Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934058AbdCJUBQ (ORCPT ); Fri, 10 Mar 2017 15:01:16 -0500 Received: from mail-ua0-f195.google.com ([209.85.217.195]:34853 "EHLO mail-ua0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933269AbdCJUBG (ORCPT ); Fri, 10 Mar 2017 15:01:06 -0500 MIME-Version: 1.0 X-Originating-IP: [108.49.102.27] In-Reply-To: <20170209155823.22148-1-runcom@redhat.com> References: <20170209155823.22148-1-runcom@redhat.com> From: Paul Moore Date: Fri, 10 Mar 2017 15:01:04 -0500 Message-ID: Subject: Re: [PATCH] security: selinux: allow per-file labeling for cgroupfs To: Antonio Murdaca Cc: selinux@tycho.nsa.gov, linux-kernel@vger.kernel.org, cgroups@vger.kernel.org, vgoyal@redhat.com Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1526 Lines: 42 On Thu, Feb 9, 2017 at 10:58 AM, Antonio Murdaca wrote: > This patch allows genfscon per-file labeling for cgroupfs. For instance, > this allows to label the "release_agent" file within each > cgroup mount and limit writes to it. > > Signed-off-by: Antonio Murdaca > --- > security/selinux/hooks.c | 2 ++ > 1 file changed, 2 insertions(+) Now that the merge window is behind us, let's get this merged, but could you update it to use the selinux_policycap_cgroupseclabel policy capability? See 2651225b5ebcdde ("selinux: wrap cgroup seclabel support with its own policy capability") for more information. Also, how goes the testing? > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 9a8f12f..5a3138e 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -808,6 +808,8 @@ static int selinux_set_mnt_opts(struct super_block *sb, > > if (!strcmp(sb->s_type->name, "debugfs") || > !strcmp(sb->s_type->name, "sysfs") || > + !strcmp(sb->s_type->name, "cgroup") || > + !strcmp(sb->s_type->name, "cgroup2") || > !strcmp(sb->s_type->name, "pstore")) > sbsec->flags |= SE_SBGENFS; > > -- > 2.9.3 > > _______________________________________________ > Selinux mailing list > Selinux@tycho.nsa.gov > To unsubscribe, send email to Selinux-leave@tycho.nsa.gov. > To get help, send an email containing "help" to Selinux-request@tycho.nsa.gov. -- paul moore www.paul-moore.com