From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752045AbdBBQJe (ORCPT ); Thu, 2 Feb 2017 11:09:34 -0500 Received: from mx1.redhat.com ([209.132.183.28]:38830 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750879AbdBBQJc (ORCPT ); Thu, 2 Feb 2017 11:09:32 -0500 Subject: Re: [PATCH v2] security: selinux: allow changing labels for cgroupfs To: Antonio Murdaca , selinux@tycho.nsa.gov References: <20170202152257.30220-1-runcom@redhat.com> Cc: linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, vgoyal@redhat.com From: Daniel J Walsh Message-ID: Date: Thu, 2 Feb 2017 11:08:36 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.6.0 MIME-Version: 1.0 In-Reply-To: <20170202152257.30220-1-runcom@redhat.com> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Thu, 02 Feb 2017 16:08:37 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org We need this patch set to tighten security inside of containers to only allow certain directories in the cgroup file system to be used by the containers. In order to make this work, SELinux policy also needs to be modified. On 02/02/2017 10:22 AM, Antonio Murdaca wrote: > This patch allows changing labels for cgroup mounts. Previously, running > chcon on cgroupfs would throw an "Operation not supported". This patch > specifically whitelist cgroupfs. > > The patch could also allow containers to write only to the systemd cgroup > for instance, while the other cgroups are kept with cgroup_t label. > > Signed-off-by: Antonio Murdaca > --- > Changes in v2: > - whitelist cgroup2 fs type > > security/selinux/hooks.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 3b955c6..2789f0a 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb) > sbsec->behavior == SECURITY_FS_USE_NATIVE || > /* Special handling. Genfs but also in-core setxattr handler */ > !strcmp(sb->s_type->name, "sysfs") || > + !strcmp(sb->s_type->name, "cgroup") || > + !strcmp(sb->s_type->name, "cgroup2") || > !strcmp(sb->s_type->name, "pstore") || > !strcmp(sb->s_type->name, "debugfs") || > !strcmp(sb->s_type->name, "tracefs") ||