From 901ef845fa2469c211ce3b1e955d9e7245ab5d50 Mon Sep 17 00:00:00 2001 From: Antonio Murdaca Date: Thu, 9 Feb 2017 17:02:42 +0100 Subject: selinux: allow per-file labeling for cgroupfs This patch allows genfscon per-file labeling for cgroupfs. For instance, this allows to label the "release_agent" file within each cgroup mount and limit writes to it. Signed-off-by: Antonio Murdaca [PM: subject line and merge tweaks] Signed-off-by: Paul Moore --- security/selinux/hooks.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'security') diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 2bd7b824b7f5..f803fdcde9cf 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -815,7 +815,9 @@ static int selinux_set_mnt_opts(struct super_block *sb, if (!strcmp(sb->s_type->name, "debugfs") || !strcmp(sb->s_type->name, "tracefs") || !strcmp(sb->s_type->name, "sysfs") || - !strcmp(sb->s_type->name, "pstore")) + !strcmp(sb->s_type->name, "pstore") || + !strcmp(sb->s_type->name, "cgroup") || + !strcmp(sb->s_type->name, "cgroup2")) sbsec->flags |= SE_SBGENFS; if (!sbsec->behavior) { -- cgit v1.2.3-59-g8ed1b