Commit 1ea0ce40 authored by Antonio Murdaca's avatar Antonio Murdaca Committed by Paul Moore
Browse files

selinux: allow changing labels for cgroupfs 



This patch allows changing labels for cgroup mounts. Previously, running
chcon on cgroupfs would throw an "Operation not supported". This patch
specifically whitelist cgroupfs.

The patch could also allow containers to write only to the systemd cgroup
for instance, while the other cgroups are kept with cgroup_t label.

Signed-off-by: default avatarAntonio Murdaca <runcom@redhat.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 3a2f5a59

security/selinux/hooks.c

+2 −0
Original line number Diff line number Diff line
@@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb) 
		sbsec->behavior == SECURITY_FS_USE_NATIVE ||

		/* Special handling. Genfs but also in-core setxattr handler */

		!strcmp(sb->s_type->name, "sysfs") ||

		!strcmp(sb->s_type->name, "cgroup") ||

		!strcmp(sb->s_type->name, "cgroup2") ||

		!strcmp(sb->s_type->name, "pstore") ||

		!strcmp(sb->s_type->name, "debugfs") ||

		!strcmp(sb->s_type->name, "tracefs") ||

CRA Git | Maintained and supported by SUSTech CRA and CCSE