Bug 1553803 - RFE: CGROUP File system does not work correctly with SELinux labels
Summary: RFE: CGROUP File system does not work correctly with SELinux labels
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: rawhide
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
Assignee: Ondrej Mosnacek
QA Contact: Fedora Extras Quality Assurance
Depends On:
Blocks: 1510139 1558178 1558179
TreeView+ depends on / blocked
Reported: 2018-03-09 15:04 UTC by Daniel Walsh
Modified: 2019-03-21 09:04 UTC (History)
26 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
: 1558178 1558179 (view as bug list)
Last Closed: 2019-03-21 09:04:29 UTC
Type: Bug

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github SELinuxProject selinux-kernel issues 39 0 None closed RFE: better labeling control over cgroupfs 2020-03-16 08:45:35 UTC

Description Daniel Walsh 2018-03-09 15:04:19 UTC
When creating a new directory in a cgroup file system, the new directory by default should get the label of the parent directory.

If I label a directory 



Now I go into this directory and create a new directory.

The directory ends up labeled as


Where it should have been labeled


This bug is preventing us for further locking down containers, by allowing them to modify partial hiarchies.

Comment 1 Stephen Smalley 2018-03-09 15:22:39 UTC
I think that supporting this requires patching kernfs (used internally by cgroup) to call security_inode_init_security() on newly created files.  See mm/shmem.c:shmem_mknod() for an example of how we do this for tmpfs.

Comment 9 Dusty Mabe 2018-04-13 14:48:29 UTC
any progress on this in fedora?

Comment 10 Paul Moore 2018-04-13 16:34:22 UTC
(In reply to Dusty Mabe from comment #9)
> any progress on this in fedora?

Nope, we don't have an upstream solution yet.  I'll update this BZ when there is something significant to share.

I spent a little bit of time on this a week (or two?) ago but I haven't been able to find any time to get back to it.

You can find my notes, as well as Stephen's comments, in the upstream GitHub tracker linked to this BZ (look up top).

Comment 11 Daniel Walsh 2018-04-28 09:25:17 UTC
We really need this to move forward.  Especially was we move towards RHEL8 and V2 cgroups.

Comment 12 Paul Moore 2018-04-28 11:51:51 UTC
Understood, it remains on the list, unfortunately I just haven't had time to work on it lately. Hopefully things will settle down a bit after Summit.

Comment 14 Ondrej Mosnacek 2019-01-09 09:58:00 UTC
Initial series of patches posted upstream:

Comment 15 Ondrej Mosnacek 2019-03-21 09:04:29 UTC
Patches that resolve this issue are now merged upstream (last 7 patches):

They should be available on some future Fedora version in kernel 5.2+.

Note You need to log in before you can comment on or make changes to this bug.