linux-kernel - About commit 901ef845fa2469c ("selinux: allow per-file labeling for cgroupfs")

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 6 Oct 2017 13:53:07 -0400
From:   Waiman Long <longman@...hat.com>
To:     Antonio Murdaca <runcom@...hat.com>
Cc:     Paul Moore <paul@...l-moore.com>,
        Stephen Smalley <sds@...ho.nsa.gov>, selinux@...ho.nsa.gov,
        Tejun Heo <tj@...nel.org>, lkml <linux-kernel@...r.kernel.org>
Subject: About commit 901ef845fa2469c ("selinux: allow per-file labeling for
 cgroupfs")

Antonio,

I have a question about your 4.14 upstream commit 901ef845fa2469c
("selinux: allow per-file labeling for cgroupfs"). With that, I am no
longer able to mount the cgroup2 filesystem with a 4.14 kernel. The
problem is that your commit sets the SE_SBGENFS flag, which causes
selinux to lookup the genfs database for a filesystem type match.
However, the filesystem type "cgroup2" isn't in the genfs database in my
RHEL7 based test system. The "cgroup" filesystem type is in the genfs database,
so I have no problem with v1 cgroup mount.

Do you know where the genfs database is defined? I need some way to add cgroup2
as a valid genfs fstype, or I have to manually back out the commit in order to
do my cgroup2 testing.

Thanks,
Longman