Provide a userspace API to unshare the selinux namespace. Currently implemented via a selinuxfs node. This could be coupled with unsharing of other namespaces (e.g. mount namespace, network namespace) that will always be needed or left independent. Don't get hung up on the interface itself, it is just to allow experimentation and testing. Sample usage: sudo bash echo 1 > /sys/fs/selinux/unshare # unshare SELinux namespace unshare -m -n # unshare mount and network namespaces umount /sys/fs/selinux # unmount parent selinuxns mount -t selinuxfs none /sys/fs/selinux # mount child selinuxns id # view initial SID in child namespace, now kernel/init load_policy # load a policy into child namespace id # view context in child namespace after policy load getenforce # check enforcing status of child namespace The above will show that the process now views itself as running in the kernel/init domain in permissive mode, as would be the case at boot.
