Stephen Smalley 2651225b5e selinux: wrap cgroup seclabel support with its own policy capability ... commit 1ea0ce4069 ("selinux: allow changing labels for cgroupfs") broke the Android init program, which looks up security contexts whenever creating directories and attempts to assign them via setfscreatecon(). When creating subdirectories in cgroup mounts, this would previously be ignored since cgroup did not support userspace setting of security contexts. However, after the commit, SELinux would attempt to honor the requested context on cgroup directories and fail due to permission denial. Avoid breaking existing userspace/policy by wrapping this change with a conditional on a new cgroup_seclabel policy capability. This preserves existing behavior until/unless a new policy explicitly enables this capability. Reported-by: John Stultz <john.stultz@linaro.org> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com> Signed-off-by: James Morris <james.l.morris@oracle.com>		2017-03-02 10:27:40 +11:00
..
audit.h	SELinux: keep the code clean formating and syntax	2008-07-14 15:01:36 +10:00
avc.h	Merge branch 'next' of git://git.infradead.org/users/pcmoore/selinux into next	2015-08-15 13:29:57 +10:00
avc_ss.h	selinux: sparse fix: fix several warnings in the security server code	2011-09-09 16:56:32 -07:00
classmap.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next	2017-02-22 10:15:09 -08:00
conditional.h	selinux: Change bool variable name to index.	2016-04-14 11:24:50 -04:00
initial_sid_to_string.h	selinux: const strings in tables	2010-03-08 09:33:53 +11:00
netif.h	selinux: make the netif cache namespace aware	2014-09-10 17:09:57 -04:00
netlabel.h	netlabel: Pass a family parameter to netlbl_skbuff_err().	2016-06-27 15:06:16 -04:00
netnode.h	selinux: reduce the number of calls to synchronize_net() when flushing caches	2014-06-26 14:33:56 -04:00
netport.h	selinux: reduce the number of calls to synchronize_net() when flushing caches	2014-06-26 14:33:56 -04:00
objsec.h	selinux: clean up cred usage and simplify	2017-01-09 10:07:31 -05:00
security.h	selinux: wrap cgroup seclabel support with its own policy capability	2017-03-02 10:27:40 +11:00
xfrm.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2014-03-25 20:29:20 -04:00