On Thu, Feb 9, 2017 at 11:02 AM, Antonio Murdaca <amurdaca@xxxxxxxxxx> wrote: > From: Antonio Murdaca <runcom@xxxxxxxxxx> > > This patch allows genfscon per-file labeling for cgroupfs. For instance, > this allows to label the "release_agent" file within each > cgroup mount and limit writes to it. > > Signed-off-by: Antonio Murdaca <amurdaca@xxxxxxxxxx> > --- > security/selinux/hooks.c | 2 ++ > 1 file changed, 2 insertions(+) This was already merged ... ? * https://marc.info/?l=selinux&m=148652458620202&w=2 > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 9a8f12f..5a3138e 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -808,6 +808,8 @@ static int selinux_set_mnt_opts(struct super_block *sb, > > if (!strcmp(sb->s_type->name, "debugfs") || > !strcmp(sb->s_type->name, "sysfs") || > + !strcmp(sb->s_type->name, "cgroup") || > + !strcmp(sb->s_type->name, "cgroup2") || > !strcmp(sb->s_type->name, "pstore")) > sbsec->flags |= SE_SBGENFS; > > -- > 2.9.3 -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line "unsubscribe cgroups" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
