selinux.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Ondrej Mosnacek <omosnace@redhat.com>
To: selinux@vger.kernel.org, Paul Moore <paul@paul-moore.com>,
	cgroups@vger.kernel.org, Tejun Heo <tj@kernel.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>,
	Li Zefan <lizefan@huawei.com>,
	Johannes Weiner <hannes@cmpxchg.org>,
	Ondrej Mosnacek <omosnace@redhat.com>
Subject: [RFC PATCH 1/3] cgroup: fix parsing empty mount option string
Date: Thu, 13 Dec 2018 15:17:37 +0100	[thread overview]
Message-ID: <20181213141739.8534-2-omosnace@redhat.com> (raw)
In-Reply-To: <20181213141739.8534-1-omosnace@redhat.com>

This fixes the case where all mount options specified are consumed by an
LSM and all that's left is an empty string. In this case cgroupfs should
accept the string and not fail.

How to reproduce (with SELinux enabled):

    # umount /sys/fs/cgroup/unified
    # mount -o context=system_u:object_r:cgroup_t:s0 -t cgroup2 cgroup2 /sys/fs/cgroup/unified
    mount: /sys/fs/cgroup/unified: wrong fs type, bad option, bad superblock on cgroup2, missing codepage or helper program, or other error.
    # dmesg | tail -n 1
    [   31.575952] cgroup: cgroup2: unknown option ""

Fixes: 67e9c74b8a87 ("cgroup: replace __DEVEL__sane_behavior with cgroup2 fs type")
[NOTE: should apply on top of commit 5136f6365ce3 ("cgroup: implement "nsdelegate" mount option"), older versions need manual rebase]
Suggested-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
---
 kernel/cgroup/cgroup.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c
index 6aaf5dd5383b..8cb616232035 100644
--- a/kernel/cgroup/cgroup.c
+++ b/kernel/cgroup/cgroup.c
@@ -1744,7 +1744,7 @@ static int parse_cgroup_root_flags(char *data, unsigned int *root_flags)
 
 	*root_flags = 0;
 
-	if (!data)
+	if (!data || *data == '\0')
 		return 0;
 
 	while ((token = strsep(&data, ",")) != NULL) {
-- 
2.19.2


  reply	other threads:[~2018-12-13 14:19 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-12-13 14:17 [RFC PATCH 0/3] Fix SELinux context mount with the cgroup filesystem Ondrej Mosnacek
2018-12-13 14:17 ` Ondrej Mosnacek [this message]
2018-12-13 16:03   ` [RFC PATCH 1/3] cgroup: fix parsing empty mount option string Tejun Heo
2018-12-28 15:14     ` Ondrej Mosnacek
2018-12-28 18:32       ` Tejun Heo
2018-12-13 14:17 ` [RFC PATCH 2/3] selinux: never allow relabeling on context mounts Ondrej Mosnacek
2018-12-13 16:18   ` Stephen Smalley
2018-12-18 15:38     ` Ondrej Mosnacek
2018-12-13 14:17 ` [RFC PATCH 3/3] selinux: do not override context " Ondrej Mosnacek
2018-12-13 16:27   ` Stephen Smalley
2018-12-18 15:50     ` Ondrej Mosnacek
2018-12-18 19:22       ` Stephen Smalley
2018-12-19 11:44         ` Ondrej Mosnacek

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20181213141739.8534-2-omosnace@redhat.com \
    --to=omosnace@redhat.com \
    --cc=cgroups@vger.kernel.org \
    --cc=hannes@cmpxchg.org \
    --cc=lizefan@huawei.com \
    --cc=paul@paul-moore.com \
    --cc=sds@tycho.nsa.gov \
    --cc=selinux@vger.kernel.org \
    --cc=tj@kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).