48 lines
1.7 KiB
Diff
48 lines
1.7 KiB
Diff
|
From 641a7f0c61ff42ea55ad7152e7f874ea5d680a2d Mon Sep 17 00:00:00 2001
|
||
|
|
From: Dan Walsh <dwalsh@redhat.com>
|
||
|
|
Date: Wed, 9 Mar 2016 09:29:25 -0500
|
||
|
|
Subject: [PATCH] /dev/console must be labeled with SELinux label
|
||
|
|
|
||
|
|
If the user specifies an selinux_apifs_context all content created in
|
||
|
|
the container including /dev/console should use this label.
|
||
|
|
|
||
|
|
Currently when this uses the default label it gets labeled user_devpts_t,
|
||
|
|
which would require us to write a policy allowing container processes to
|
||
|
|
manage user_devpts_t. This means that an escaped process would be allowed
|
||
|
|
to attack all users terminals as well as other container terminals. Changing
|
||
|
|
the label to match the apifs_context, means the processes would only be allowed
|
||
|
|
to manage their specific tty.
|
||
|
|
|
||
|
|
This change fixes a problem preventing RKT containers from working with systemd-nspawn.
|
||
|
|
|
||
|
|
(cherry picked from commit 68b020494d1ff085281061413d9236b5865ef238)
|
||
|
|
---
|
||
|
|
src/nspawn/nspawn.c | 7 +++++++
|
||
|
|
1 file changed, 7 insertions(+)
|
||
|
|
|
||
|
|
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
|
||
|
|
index ef348c335b..8c06f6ef75 100644
|
||
|
|
--- a/src/nspawn/nspawn.c
|
||
|
|
+++ b/src/nspawn/nspawn.c
|
||
|
|
@@ -87,6 +87,7 @@
|
||
|
|
#ifdef HAVE_SECCOMP
|
||
|
|
#include "seccomp-util.h"
|
||
|
|
#endif
|
||
|
|
+#include "selinux-util.h"
|
||
|
|
#include "signal-util.h"
|
||
|
|
#include "socket-util.h"
|
||
|
|
#include "stat-util.h"
|
||
|
|
@@ -3286,6 +3287,12 @@ int main(int argc, char *argv[]) {
|
||
|
|
goto finish;
|
||
|
|
}
|
||
|
|
|
||
|
|
+ if (arg_selinux_apifs_context) {
|
||
|
|
+ r = mac_selinux_apply(console, arg_selinux_apifs_context);
|
||
|
|
+ if (r < 0)
|
||
|
|
+ goto finish;
|
||
|
|
+ }
|
||
|
|
+
|
||
|
|
if (unlockpt(master) < 0) {
|
||
|
|
r = log_error_errno(errno, "Failed to unlock tty: %m");
|
||
|
|
goto finish;
|