smack-team/smack — pull request #105 by jobol (2014-03-27 15:39:18+00:00)
Title: libsmack: `verify_smackfs_mnt` wrongly expects smackfs to be writable

Mounting the SMACKFS read-only has side effect on commands 'id', 'ls', 'ps', ... because libsmack refuses to detect SMACKFS when it is mounted read-only.

I guess that this behaviour is because many features of libsmack are expecting write permission.

The current behaviour doesn't seems to be consistent with the reality: SMACKFS is mounted and SMACK security is active.

You can't write it? Do you have the CAP_MAC_ADMIN? Is it read-only mounted? Does function `verify_smackfs_mnt` refuse to validate the filesystem when CAP_MAC_ADMIN is off? No.