summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAntonio Murdaca <amurdaca@redhat.com>2017-02-02 18:22:57 +0300
committerPaul Moore <paul@paul-moore.com>2017-02-08 06:17:47 +0300
commit1ea0ce40690dff38935538e8dab7b12683ded0d3 (patch)
treee7d8de7dc6c8d750658a368b8301f1a6ab1527c0
parent3a2f5a59a695a73e0cde9a61e0feae5fa730e936 (diff)
downloadlinux-1ea0ce40690dff38935538e8dab7b12683ded0d3.tar.xz
selinux: allow changing labels for cgroupfs
This patch allows changing labels for cgroup mounts. Previously, running chcon on cgroupfs would throw an "Operation not supported". This patch specifically whitelist cgroupfs. The patch could also allow containers to write only to the systemd cgroup for instance, while the other cgroups are kept with cgroup_t label. Signed-off-by: Antonio Murdaca <runcom@redhat.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com>
-rw-r--r--security/selinux/hooks.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index a5398fea0966..76af95fa741a 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
sbsec->behavior == SECURITY_FS_USE_NATIVE ||
/* Special handling. Genfs but also in-core setxattr handler */
!strcmp(sb->s_type->name, "sysfs") ||
+ !strcmp(sb->s_type->name, "cgroup") ||
+ !strcmp(sb->s_type->name, "cgroup2") ||
!strcmp(sb->s_type->name, "pstore") ||
!strcmp(sb->s_type->name, "debugfs") ||
!strcmp(sb->s_type->name, "tracefs") ||