99c39553a927aa4a7e9.]\n\nChange-Id: I6460fbed6bb6bd36eb8554ac8c4fdd574edf3b07\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>","distinct":true,"url":"https://api.github.com/repos/moepda/android_kernel_samsung_hlte/commits/39d2454b9399cff35b00e6a233195810e38c030e"}]}