I am not sure why libcgroup is moving locations for cgroupfs. Seems they now use /cgroup again, where they were using /sys/fs/cgroup a version before.
But since we added initial support for /sys/fs/cgroup, we might as well make that work i guess.
Signed-off-by: Dominick Grift <[email protected]>
---
:100644 100644 99482ca... ab8b7aa... M policy/modules/kernel/devices.if
:100644 100644 59bae6a... f0cce08... M policy/modules/kernel/filesystem.fc
:100644 100644 0dff98e... d5b1551... M policy/modules/kernel/filesystem.te
policy/modules/kernel/devices.if | 18 ++++++++++++++++++
policy/modules/kernel/filesystem.fc | 4 +++-
policy/modules/kernel/filesystem.te | 1 +
3 files changed, 22 insertions(+), 1 deletions(-)
diff --git a/policy/modules/kernel/devices.if b/policy/modules/kernel/devices.if
index 99482ca..ab8b7aa 100644
--- a/policy/modules/kernel/devices.if
+++ b/policy/modules/kernel/devices.if
@@ -3613,6 +3613,24 @@ interface(`dev_manage_smartcard',`
########################################
## <summary>
+## Associate to sysfs filesystems.
+## </summary>
+## <param name="file_type">
+## <summary>
+## Type to be associated.
+## </summary>
+## </param>
+#
+interface(`dev_associate_sysfs',`
+ gen_require(`
+ type sysfs_t;
+ ')
+
+ allow $1 sysfs_t:filesystem associate;
+')
+
+########################################
+## <summary>
## Get the attributes of sysfs directories.
## </summary>
## <param name="domain">
diff --git a/policy/modules/kernel/filesystem.fc b/policy/modules/kernel/filesystem.fc
index 59bae6a..f0cce08 100644
--- a/policy/modules/kernel/filesystem.fc
+++ b/policy/modules/kernel/filesystem.fc
@@ -2,5 +2,7 @@
/dev/shm/.* <<none>>
/cgroup -d gen_context(system_u:object_r:cgroup_t,s0)
+/cgroup/.* <<none>>
-/sys/fs/cgroup(/.*)? <<none>>
+/sys/fs/cgroup -d gen_context(system_u:object_r:cgroup_t,s0)
+/sys/fs/cgroup/.* <<none>>
diff --git a/policy/modules/kernel/filesystem.te b/policy/modules/kernel/filesystem.te
index 0dff98e..d5b1551 100644
--- a/policy/modules/kernel/filesystem.te
+++ b/policy/modules/kernel/filesystem.te
@@ -71,6 +71,7 @@ type cgroup_t;
fs_type(cgroup_t)
files_type(cgroup_t)
files_mountpoint(cgroup_t)
+dev_associate_sysfs(cgroup_t)
genfscon cgroup / gen_context(system_u:object_r:cgroup_t,s0)
type configfs_t;
--
1.7.2.3
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20101008/b643373b/attachment.bin
On Fri, 8 Oct 2010 23:28:01 +0200
Dominick Grift <[email protected]> wrote:
> I am not sure why libcgroup is moving locations for cgroupfs. Seems
> they now use /cgroup again, where they were using /sys/fs/cgroup a
> version before.
https://bugzilla.redhat.com/show_bug.cgi?id=640282
It'll move back again for F-15.
Paul.
On 10/09/10 09:39, Paul Howarth wrote:
> On Fri, 8 Oct 2010 23:28:01 +0200
> Dominick Grift<[email protected]> wrote:
>
>> I am not sure why libcgroup is moving locations for cgroupfs. Seems
>> they now use /cgroup again, where they were using /sys/fs/cgroup a
>> version before.
>
> https://bugzilla.redhat.com/show_bug.cgi?id=640282
>
> It'll move back again for F-15.
I'm going to pass on this change for now.
--
Chris PeBenito
Tresys Technology, LLC
http://www.tresys.com | oss.tresys.com
On Mon, Oct 11, 2010 at 10:35:31AM -0400, Christopher J. PeBenito wrote:
> On 10/09/10 09:39, Paul Howarth wrote:
> > On Fri, 8 Oct 2010 23:28:01 +0200
> > Dominick Grift<[email protected]> wrote:
> >
> >> I am not sure why libcgroup is moving locations for cgroupfs. Seems
> >> they now use /cgroup again, where they were using /sys/fs/cgroup a
> >> version before.
> >
> > https://bugzilla.redhat.com/show_bug.cgi?id=640282
> >
> > It'll move back again for F-15.
>
> I'm going to pass on this change for now.
Good call, it wont work anyways. sysfs is a pseudo fs so type cgroup_t for /sys/fs/cgroup wont apply at boot.
So if they move to that location we either need to allow libcgroup to mounon sysfs_t or it needs some magic in the kernel to label that dir cgroup_t.
But thats for f15..
i do have some cgroup related patches in the pipeline for f14 (initrc_t (cgreds and cgconfigs rc scripts need to read their config files :( )
>
> --
> Chris PeBenito
> Tresys Technology, LLC
> http://www.tresys.com | oss.tresys.com
> _______________________________________________
> refpolicy mailing list
> refpolicy at oss.tresys.com
> http://oss.tresys.com/mailman/listinfo/refpolicy
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 198 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20101011/9c25361f/attachment.bin