diff options
| author |   Stephen Smalley <sds@tycho.nsa.gov> | 2017-02-28 10:35:56 -0500 |
|---|---|---|
| committer |   James Morris <james.l.morris@oracle.com> | 2017-03-02 10:27:40 +1100 |
| commit | 2651225b5ebcdde60f684c4db8ec7e9e3800a74f (patch) | |
| tree | 73c955a7c52dbcbe7320ddb1fc823be6671d0a84 /security/selinux/selinuxfs.c | |
| parent | KEYS: Differentiate uses of rcu_dereference_key() and user_key_payload() (diff) | |
| download | linux-dev-2651225b5ebcdde60f684c4db8ec7e9e3800a74f.tar.xz linux-dev-2651225b5ebcdde60f684c4db8ec7e9e3800a74f.zip | |
selinux: wrap cgroup seclabel support with its own policy capability
commit 1ea0ce40690dff38935538e8dab7b12683ded0d3 ("selinux: allow
changing labels for cgroupfs") broke the Android init program,
which looks up security contexts whenever creating directories
and attempts to assign them via setfscreatecon().
When creating subdirectories in cgroup mounts, this would previously
be ignored since cgroup did not support userspace setting of security
contexts. However, after the commit, SELinux would attempt to honor
the requested context on cgroup directories and fail due to permission
denial. Avoid breaking existing userspace/policy by wrapping this change
with a conditional on a new cgroup_seclabel policy capability. This
preserves existing behavior until/unless a new policy explicitly enables
this capability.
Reported-by: John Stultz <john.stultz@linaro.org>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Diffstat (limited to 'security/selinux/selinuxfs.c')
| -rw-r--r-- | security/selinux/selinuxfs.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index c9e8a9898ce4..cb3fd98fb05a 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -46,7 +46,8 @@ static char *policycap_names[] = { "network_peer_controls", "open_perms", "extended_socket_class", - "always_check_network" + "always_check_network", + "cgroup_seclabel" }; unsigned int selinux_checkreqprot = CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE; |