* [PATCH] security: selinux: allow changing labels for cgroupfs
@ 2017-02-02 14:42 Antonio Murdaca
2017-02-02 15:01 ` Gary Tierney
0 siblings, 1 reply; 3+ messages in thread
From: Antonio Murdaca @ 2017-02-02 14:42 UTC (permalink / raw)
To: selinux; +Cc: linux-kernel, dwalsh, pmoore, vgoyal, cgroups
This patch allows changing labels for cgroup mounts. Previously, running
chcon on cgroupfs would throw an "Operation not supported". This patch
specifically whitelist cgroupfs.
The patch could also allow containers to write only to the systemd cgroup
for instance, while the other cgroups are kept with cgroup_t label.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
---
security/selinux/hooks.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3b955c6..4e84211 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -480,6 +480,7 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
sbsec->behavior == SECURITY_FS_USE_NATIVE ||
/* Special handling. Genfs but also in-core setxattr handler */
!strcmp(sb->s_type->name, "sysfs") ||
+ !strcmp(sb->s_type->name, "cgroup") ||
!strcmp(sb->s_type->name, "pstore") ||
!strcmp(sb->s_type->name, "debugfs") ||
!strcmp(sb->s_type->name, "tracefs") ||
--
2.9.3
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] security: selinux: allow changing labels for cgroupfs
2017-02-02 14:42 [PATCH] security: selinux: allow changing labels for cgroupfs Antonio Murdaca
@ 2017-02-02 15:01 ` Gary Tierney
2017-02-02 15:35 ` Antonio Murdaca
0 siblings, 1 reply; 3+ messages in thread
From: Gary Tierney @ 2017-02-02 15:01 UTC (permalink / raw)
To: selinux; +Cc: amurdaca, cgroups, linux-kernel, vgoyal
On Thu, Feb 02, 2017 at 03:42:28PM +0100, Antonio Murdaca wrote:
> This patch allows changing labels for cgroup mounts. Previously, running
> chcon on cgroupfs would throw an "Operation not supported". This patch
> specifically whitelist cgroupfs.
>
> The patch could also allow containers to write only to the systemd cgroup
> for instance, while the other cgroups are kept with cgroup_t label.
>
> Signed-off-by: Antonio Murdaca <runcom@redhat.com>
> ---
> security/selinux/hooks.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 3b955c6..4e84211 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -480,6 +480,7 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
> sbsec->behavior == SECURITY_FS_USE_NATIVE ||
> /* Special handling. Genfs but also in-core setxattr handler */
> !strcmp(sb->s_type->name, "sysfs") ||
> + !strcmp(sb->s_type->name, "cgroup") ||
Should we also include "cgroup2" here, since they are defined as 2
distinct filesystems? https://github.com/SELinuxProject/selinux-kernel/blob/master/kernel/cgroup.c#L2314-L2326
> !strcmp(sb->s_type->name, "pstore") ||
> !strcmp(sb->s_type->name, "debugfs") ||
> !strcmp(sb->s_type->name, "tracefs") ||
> --
> 2.9.3
>
> _______________________________________________
> Selinux mailing list
> Selinux@tycho.nsa.gov
> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] security: selinux: allow changing labels for cgroupfs
2017-02-02 15:01 ` Gary Tierney
@ 2017-02-02 15:35 ` Antonio Murdaca
0 siblings, 0 replies; 3+ messages in thread
From: Antonio Murdaca @ 2017-02-02 15:35 UTC (permalink / raw)
To: selinux, Antonio Murdaca, cgroups, linux-kernel, Vivek Goyal
On Thu, Feb 2, 2017 at 4:01 PM, Gary Tierney <gary.tierney@gmx.com> wrote:
> On Thu, Feb 02, 2017 at 03:42:28PM +0100, Antonio Murdaca wrote:
>> This patch allows changing labels for cgroup mounts. Previously, running
>> chcon on cgroupfs would throw an "Operation not supported". This patch
>> specifically whitelist cgroupfs.
>>
>> The patch could also allow containers to write only to the systemd cgroup
>> for instance, while the other cgroups are kept with cgroup_t label.
>>
>> Signed-off-by: Antonio Murdaca <runcom@redhat.com>
>> ---
>> security/selinux/hooks.c | 1 +
>> 1 file changed, 1 insertion(+)
>>
>> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
>> index 3b955c6..4e84211 100644
>> --- a/security/selinux/hooks.c
>> +++ b/security/selinux/hooks.c
>> @@ -480,6 +480,7 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
>> sbsec->behavior == SECURITY_FS_USE_NATIVE ||
>> /* Special handling. Genfs but also in-core setxattr handler */
>> !strcmp(sb->s_type->name, "sysfs") ||
>> + !strcmp(sb->s_type->name, "cgroup") ||
>
> Should we also include "cgroup2" here, since they are defined as 2
> distinct filesystems? https://github.com/SELinuxProject/selinux-kernel/blob/master/kernel/cgroup.c#L2314-L2326
likely yes
>
>> !strcmp(sb->s_type->name, "pstore") ||
>> !strcmp(sb->s_type->name, "debugfs") ||
>> !strcmp(sb->s_type->name, "tracefs") ||
>> --
>> 2.9.3
>>
>> _______________________________________________
>> Selinux mailing list
>> Selinux@tycho.nsa.gov
>> To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
>> To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
--
Antonio (runcom) Murdaca, RHCE
Senior Software Engineer - Containers
09B9 8F09 3E2D C310 E250 69B5 B2BE AD15 0DE9 36B9
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-02-02 15:35 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-02 14:42 [PATCH] security: selinux: allow changing labels for cgroupfs Antonio Murdaca
2017-02-02 15:01 ` Gary Tierney
2017-02-02 15:35 ` Antonio Murdaca
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).