Stephen Smalley 7bb185edb0 selinux: fix mounting of cgroup2 under older policies ... commit 901ef845fa ("selinux: allow per-file labeling for cgroupfs") broke mounting of cgroup2 under older SELinux policies which lacked a genfscon rule for cgroup2. This prevents mounting of cgroup2 even when SELinux is permissive. Change the handling when there is no genfscon rule in policy to just mark the inode unlabeled and not return an error to the caller. This permits mounting and access if allowed by policy, e.g. to unconfined domains. I also considered changing the behavior of security_genfs_sid() to never return -ENOENT, but the current behavior is relied upon by other callers to perform caller-specific handling. Fixes: 901ef845fa ("selinux: allow per-file labeling for cgroupfs") CC: <stable@vger.kernel.org> Reported-by: Dmitry Vyukov <dvyukov@google.com> Reported-by: Waiman Long <longman@redhat.com> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Tested-by: Waiman Long <longman@redhat.com> Signed-off-by: Paul Moore <paul@paul-moore.com>		2018-09-04 18:02:52 -04:00
..
apparmor	+ Cleanups	2018-08-24 13:00:33 -07:00
integrity	Merge branch 'next-integrity' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2018-08-15 22:54:12 -07:00
keys	Merge git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux	2018-08-03 17:55:12 +08:00
loadpin	module: replace the existing LSM hook in init_module	2018-07-16 12:31:57 -07:00
selinux	selinux: fix mounting of cgroup2 under older policies	2018-09-04 18:02:52 -04:00
smack	Merge branch 'next-smack' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2018-08-15 22:49:04 -07:00
tomoyo	Kbuild updates for v4.19	2018-08-15 12:09:03 -07:00
yama	pids: introduce find_get_task_by_vpid() helper	2018-02-06 18:32:46 -08:00
Kconfig	- drop unneeded Kconfig "select BUG" (Kamal Mostafa)	2018-08-15 08:45:54 -07:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
commoncap.c	cap_inode_getsecurity: use d_find_any_alias() instead of d_find_alias()	2018-08-11 02:05:53 -05:00
device_cgroup.c	docs: fix broken references with multiple hints	2018-06-15 18:10:01 -03:00
inode.c	securityfs: add the ability to support symlinks	2017-06-08 12:51:43 -07:00
lsm_audit.c	audit: use inline function to get audit context	2018-05-14 17:24:18 -04:00
min_addr.c	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
security.c	init: allow initcall tables to be emitted using relative references	2018-08-22 10:52:47 -07:00