When creating a new directory in a cgroup file system, the new directory by default should get the label of the parent directory. If I label a directory /sys/fs/cgroup/unified/system.slice/docker-UUID system_u:object_r:container_file_t:s0:c1,c2 Now I go into this directory and create a new directory. The directory ends up labeled as system_u:object_r:cgroup_t:s0 Where it should have been labeled system_u:object_r:container_file_t:s0:c1,c2 This bug is preventing us for further locking down containers, by allowing them to modify partial hiarchies.
I think that supporting this requires patching kernfs (used internally by cgroup) to call security_inode_init_security() on newly created files. See mm/shmem.c:shmem_mknod() for an example of how we do this for tmpfs.
any progress on this in fedora?
(In reply to Dusty Mabe from comment #9) > any progress on this in fedora? Nope, we don't have an upstream solution yet. I'll update this BZ when there is something significant to share. I spent a little bit of time on this a week (or two?) ago but I haven't been able to find any time to get back to it. You can find my notes, as well as Stephen's comments, in the upstream GitHub tracker linked to this BZ (look up top).
We really need this to move forward. Especially was we move towards RHEL8 and V2 cgroups.
Understood, it remains on the list, unfortunately I just haven't had time to work on it lately. Hopefully things will settle down a bit after Summit.
Initial series of patches posted upstream: https://lore.kernel.org/selinux/20190109091028.24485-1-omosnace@redhat.com/T/
Patches that resolve this issue are now merged upstream (last 7 patches): https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git/log/?h=e19dfdc83b60f196e0653d683499f7bc5548128f They should be available on some future Fedora version in kernel 5.2+.