From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751508AbdBBOmn (ORCPT ); Thu, 2 Feb 2017 09:42:43 -0500 Received: from mail-wm0-f49.google.com ([74.125.82.49]:34176 "EHLO mail-wm0-f49.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750777AbdBBOml (ORCPT ); Thu, 2 Feb 2017 09:42:41 -0500 From: Antonio Murdaca X-Google-Original-From: Antonio Murdaca To: selinux@tycho.nsa.gov Cc: linux-kernel@vger.kernel.org, dwalsh@redhat.com, pmoore@redhat.com, vgoyal@redhat.com, cgroups@vger.kernel.org Subject: [PATCH] security: selinux: allow changing labels for cgroupfs Date: Thu, 2 Feb 2017 15:42:28 +0100 Message-Id: <20170202144228.24454-1-runcom@redhat.com> X-Mailer: git-send-email 2.9.3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch allows changing labels for cgroup mounts. Previously, running chcon on cgroupfs would throw an "Operation not supported". This patch specifically whitelist cgroupfs. The patch could also allow containers to write only to the systemd cgroup for instance, while the other cgroups are kept with cgroup_t label. Signed-off-by: Antonio Murdaca --- security/selinux/hooks.c | 1 + 1 file changed, 1 insertion(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 3b955c6..4e84211 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -480,6 +480,7 @@ static int selinux_is_sblabel_mnt(struct super_block *sb) sbsec->behavior == SECURITY_FS_USE_NATIVE || /* Special handling. Genfs but also in-core setxattr handler */ !strcmp(sb->s_type->name, "sysfs") || + !strcmp(sb->s_type->name, "cgroup") || !strcmp(sb->s_type->name, "pstore") || !strcmp(sb->s_type->name, "debugfs") || !strcmp(sb->s_type->name, "tracefs") || -- 2.9.3