Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 1553803

Summary:	RFE: CGROUP File system does not work correctly with SELinux labels
Product:	[Fedora] Fedora	Reporter:	Daniel Walsh <dwalsh>
Component:	kernel	Assignee:	Ondrej Mosnacek <omosnace>
Status:	CLOSED UPSTREAM	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	rawhide	CC:	airlied, bskeggs, dustymabe, eparis, ewk, hdegoede, ichavero, itamar, jarodwilson, jglisse, john.j5live, jonathan, josef, jpazdziora, kernel-maint, linville, lvrabec, mchehab, mgrepl, miabbott, mjg59, santiago, sds, ssekidde, steved, vgoyal
Target Milestone:	---
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1558179 (view as bug list)		Environment:
Last Closed:	2019-03-21 09:04:29 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1510139, 1558179

Description Daniel Walsh 2018-03-09 15:04:19 UTC

When creating a new directory in a cgroup file system, the new directory by default should get the label of the parent directory.

If I label a directory 

/sys/fs/cgroup/unified/system.slice/docker-UUID

system_u:object_r:container_file_t:s0:c1,c2

Now I go into this directory and create a new directory.

The directory ends up labeled as

system_u:object_r:cgroup_t:s0

Where it should have been labeled

system_u:object_r:container_file_t:s0:c1,c2

This bug is preventing us for further locking down containers, by allowing them to modify partial hiarchies.

Comment 1 Stephen Smalley 2018-03-09 15:22:39 UTC

I think that supporting this requires patching kernfs (used internally by cgroup) to call security_inode_init_security() on newly created files.  See mm/shmem.c:shmem_mknod() for an example of how we do this for tmpfs.

Comment 9 Dusty Mabe 2018-04-13 14:48:29 UTC

any progress on this in fedora?

Comment 10 Paul Moore 2018-04-13 16:34:22 UTC

(In reply to Dusty Mabe from comment #9)
> any progress on this in fedora?

Nope, we don't have an upstream solution yet.  I'll update this BZ when there is something significant to share.

I spent a little bit of time on this a week (or two?) ago but I haven't been able to find any time to get back to it.

You can find my notes, as well as Stephen's comments, in the upstream GitHub tracker linked to this BZ (look up top).

Comment 11 Daniel Walsh 2018-04-28 09:25:17 UTC

We really need this to move forward.  Especially was we move towards RHEL8 and V2 cgroups.

Comment 12 Paul Moore 2018-04-28 11:51:51 UTC

Understood, it remains on the list, unfortunately I just haven't had time to work on it lately. Hopefully things will settle down a bit after Summit.

Comment 14 Ondrej Mosnacek 2019-01-09 09:58:00 UTC

Initial series of patches posted upstream:
https://lore.kernel.org/selinux/20190109091028.24485-1-omosnace@redhat.com/T/

Comment 15 Ondrej Mosnacek 2019-03-21 09:04:29 UTC

Patches that resolve this issue are now merged upstream (last 7 patches):
https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git/log/?h=e19dfdc83b60f196e0653d683499f7bc5548128f

They should be available on some future Fedora version in kernel 5.2+.