Re: cgroup2 labeling question

[Dominick Grift <dominick.grift@defensec.nl>]

Stephen Smalley <stephen.smalley.work@gmail.com> writes:

> On Mon, Mar 20, 2023 at 1:28 PM Stephen Smalley
> <stephen.smalley.work@gmail.com> wrote:
>> Hmm...that's interesting. I just tried in Fedora using one of the
>> type_transitions already defined in the default policy and although it
>> appears to use the type_transition to compute the new SID for the
>> create check, ls -Z of the file after creation showed it labeled
>> cgroup_t instead. So it doesn't appear to be working or I am doing it
>> wrong.

I am totally confused now as well because Christian on IRC say's it
works for him but I cannot get it to work here and I tried various
combinations

>
> Reproducer, on F34,
> $ sudo mkdir /sys/fs/cgroup/system.slice/.snapshots
> mkdir: cannot create directory
> ‘/sys/fs/cgroup/system.slice/.snapshots’: Permission denied
> $ sudo ausearch -m AVC -ts recent -i
> ----
> type=AVC msg=audit(03/20/2023 13:00:04.699:47156) : avc:  denied  {
> associate } for  pid=152325 comm=mkdir name=.snapshots
> scontext=unconfined_u:object_r:snapperd_data_t:s0
> tcontext=system_u:object_r:cgroup_t:s0 tclass=filesystem permissive=0
> $ seinfo --fs_use | grep cgroup
> $ seinfo --genfscon | grep cgroup
>    genfscon cgroup /  system_u:object_r:cgroup_t:s0
>    genfscon cgroup2 /  system_u:object_r:cgroup_t:s0
> $ sesearch -T -s unconfined_t -t cgroup_t -c dir
> type_transition unconfined_t cgroup_t:dir snapperd_data_t .snapshots
> $ sudo setenforce 0
> $ sudo mkdir /sys/fs/cgroup/system.slice/.snapshots
> $ ls -Zd /sys/fs/cgroup/system.slice/.snapshots
> system_u:object_r:cgroup_t:s0 /sys/fs/cgroup/system.slice/.snapshots

-- 
gpg --locate-keys dominick.grift@defensec.nl
Key fingerprint = FCD2 3660 5D6B 9D27 7FC6  E0FF DA7E 521F 10F6 4098
Dominick Grift