Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]


Groups > linux.kernel > #1572465 > unrolled thread

[PATCH v2] security: selinux: allow changing labels for cgroupfs

Started byAntonio Murdaca <amurdaca@redhat.com>
First post2017-02-02 16:30 +0100
Last post2017-02-08 04:40 +0100
Articles 4 — 4 participants

Back to article view | Back to linux.kernel


Contents

  [PATCH v2] security: selinux: allow changing labels for cgroupfs Antonio Murdaca <amurdaca@redhat.com> - 2017-02-02 16:30 +0100
    Re: [PATCH v2] security: selinux: allow changing labels for cgroupfs Daniel J Walsh <dwalsh@redhat.com> - 2017-02-02 17:20 +0100
    Re: [PATCH v2] security: selinux: allow changing labels for cgroupfs Stephen Smalley <sds@tycho.nsa.gov> - 2017-02-02 20:50 +0100
    Re: [PATCH v2] security: selinux: allow changing labels for cgroupfs Paul Moore <paul@paul-moore.com> - 2017-02-08 04:40 +0100

#1572465 — [PATCH v2] security: selinux: allow changing labels for cgroupfs

FromAntonio Murdaca <amurdaca@redhat.com>
Date2017-02-02 16:30 +0100
Subject[PATCH v2] security: selinux: allow changing labels for cgroupfs
Message-ID<t6ruH-5L1-23@gated-at.bofh.it>
This patch allows changing labels for cgroup mounts. Previously, running
chcon on cgroupfs would throw an "Operation not supported". This patch
specifically whitelist cgroupfs.

The patch could also allow containers to write only to the systemd cgroup
for instance, while the other cgroups are kept with cgroup_t label.

Signed-off-by: Antonio Murdaca <runcom@redhat.com>
---
Changes in v2:
  - whitelist cgroup2 fs type

 security/selinux/hooks.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3b955c6..2789f0a 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
 		sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 		/* Special handling. Genfs but also in-core setxattr handler */
 		!strcmp(sb->s_type->name, "sysfs") ||
+		!strcmp(sb->s_type->name, "cgroup") ||
+		!strcmp(sb->s_type->name, "cgroup2") ||
 		!strcmp(sb->s_type->name, "pstore") ||
 		!strcmp(sb->s_type->name, "debugfs") ||
 		!strcmp(sb->s_type->name, "tracefs") ||
-- 
2.9.3

[toc] | [next] | [standalone]


#1572495

FromDaniel J Walsh <dwalsh@redhat.com>
Date2017-02-02 17:20 +0100
Message-ID<t6sh4-6ho-11@gated-at.bofh.it>
In reply to#1572465
We need this patch set to tighten security inside of containers to only
allow certain directories in the cgroup file system to be used by the
containers.  In order to make this work, SELinux policy also needs to be
modified.


On 02/02/2017 10:22 AM, Antonio Murdaca wrote:
> This patch allows changing labels for cgroup mounts. Previously, running
> chcon on cgroupfs would throw an "Operation not supported". This patch
> specifically whitelist cgroupfs.
>
> The patch could also allow containers to write only to the systemd cgroup
> for instance, while the other cgroups are kept with cgroup_t label.
>
> Signed-off-by: Antonio Murdaca <runcom@redhat.com>
> ---
> Changes in v2:
>   - whitelist cgroup2 fs type
>
>  security/selinux/hooks.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 3b955c6..2789f0a 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
>  		sbsec->behavior == SECURITY_FS_USE_NATIVE ||
>  		/* Special handling. Genfs but also in-core setxattr handler */
>  		!strcmp(sb->s_type->name, "sysfs") ||
> +		!strcmp(sb->s_type->name, "cgroup") ||
> +		!strcmp(sb->s_type->name, "cgroup2") ||
>  		!strcmp(sb->s_type->name, "pstore") ||
>  		!strcmp(sb->s_type->name, "debugfs") ||
>  		!strcmp(sb->s_type->name, "tracefs") ||

[toc] | [prev] | [next] | [standalone]


#1572705

FromStephen Smalley <sds@tycho.nsa.gov>
Date2017-02-02 20:50 +0100
Message-ID<t6vyh-8gz-13@gated-at.bofh.it>
In reply to#1572465
On Thu, 2017-02-02 at 16:22 +0100, Antonio Murdaca wrote:
> This patch allows changing labels for cgroup mounts. Previously,
> running
> chcon on cgroupfs would throw an "Operation not supported". This
> patch
> specifically whitelist cgroupfs.
> 
> The patch could also allow containers to write only to the systemd
> cgroup
> for instance, while the other cgroups are kept with cgroup_t label.
> 
> Signed-off-by: Antonio Murdaca <runcom@redhat.com>

Acked-by: Stephen Smalley <sds@tycho.nsa.gov>

> ---
> Changes in v2:
>   - whitelist cgroup2 fs type
> 
>  security/selinux/hooks.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 3b955c6..2789f0a 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct
> super_block *sb)
>  		sbsec->behavior == SECURITY_FS_USE_NATIVE ||
>  		/* Special handling. Genfs but also in-core setxattr
> handler */
>  		!strcmp(sb->s_type->name, "sysfs") ||
> +		!strcmp(sb->s_type->name, "cgroup") ||
> +		!strcmp(sb->s_type->name, "cgroup2") ||
>  		!strcmp(sb->s_type->name, "pstore") ||
>  		!strcmp(sb->s_type->name, "debugfs") ||
>  		!strcmp(sb->s_type->name, "tracefs") ||

[toc] | [prev] | [next] | [standalone]


#1576265

FromPaul Moore <paul@paul-moore.com>
Date2017-02-08 04:40 +0100
Message-ID<t8rgR-3hA-9@gated-at.bofh.it>
In reply to#1572465
On Thu, Feb 2, 2017 at 10:22 AM, Antonio Murdaca <amurdaca@redhat.com> wrote:
> This patch allows changing labels for cgroup mounts. Previously, running
> chcon on cgroupfs would throw an "Operation not supported". This patch
> specifically whitelist cgroupfs.
>
> The patch could also allow containers to write only to the systemd cgroup
> for instance, while the other cgroups are kept with cgroup_t label.
>
> Signed-off-by: Antonio Murdaca <runcom@redhat.com>
> ---
> Changes in v2:
>   - whitelist cgroup2 fs type
>
>  security/selinux/hooks.c | 2 ++
>  1 file changed, 2 insertions(+)

Merged into selinux/next, thanks.

> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 3b955c6..2789f0a 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -480,6 +480,8 @@ static int selinux_is_sblabel_mnt(struct super_block *sb)
>                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
>                 /* Special handling. Genfs but also in-core setxattr handler */
>                 !strcmp(sb->s_type->name, "sysfs") ||
> +               !strcmp(sb->s_type->name, "cgroup") ||
> +               !strcmp(sb->s_type->name, "cgroup2") ||
>                 !strcmp(sb->s_type->name, "pstore") ||
>                 !strcmp(sb->s_type->name, "debugfs") ||
>                 !strcmp(sb->s_type->name, "tracefs") ||
> --
> 2.9.3

-- 
paul moore
www.paul-moore.com

[toc] | [prev] | [standalone]


Back to top | Article view | linux.kernel


csiph-web