On Thu, Feb 9, 2017 at 10:58 AM, Antonio Murdaca <amurd...@redhat.com> wrote: > This patch allows genfscon per-file labeling for cgroupfs. For instance, > this allows to label the "release_agent" file within each > cgroup mount and limit writes to it. > > Signed-off-by: Antonio Murdaca <run...@redhat.com> > --- > security/selinux/hooks.c | 2 ++ > 1 file changed, 2 insertions(+)
Now that the merge window is behind us, let's get this merged, but could you update it to use the selinux_policycap_cgroupseclabel policy capability? See 2651225b5ebcdde ("selinux: wrap cgroup seclabel support with its own policy capability") for more information. Also, how goes the testing? > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 9a8f12f..5a3138e 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -808,6 +808,8 @@ static int selinux_set_mnt_opts(struct super_block *sb, > > if (!strcmp(sb->s_type->name, "debugfs") || > !strcmp(sb->s_type->name, "sysfs") || > + !strcmp(sb->s_type->name, "cgroup") || > + !strcmp(sb->s_type->name, "cgroup2") || > !strcmp(sb->s_type->name, "pstore")) > sbsec->flags |= SE_SBGENFS; > > -- > 2.9.3 > > _______________________________________________ > Selinux mailing list > seli...@tycho.nsa.gov > To unsubscribe, send email to selinux-le...@tycho.nsa.gov. > To get help, send an email containing "help" to selinux-requ...@tycho.nsa.gov. -- paul moore www.paul-moore.com