From: Antonio Murdaca Date: Thu, 2 Feb 2017 15:22:57 +0000 (+0100) Subject: selinux: allow changing labels for cgroupfs X-Git-Tag: v4.11-rc1~138^2~8^2 X-Git-Url: https://asedeno.scripts.mit.edu/gitweb/?a=commitdiff_plain;h=1ea0ce40690dff38935538e8dab7b12683ded0d3;p=linux.git selinux: allow changing labels for cgroupfs This patch allows changing labels for cgroup mounts. Previously, running chcon on cgroupfs would throw an "Operation not supported". This patch specifically whitelist cgroupfs. The patch could also allow containers to write only to the systemd cgroup for instance, while the other cgroups are kept with cgroup_t label. Signed-off-by: Antonio Murdaca Acked-by: Stephen Smalley Signed-off-by: Paul Moore --- diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index a5398fea0966..76af95fa741a 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb) sbsec->behavior == SECURITY_FS_USE_NATIVE || /* Special handling. Genfs but also in-core setxattr handler */ !strcmp(sb->s_type->name, "sysfs") || + !strcmp(sb->s_type->name, "cgroup") || + !strcmp(sb->s_type->name, "cgroup2") || !strcmp(sb->s_type->name, "pstore") || !strcmp(sb->s_type->name, "debugfs") || !strcmp(sb->s_type->name, "tracefs") ||