On Thu, 2017-02-02 at 16:22 +0100, Antonio Murdaca wrote: > This patch allows changing labels for cgroup mounts. Previously, > running > chcon on cgroupfs would throw an "Operation not supported". This > patch > specifically whitelist cgroupfs. > > The patch could also allow containers to write only to the systemd > cgroup > for instance, while the other cgroups are kept with cgroup_t label. > > Signed-off-by: Antonio Murdaca <runcom@xxxxxxxxxx> Acked-by: Stephen Smalley <sds@xxxxxxxxxxxxx> > --- > Changes in v2: > - whitelist cgroup2 fs type > > security/selinux/hooks.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 3b955c6..2789f0a 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct > super_block *sb) > sbsec->behavior == SECURITY_FS_USE_NATIVE || > /* Special handling. Genfs but also in-core setxattr > handler */ > !strcmp(sb->s_type->name, "sysfs") || > + !strcmp(sb->s_type->name, "cgroup") || > + !strcmp(sb->s_type->name, "cgroup2") || > !strcmp(sb->s_type->name, "pstore") || > !strcmp(sb->s_type->name, "debugfs") || > !strcmp(sb->s_type->name, "tracefs") || _______________________________________________ Selinux mailing list Selinux@xxxxxxxxxxxxx To unsubscribe, send email to Selinux-leave@xxxxxxxxxxxxx. To get help, send an email containing "help" to Selinux-request@xxxxxxxxxxxxx.
