From 1200421b359c8f8a6fb5f1fa65cca867a45a4931 Mon Sep 17 00:00:00 2001 From: Antonio Murdaca Date: Thu, 9 Feb 2017 17:02:42 +0100 Subject: [PATCH] UPSTREAM: selinux: allow per-file labeling for cgroupfs This patch allows genfscon per-file labeling for cgroupfs. For instance, this allows to label the "release_agent" file within each cgroup mount and limit writes to it. Signed-off-by: Antonio Murdaca [PM: subject line and merge tweaks] Signed-off-by: Paul Moore Signed-off-by: Sorayukii --- security/selinux/hooks.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 6b33aa79a2c2..5029f5a9f53d 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -816,7 +816,9 @@ static int selinux_set_mnt_opts(struct super_block *sb, !strcmp(sb->s_type->name, "sysfs") || !strcmp(sb->s_type->name, "pstore") || !strcmp(sb->s_type->name, "bpf") || - !strcmp(sb->s_type->name, "binder")) + !strcmp(sb->s_type->name, "binder") || + !strcmp(sb->s_type->name, "cgroup") || + !strcmp(sb->s_type->name, "cgroup2")) sbsec->flags |= SE_SBGENFS; if (!sbsec->behavior) {