Re: Labeling nsfs filesystem

2016-01-08 Thread Christopher J. PeBenito
On 1/8/2016 9:13 AM, Stephen Smalley wrote: > On 01/08/2016 08:00 AM, Christopher J. PeBenito wrote: >> On 1/7/2016 4:19 PM, Stephen Smalley wrote: >>> On 01/07/2016 03:36 PM, Nicolas Iooss wrote: Hello, Since Linux 3.19 targets of /proc/PID/ns/* symlinks have lived in a fs

Re: Labeling nsfs filesystem

2016-01-08 Thread Christopher J. PeBenito
On 1/7/2016 4:19 PM, Stephen Smalley wrote: > On 01/07/2016 03:36 PM, Nicolas Iooss wrote: >> Hello, >> >> Since Linux 3.19 targets of /proc/PID/ns/* symlinks have lived in a fs >> separated from /proc, named nsfs [1]. These targets are used to enter >> the namespace of another process by using

Re: Labeling nsfs filesystem

2016-01-08 Thread Stephen Smalley
On 01/08/2016 08:00 AM, Christopher J. PeBenito wrote: On 1/7/2016 4:19 PM, Stephen Smalley wrote: On 01/07/2016 03:36 PM, Nicolas Iooss wrote: Hello, Since Linux 3.19 targets of /proc/PID/ns/* symlinks have lived in a fs separated from /proc, named nsfs [1]. These targets are used to enter

Labeling nsfs filesystem

2016-01-07 Thread Nicolas Iooss
Hello, Since Linux 3.19 targets of /proc/PID/ns/* symlinks have lived in a fs separated from /proc, named nsfs [1]. These targets are used to enter the namespace of another process by using setns() syscall [2]. On old kernels, they were labeled with procfs default type (for example "getfilecon

Re: Labeling nsfs filesystem

2016-01-07 Thread Stephen Smalley
On 01/07/2016 03:36 PM, Nicolas Iooss wrote: Hello, Since Linux 3.19 targets of /proc/PID/ns/* symlinks have lived in a fs separated from /proc, named nsfs [1]. These targets are used to enter the namespace of another process by using setns() syscall [2]. On old kernels, they were labeled