* [PATCH v2] security: selinux: allow changing labels for cgroupfs
@ 2017-02-02 15:22 Antonio Murdaca
2017-02-02 16:08 ` Daniel J Walsh
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Antonio Murdaca @ 2017-02-02 15:22 UTC (permalink / raw)
To: selinux; +Cc: gary.tierney, linux-kernel, dwalsh, pmoore, vgoyal, cgroups
This patch allows changing labels for cgroup mounts. Previously, running
chcon on cgroupfs would throw an "Operation not supported". This patch
specifically whitelist cgroupfs.
The patch could also allow containers to write only to the systemd cgroup
for instance, while the other cgroups are kept with cgroup_t label.
Signed-off-by: Antonio Murdaca <runcom@redhat.com>
---
Changes in v2:
- whitelist cgroup2 fs type
security/selinux/hooks.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3b955c6..2789f0a 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
sbsec->behavior == SECURITY_FS_USE_NATIVE ||
/* Special handling. Genfs but also in-core setxattr handler */
!strcmp(sb->s_type->name, "sysfs") ||
+ !strcmp(sb->s_type->name, "cgroup") ||
+ !strcmp(sb->s_type->name, "cgroup2") ||
!strcmp(sb->s_type->name, "pstore") ||
!strcmp(sb->s_type->name, "debugfs") ||
!strcmp(sb->s_type->name, "tracefs") ||
--
2.9.3
^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH v2] security: selinux: allow changing labels for cgroupfs
@ 2017-02-02 16:08 ` Daniel J Walsh
0 siblings, 0 replies; 7+ messages in thread
From: Daniel J Walsh @ 2017-02-02 16:08 UTC (permalink / raw)
To: Antonio Murdaca, selinux; +Cc: linux-kernel, cgroups, vgoyal
We need this patch set to tighten security inside of containers to only
allow certain directories in the cgroup file system to be used by the
containers. In order to make this work, SELinux policy also needs to be
modified.
On 02/02/2017 10:22 AM, Antonio Murdaca wrote:
> This patch allows changing labels for cgroup mounts. Previously, running
> chcon on cgroupfs would throw an "Operation not supported". This patch
> specifically whitelist cgroupfs.
>
> The patch could also allow containers to write only to the systemd cgroup
> for instance, while the other cgroups are kept with cgroup_t label.
>
> Signed-off-by: Antonio Murdaca <runcom@redhat.com>
> ---
> Changes in v2:
> - whitelist cgroup2 fs type
>
> security/selinux/hooks.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 3b955c6..2789f0a 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
> sbsec->behavior == SECURITY_FS_USE_NATIVE ||
> /* Special handling. Genfs but also in-core setxattr handler */
> !strcmp(sb->s_type->name, "sysfs") ||
> + !strcmp(sb->s_type->name, "cgroup") ||
> + !strcmp(sb->s_type->name, "cgroup2") ||
> !strcmp(sb->s_type->name, "pstore") ||
> !strcmp(sb->s_type->name, "debugfs") ||
> !strcmp(sb->s_type->name, "tracefs") ||
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2] security: selinux: allow changing labels for cgroupfs
@ 2017-02-02 16:08 ` Daniel J Walsh
0 siblings, 0 replies; 7+ messages in thread
From: Daniel J Walsh @ 2017-02-02 16:08 UTC (permalink / raw)
To: Antonio Murdaca, selinux-+05T5uksL2qpZYMLLGbcSA
Cc: linux-kernel-u79uwXL29TY76Z2rM5mHXA,
cgroups-u79uwXL29TY76Z2rM5mHXA, vgoyal-H+wXaHxf7aLQT0dZR+AlfA
We need this patch set to tighten security inside of containers to only
allow certain directories in the cgroup file system to be used by the
containers. In order to make this work, SELinux policy also needs to be
modified.
On 02/02/2017 10:22 AM, Antonio Murdaca wrote:
> This patch allows changing labels for cgroup mounts. Previously, running
> chcon on cgroupfs would throw an "Operation not supported". This patch
> specifically whitelist cgroupfs.
>
> The patch could also allow containers to write only to the systemd cgroup
> for instance, while the other cgroups are kept with cgroup_t label.
>
> Signed-off-by: Antonio Murdaca <runcom-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> ---
> Changes in v2:
> - whitelist cgroup2 fs type
>
> security/selinux/hooks.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 3b955c6..2789f0a 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
> sbsec->behavior == SECURITY_FS_USE_NATIVE ||
> /* Special handling. Genfs but also in-core setxattr handler */
> !strcmp(sb->s_type->name, "sysfs") ||
> + !strcmp(sb->s_type->name, "cgroup") ||
> + !strcmp(sb->s_type->name, "cgroup2") ||
> !strcmp(sb->s_type->name, "pstore") ||
> !strcmp(sb->s_type->name, "debugfs") ||
> !strcmp(sb->s_type->name, "tracefs") ||
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2] security: selinux: allow changing labels for cgroupfs
@ 2017-02-02 19:46 ` Stephen Smalley
0 siblings, 0 replies; 7+ messages in thread
From: Stephen Smalley @ 2017-02-02 19:46 UTC (permalink / raw)
To: Antonio Murdaca, selinux; +Cc: linux-kernel, cgroups, vgoyal
On Thu, 2017-02-02 at 16:22 +0100, Antonio Murdaca wrote:
> This patch allows changing labels for cgroup mounts. Previously,
> running
> chcon on cgroupfs would throw an "Operation not supported". This
> patch
> specifically whitelist cgroupfs.
>
> The patch could also allow containers to write only to the systemd
> cgroup
> for instance, while the other cgroups are kept with cgroup_t label.
>
> Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
> Changes in v2:
> - whitelist cgroup2 fs type
>
> security/selinux/hooks.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 3b955c6..2789f0a 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct
> super_block *sb)
> sbsec->behavior == SECURITY_FS_USE_NATIVE ||
> /* Special handling. Genfs but also in-core setxattr
> handler */
> !strcmp(sb->s_type->name, "sysfs") ||
> + !strcmp(sb->s_type->name, "cgroup") ||
> + !strcmp(sb->s_type->name, "cgroup2") ||
> !strcmp(sb->s_type->name, "pstore") ||
> !strcmp(sb->s_type->name, "debugfs") ||
> !strcmp(sb->s_type->name, "tracefs") ||
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2] security: selinux: allow changing labels for cgroupfs
@ 2017-02-02 19:46 ` Stephen Smalley
0 siblings, 0 replies; 7+ messages in thread
From: Stephen Smalley @ 2017-02-02 19:46 UTC (permalink / raw)
To: Antonio Murdaca, selinux-+05T5uksL2qpZYMLLGbcSA
Cc: cgroups-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
vgoyal-H+wXaHxf7aLQT0dZR+AlfA
On Thu, 2017-02-02 at 16:22 +0100, Antonio Murdaca wrote:
> This patch allows changing labels for cgroup mounts. Previously,
> running
> chcon on cgroupfs would throw an "Operation not supported". This
> patch
> specifically whitelist cgroupfs.
>
> The patch could also allow containers to write only to the systemd
> cgroup
> for instance, while the other cgroups are kept with cgroup_t label.
>
> Signed-off-by: Antonio Murdaca <runcom@redhat.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
> ---
> Changes in v2:
> - whitelist cgroup2 fs type
>
> security/selinux/hooks.c | 2 ++
> 1 file changed, 2 insertions(+)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 3b955c6..2789f0a 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct
> super_block *sb)
> sbsec->behavior == SECURITY_FS_USE_NATIVE ||
> /* Special handling. Genfs but also in-core setxattr
> handler */
> !strcmp(sb->s_type->name, "sysfs") ||
> + !strcmp(sb->s_type->name, "cgroup") ||
> + !strcmp(sb->s_type->name, "cgroup2") ||
> !strcmp(sb->s_type->name, "pstore") ||
> !strcmp(sb->s_type->name, "debugfs") ||
> !strcmp(sb->s_type->name, "tracefs") ||
_______________________________________________
Selinux mailing list
Selinux@tycho.nsa.gov
To unsubscribe, send email to Selinux-leave@tycho.nsa.gov.
To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2] security: selinux: allow changing labels for cgroupfs
@ 2017-02-08 3:29 ` Paul Moore
0 siblings, 0 replies; 7+ messages in thread
From: Paul Moore @ 2017-02-08 3:29 UTC (permalink / raw)
To: Antonio Murdaca; +Cc: selinux, linux-kernel, cgroups, vgoyal
On Thu, Feb 2, 2017 at 10:22 AM, Antonio Murdaca <amurdaca@redhat.com> wrote:
> This patch allows changing labels for cgroup mounts. Previously, running
> chcon on cgroupfs would throw an "Operation not supported". This patch
> specifically whitelist cgroupfs.
>
> The patch could also allow containers to write only to the systemd cgroup
> for instance, while the other cgroups are kept with cgroup_t label.
>
> Signed-off-by: Antonio Murdaca <runcom@redhat.com>
> ---
> Changes in v2:
> - whitelist cgroup2 fs type
>
> security/selinux/hooks.c | 2 ++
> 1 file changed, 2 insertions(+)
Merged into selinux/next, thanks.
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 3b955c6..2789f0a 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
> sbsec->behavior == SECURITY_FS_USE_NATIVE ||
> /* Special handling. Genfs but also in-core setxattr handler */
> !strcmp(sb->s_type->name, "sysfs") ||
> + !strcmp(sb->s_type->name, "cgroup") ||
> + !strcmp(sb->s_type->name, "cgroup2") ||
> !strcmp(sb->s_type->name, "pstore") ||
> !strcmp(sb->s_type->name, "debugfs") ||
> !strcmp(sb->s_type->name, "tracefs") ||
> --
> 2.9.3
--
paul moore
www.paul-moore.com
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH v2] security: selinux: allow changing labels for cgroupfs
@ 2017-02-08 3:29 ` Paul Moore
0 siblings, 0 replies; 7+ messages in thread
From: Paul Moore @ 2017-02-08 3:29 UTC (permalink / raw)
To: Antonio Murdaca
Cc: cgroups-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA,
selinux-+05T5uksL2qpZYMLLGbcSA, vgoyal-H+wXaHxf7aLQT0dZR+AlfA
On Thu, Feb 2, 2017 at 10:22 AM, Antonio Murdaca <amurdaca-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> wrote:
> This patch allows changing labels for cgroup mounts. Previously, running
> chcon on cgroupfs would throw an "Operation not supported". This patch
> specifically whitelist cgroupfs.
>
> The patch could also allow containers to write only to the systemd cgroup
> for instance, while the other cgroups are kept with cgroup_t label.
>
> Signed-off-by: Antonio Murdaca <runcom-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
> ---
> Changes in v2:
> - whitelist cgroup2 fs type
>
> security/selinux/hooks.c | 2 ++
> 1 file changed, 2 insertions(+)
Merged into selinux/next, thanks.
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 3b955c6..2789f0a 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
> sbsec->behavior == SECURITY_FS_USE_NATIVE ||
> /* Special handling. Genfs but also in-core setxattr handler */
> !strcmp(sb->s_type->name, "sysfs") ||
> + !strcmp(sb->s_type->name, "cgroup") ||
> + !strcmp(sb->s_type->name, "cgroup2") ||
> !strcmp(sb->s_type->name, "pstore") ||
> !strcmp(sb->s_type->name, "debugfs") ||
> !strcmp(sb->s_type->name, "tracefs") ||
> --
> 2.9.3
--
paul moore
www.paul-moore.com
_______________________________________________
Selinux mailing list
Selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org
To unsubscribe, send email to Selinux-leave-+05T5uksL2pAGbPMOrvdOA@public.gmane.org
To get help, send an email containing "help" to Selinux-request-+05T5uksL2pAGbPMOrvdOA@public.gmane.org
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2017-02-08 3:31 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-02-02 15:22 [PATCH v2] security: selinux: allow changing labels for cgroupfs Antonio Murdaca
2017-02-02 16:08 ` Daniel J Walsh
2017-02-02 16:08 ` Daniel J Walsh
2017-02-02 19:46 ` Stephen Smalley
2017-02-02 19:46 ` Stephen Smalley
2017-02-08 3:29 ` Paul Moore
2017-02-08 3:29 ` Paul Moore
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.