valeriyvdovin / rpms / systemd

Forked from rpms/systemd 4 years ago
Clone

Blame SOURCES/0645-Fix-SELinux-labels-in-cgroup-filesystem-root-directo.patch

a9339c
From c043ae5b2ef2e1e437bf738bbf522799c6213230 Mon Sep 17 00:00:00 2001
a9339c
From: Krzysztof Nowicki <krzysztof.a.nowicki+github@gmail.com>
a9339c
Date: Thu, 30 Nov 2017 11:59:29 +0100
a9339c
Subject: [PATCH] Fix SELinux labels in cgroup filesystem root directory
a9339c
 (#7496)
a9339c
a9339c
When using SELinux with legacy cgroups the tmpfs on /sys/fs/cgroup is by
a9339c
default labelled as tmpfs_t. This label is also inherited by the "cpu"
a9339c
and "cpuacct" symbolic links. Unfortunately the policy expects them to
a9339c
be labelled as cgroup_t, which is used for all the actual cgroup
a9339c
filesystems. Failure to do so results in a stream of denials.
a9339c
a9339c
This state cannot be fixed reliably when the cgroup filesystem structure
a9339c
is set-up as the SELinux policy is not yet loaded at this
a9339c
moment. It also cannot be fixed later as the root of the cgroup
a9339c
filesystem is remounted read-only. In order to fix it the root of the
a9339c
cgroup filesystem needs to be temporary remounted read-write, relabelled
a9339c
and remounted back read-only.
a9339c
a9339c
(cherry picked from commit 8739f23e3c26bbf8b0296421578e56daa63cbf4b)
a9339c
---
a9339c
 src/core/mount-setup.c | 10 +++++++++-
a9339c
 1 file changed, 9 insertions(+), 1 deletion(-)
a9339c
a9339c
diff --git a/src/core/mount-setup.c b/src/core/mount-setup.c
a9339c
index 521545e5c..7a2cae4a3 100644
a9339c
--- a/src/core/mount-setup.c
a9339c
+++ b/src/core/mount-setup.c
a9339c
@@ -363,14 +363,22 @@ int mount_setup(bool loaded_policy) {
a9339c
                 usec_t before_relabel, after_relabel;
a9339c
                 char timespan[FORMAT_TIMESPAN_MAX];
a9339c
 
a9339c
+                mkdir_label("/run/systemd/policy-relabelling", 0755);
a9339c
                 before_relabel = now(CLOCK_MONOTONIC);
a9339c
 
a9339c
                 nftw("/dev", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
a9339c
                 nftw("/run", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
a9339c
 
a9339c
+                /* Temporarily remount the root cgroup filesystem to give it a proper label. */
a9339c
+                (void) mount(NULL, "/sys/fs/cgroup", NULL, MS_REMOUNT, NULL);
a9339c
+                label_fix("/sys/fs/cgroup", false, false);
a9339c
+                nftw("/sys/fs/cgroup", nftw_cb, 64, FTW_MOUNT|FTW_PHYS|FTW_ACTIONRETVAL);
a9339c
+                (void) mount(NULL, "/sys/fs/cgroup", NULL, MS_REMOUNT|MS_RDONLY, NULL);
a9339c
+
a9339c
                 after_relabel = now(CLOCK_MONOTONIC);
a9339c
 
a9339c
-                log_info("Relabelled /dev and /run in %s.",
a9339c
+                mkdir_label("/run/systemd/policy-relabelled", 0755);
a9339c
+                log_info("Relabelled /dev, /run and /sys/fs/cgroup in %s.",
a9339c
                          format_timespan(timespan, sizeof(timespan), after_relabel - before_relabel, 0));
a9339c
         }
a9339c
 #endif