Stephen Smalley 2651225b5e selinux: wrap cgroup seclabel support with its own policy capability ... commit 1ea0ce4069 ("selinux: allow changing labels for cgroupfs") broke the Android init program, which looks up security contexts whenever creating directories and attempts to assign them via setfscreatecon(). When creating subdirectories in cgroup mounts, this would previously be ignored since cgroup did not support userspace setting of security contexts. However, after the commit, SELinux would attempt to honor the requested context on cgroup directories and fail due to permission denial. Avoid breaking existing userspace/policy by wrapping this change with a conditional on a new cgroup_seclabel policy capability. This preserves existing behavior until/unless a new policy explicitly enables this capability. Reported-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: James Morris <james.l.morris@oracle.com>		2017-03-02 10:27:40 +11:00
..
apparmor	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2017-02-23 20:33:51 -08:00
integrity	ima: allow to check MAY_APPEND	2017-01-27 14:17:21 -05:00
keys	KEYS: Differentiate uses of rcu_dereference_key() and user_key_payload()	2017-03-02 10:09:00 +11:00
loadpin	LSM: Add /sys/kernel/security/lsm	2017-01-19 13:18:29 +11:00
selinux	selinux: wrap cgroup seclabel support with its own policy capability	2017-03-02 10:27:40 +11:00
smack	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2017-02-23 20:33:51 -08:00
tomoyo	LSM: Add /sys/kernel/security/lsm	2017-01-19 13:18:29 +11:00
yama	LSM: Add /sys/kernel/security/lsm	2017-01-19 13:18:29 +11:00
commoncap.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2017-02-23 20:33:51 -08:00
device_cgroup.c	security/device_cgroup: Fix RCU_LOCKDEP_WARN() condition	2015-09-03 18:13:10 -07:00
inode.c	LSM: Add /sys/kernel/security/lsm	2017-01-19 13:18:29 +11:00
Kconfig	Introduce STATIC_USERMODEHELPER to mediate call_usermodehelper()	2017-01-19 12:59:45 +01:00
lsm_audit.c	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2016-10-04 14:48:27 -07:00
Makefile	LSM: LoadPin for kernel file loading restrictions	2016-04-21 10:47:27 +10:00
min_addr.c
security.c	Merge branch 'stable-4.11' of git://git.infradead.org/users/pcmoore/selinux into next	2017-02-10 10:28:49 +11:00