From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752389AbdBIQHQ (ORCPT ); Thu, 9 Feb 2017 11:07:16 -0500 Received: from mail-wm0-f52.google.com ([74.125.82.52]:38867 "EHLO mail-wm0-f52.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751062AbdBIQHN (ORCPT ); Thu, 9 Feb 2017 11:07:13 -0500 From: Antonio Murdaca X-Google-Original-From: Antonio Murdaca To: selinux@tycho.nsa.gov Cc: gary.tierney@gmx.com, linux-kernel@vger.kernel.org, dwalsh@redhat.com, pmoore@redhat.com, vgoyal@redhat.com, cgroups@vger.kernel.org Subject: [PATCH] security: selinux: allow per-file labeling for cgroupfs Date: Thu, 9 Feb 2017 16:58:23 +0100 Message-Id: <20170209155823.22148-1-runcom@redhat.com> X-Mailer: git-send-email 2.9.3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch allows genfscon per-file labeling for cgroupfs. For instance, this allows to label the "release_agent" file within each cgroup mount and limit writes to it. Signed-off-by: Antonio Murdaca --- security/selinux/hooks.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 9a8f12f..5a3138e 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -808,6 +808,8 @@ static int selinux_set_mnt_opts(struct super_block *sb, if (!strcmp(sb->s_type->name, "debugfs") || !strcmp(sb->s_type->name, "sysfs") || + !strcmp(sb->s_type->name, "cgroup") || + !strcmp(sb->s_type->name, "cgroup2") || !strcmp(sb->s_type->name, "pstore")) sbsec->flags |= SE_SBGENFS; -- 2.9.3