From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932151AbdBIQCt (ORCPT ); Thu, 9 Feb 2017 11:02:49 -0500 Received: from mail-wm0-f46.google.com ([74.125.82.46]:37835 "EHLO mail-wm0-f46.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753628AbdBIQCq (ORCPT ); Thu, 9 Feb 2017 11:02:46 -0500 From: Antonio Murdaca To: selinux@tycho.nsa.gov Cc: gary.tierney@gmx.com, linux-kernel@vger.kernel.org, dwalsh@redhat.com, pmoore@redhat.com, vgoyal@redhat.com, cgroups@vger.kernel.org, Antonio Murdaca Subject: [PATCH] security: selinux: allow per-file labeling for cgroupfs Date: Thu, 9 Feb 2017 17:02:42 +0100 Message-Id: <20170209160242.23405-1-amurdaca@redhat.com> X-Mailer: git-send-email 2.9.3 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Antonio Murdaca This patch allows genfscon per-file labeling for cgroupfs. For instance, this allows to label the "release_agent" file within each cgroup mount and limit writes to it. Signed-off-by: Antonio Murdaca --- security/selinux/hooks.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 9a8f12f..5a3138e 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -808,6 +808,8 @@ static int selinux_set_mnt_opts(struct super_block *sb, if (!strcmp(sb->s_type->name, "debugfs") || !strcmp(sb->s_type->name, "sysfs") || + !strcmp(sb->s_type->name, "cgroup") || + !strcmp(sb->s_type->name, "cgroup2") || !strcmp(sb->s_type->name, "pstore")) sbsec->flags |= SE_SBGENFS; -- 2.9.3