Stephen Smalley 2651225b5e selinux: wrap cgroup seclabel support with its own policy capability ... commit 1ea0ce4069 ("selinux: allow changing labels for cgroupfs") broke the Android init program, which looks up security contexts whenever creating directories and attempts to assign them via setfscreatecon(). When creating subdirectories in cgroup mounts, this would previously be ignored since cgroup did not support userspace setting of security contexts. However, after the commit, SELinux would attempt to honor the requested context on cgroup directories and fail due to permission denial. Avoid breaking existing userspace/policy by wrapping this change with a conditional on a new cgroup_seclabel policy capability. This preserves existing behavior until/unless a new policy explicitly enables this capability. Reported-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: James Morris <james.l.morris@oracle.com>		2017-03-02 10:27:40 +11:00
..
avtab.c	selinux: extended permissions for ioctls	2015-07-13 13:31:58 -04:00
avtab.h	selinux: extended permissions for ioctls	2015-07-13 13:31:58 -04:00
conditional.c	selinux: fix overflow and 0 length allocations	2016-08-30 15:45:50 -04:00
conditional.h	selinux: extended permissions for ioctls	2015-07-13 13:31:58 -04:00
constraint.h	SELinux: Update policy version to support constraints info	2013-11-19 17:34:23 -05:00
context.h	SELinux: allow default source/target selectors for user/role/range	2012-04-09 12:22:47 -04:00
ebitmap.c	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
ebitmap.h	netlabel: shorter names for the NetLabel catmap funcs/structs	2014-08-01 11:17:37 -04:00
hashtab.c	selinux: conditionally reschedule in hashtab_insert while loading selinux policy	2014-05-15 17:07:55 -04:00
hashtab.h
mls.c	selinux: reconcile security_netlbl_secattr_to_sid() and mls_import_netlbl_cat()	2015-04-06 20:15:55 -04:00
mls.h	doc: Update the email address for Paul Moore in various source files	2011-08-01 17:58:33 -07:00
mls_types.h	SELinux: Reduce overhead of mls_level_isvalid() function call	2013-07-25 13:02:18 -04:00
policydb.c	lib/vsprintf.c: remove %Z support	2017-02-27 18:43:47 -08:00
policydb.h	SELinux: Update policy version to support constraints info	2013-11-19 17:34:23 -05:00
services.c	selinux: wrap cgroup seclabel support with its own policy capability	2017-03-02 10:27:40 +11:00
services.h	selinux: extended permissions for ioctls	2015-07-13 13:31:58 -04:00
sidtab.c
sidtab.h
status.c
symtab.c
symtab.h