diff options
| author | Stephen Smalley <sds@tycho.nsa.gov> | 2017-01-09 10:07:31 -0500 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2017-01-09 10:07:31 -0500 |
| commit | 01593d3299a1cfdb5e08acf95f63ec59dd674906 (patch) | |
| tree | 8effe4c871d480da9ac231fbeaab8caf68c9252b /lib/bust_spinlocks.c | |
| parent | ef37979a2cfa3905adbf0c2a681ce16c0aaea92d (diff) | |
| download | op-kernel-dev-01593d3299a1cfdb5e08acf95f63ec59dd674906.zip op-kernel-dev-01593d3299a1cfdb5e08acf95f63ec59dd674906.tar.gz | |
selinux: allow context mounts on tmpfs, ramfs, devpts within user namespaces
commit aad82892af261b9903cc11c55be3ecf5f0b0b4f8 ("selinux: Add support for
unprivileged mounts from user namespaces") prohibited any use of context
mount options within non-init user namespaces. However, this breaks
use of context mount options for tmpfs mounts within user namespaces,
which are being used by Docker/runc. There is no reason to block such
usage for tmpfs, ramfs or devpts. Exempt these filesystem types
from this restriction.
Before:
sh$ userns_child_exec -p -m -U -M '0 1000 1' -G '0 1000 1' bash
sh# mount -t tmpfs -o context=system_u:object_r:user_tmp_t:s0:c13 none /tmp
mount: tmpfs is write-protected, mounting read-only
mount: cannot mount tmpfs read-only
After:
sh$ userns_child_exec -p -m -U -M '0 1000 1' -G '0 1000 1' bash
sh# mount -t tmpfs -o context=system_u:object_r:user_tmp_t:s0:c13 none /tmp
sh# ls -Zd /tmp
unconfined_u:object_r:user_tmp_t:s0:c13 /tmp
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'lib/bust_spinlocks.c')
0 files changed, 0 insertions, 0 deletions
