Re: [PATCH v2] security: selinux: allow changing labels for cgroupfs
From: Paul Moore <hidden>
Date: 2017-02-08 03:31:02
Also in:
lkml, selinux
On Thu, Feb 2, 2017 at 10:22 AM, Antonio Murdaca [off-list ref] wrote:
This patch allows changing labels for cgroup mounts. Previously, running chcon on cgroupfs would throw an "Operation not supported". This patch specifically whitelist cgroupfs. The patch could also allow containers to write only to the systemd cgroup for instance, while the other cgroups are kept with cgroup_t label. Signed-off-by: Antonio Murdaca <redacted> --- Changes in v2: - whitelist cgroup2 fs type security/selinux/hooks.c | 2 ++ 1 file changed, 2 insertions(+)
Merged into selinux/next, thanks.
quoted hunk ↗ jump to hunk
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 3b955c6..2789f0a 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c@@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb) sbsec->behavior == SECURITY_FS_USE_NATIVE || /* Special handling. Genfs but also in-core setxattr handler */ !strcmp(sb->s_type->name, "sysfs") || + !strcmp(sb->s_type->name, "cgroup") || + !strcmp(sb->s_type->name, "cgroup2") || !strcmp(sb->s_type->name, "pstore") || !strcmp(sb->s_type->name, "debugfs") || !strcmp(sb->s_type->name, "tracefs") || --2.9.3
-- paul moore www.paul-moore.com _______________________________________________ Selinux mailing list Selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org To unsubscribe, send email to Selinux-leave-+05T5uksL2pAGbPMOrvdOA@public.gmane.org To get help, send an email containing "help" to Selinux-request-+05T5uksL2pAGbPMOrvdOA@public.gmane.org