From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1751823AbdBBTqU (ORCPT <rfc822;w@1wt.eu>);
        Thu, 2 Feb 2017 14:46:20 -0500
Received: from smtp.nsa.gov ([8.44.101.9]:34016 "EHLO emsm-gh1-uea11.nsa.gov"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1751120AbdBBTqS (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Thu, 2 Feb 2017 14:46:18 -0500
X-IronPort-AV: E=Sophos;i="5.33,326,1477958400"; 
   d="scan'208";a="2849352"
IronPort-PHdr: =?us-ascii?q?9a23=3AMjw70RWb7HflYhXMVZmqMIAIeWPV8LGtZVwlr6E/?=
 =?us-ascii?q?grcLSJyIuqrYZRSGvKdThVPEFb/W9+hDw7KP9fuxBSpesN3Y6iFKWacPfidNsd?=
 =?us-ascii?q?8RkQ0kDZzNImzAB9muURYHGt9fXkRu5XCxPBsdMs//Y1rPvi/6tmZKSV3wOgVv?=
 =?us-ascii?q?O+v6BJPZgdip2OCu4Z3TZBhDiCagbb9oIhi7qQrcutMXjIZmJao91wXFr39VcO?=
 =?us-ascii?q?lK2G1kIk6ekQzh7cmq5p5j9CpQu/Ml98FeVKjxYro1Q79FAjk4Km45/MLkuwXN?=
 =?us-ascii?q?QguJ/XscT34ZkgFUDAjf7RH1RYn+vy3nvedgwiaaPMn2TbcpWTS+6qpgVRHlhD?=
 =?us-ascii?q?sbOzM/7WrakdJ7gr5Frx29phx/24/Ub5+TNPpiZaPWYNcWSXNcUspNSyBNB4Wx?=
 =?us-ascii?q?YIUVD+oFIO1WsY/zqVUTphe6HAWgGv/jxjpOi3Tr36M1zv4hHBnF0gI9H9wArn?=
 =?us-ascii?q?rao9f7NKcVTe+7y6bHwzrYYvNK2jrw8pTEfwo9rfyOW797bMrfyVMoFwPAllie?=
 =?us-ascii?q?tJDlMC2N1uQNrWeb6fdrW/+qi2E9rwFxpiagx8cxgYTOnYIa10vE+D5lwIc1Od?=
 =?us-ascii?q?K4SEl7bcSiEJtLrS6WLYR2QsQ8Q2xxvisx174IuYajcSQXx5kqyATTZvyaf4SS?=
 =?us-ascii?q?/B7uW/idLS1liH9jZbmxnQy98VK6xe35TsS01VFKoTdbndTUrXAN0gDT6tCASv?=
 =?us-ascii?q?tg4ketwTaP2B7X6uFDOU00ibDUK4Qgwr4tjZofq1jDHy/ql0X2i6+abEMk9fSz?=
 =?us-ascii?q?6+v7eLnmo56cN4tshgH/NKQhhNC/DPwlPgUBUGWX4+Sx2KD58UHnT7hGkOc6nr?=
 =?us-ascii?q?TBvJDfP8sbp6q5AwFP0oYk7hayFyym38kDnXQcMFJEeA6Ij4juO13UJvD4Fu2w?=
 =?us-ascii?q?j06jkDds2fDKJqfhDYnVLnjfjLfheq5w61BTyAo0zdFQ/ZZUB6obIP3tR0DxtM?=
 =?us-ascii?q?bXDgMjPwOoxObnDc131pkCVmKXHq+ZLKTSvEeU6eIgOemMY5IVuC7mK/U++f7u?=
 =?us-ascii?q?gmE2mUUHcamqw5QXcna4EepiI0mDZnrsmNgBG38QvgUiVOzqlEGCUTlLana2Xq?=
 =?us-ascii?q?I84Cw7CY2/AYfAWI+tmrqB0zm/HpBNeGBGBU6DEW3ye4WHRfgMciSSLdFlkjAe?=
 =?us-ascii?q?UrihUYAh3wm0tADm07pnMvbU+ioAuJ350dh1+vfTmgwo+jNoFcuQyHuNQH9pkW?=
 =?us-ascii?q?MIXTA2wLpzrlB6yleGguBEhKlxE8BU4fJOGiInL5LVxOUyX9n3RxjNd9yAYEyr?=
 =?us-ascii?q?TtWvHXc6Sddnh5cVbkJ8HciypgzS1CqtRbkOnvqEA4Jn3Ljb2i3KO8tly3vAnJ?=
 =?us-ascii?q?Ikhl0iT9oHYXaqnYZj5gPTAMjPiEzfmKG0I/dPlBXR/XuOmDLd9HpTVxR9BOCc?=
 =?us-ascii?q?BygS?=
X-IPAS-Result: =?us-ascii?q?A2FCAwBPi5NY/wHyM5BdGQEBAQEBAQEBAQEBBwEBAQEBFAE?=
 =?us-ascii?q?BAQEBAQEBAQEBBwEBAQEBgyiBaoNXmmkBAQEGgSGTJoQchiICglZXAQEBAQEBA?=
 =?us-ascii?q?QECAQJfKIIzGwGCGwEFIwQLAUYQCw0BCgICJgICVwYBEolkDaw9gWs6JgKLAgE?=
 =?us-ascii?q?BAQEBBQEBAQEBAQEhgQuEfIUzh1OCXwWPNn6LKZIHilOGL5MHWIEUBwIRCBsPh?=
 =?us-ascii?q?xsiNYkDAQEB?=
Message-ID: <1486064805.1887.82.camel@tycho.nsa.gov>
Subject: Re: [PATCH v2] security: selinux: allow changing labels for cgroupfs
From: Stephen Smalley <sds@tycho.nsa.gov>
To: Antonio Murdaca <amurdaca@redhat.com>, selinux@tycho.nsa.gov
Cc: linux-kernel@vger.kernel.org, cgroups@vger.kernel.org,
        vgoyal@redhat.com
Date: Thu, 02 Feb 2017 14:46:45 -0500
In-Reply-To: <20170202152257.30220-1-runcom@redhat.com>
References: <20170202152257.30220-1-runcom@redhat.com>
Organization: National Security Agency
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.20.5 (3.20.5-1.fc24) 
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, 2017-02-02 at 16:22 +0100, Antonio Murdaca wrote:
> This patch allows changing labels for cgroup mounts. Previously,
> running
> chcon on cgroupfs would throw an "Operation not supported". This
> patch
> specifically whitelist cgroupfs.
> 
> The patch could also allow containers to write only to the systemd
> cgroup
> for instance, while the other cgroups are kept with cgroup_t label.
> 
> Signed-off-by: Antonio Murdaca <runcom@redhat.com>

Acked-by: Stephen Smalley <sds@tycho.nsa.gov>

> ---
> Changes in v2:
>   - whitelist cgroup2 fs type
> 
>  security/selinux/hooks.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 3b955c6..2789f0a 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct
> super_block *sb)
>  		sbsec->behavior == SECURITY_FS_USE_NATIVE ||
>  		/* Special handling. Genfs but also in-core setxattr
> handler */
>  		!strcmp(sb->s_type->name, "sysfs") ||
> +		!strcmp(sb->s_type->name, "cgroup") ||
> +		!strcmp(sb->s_type->name, "cgroup2") ||
>  		!strcmp(sb->s_type->name, "pstore") ||
>  		!strcmp(sb->s_type->name, "debugfs") ||
>  		!strcmp(sb->s_type->name, "tracefs") ||