Blame 0023-dev-console-must-be-labeled-with-SELinux-label.patch

b9a1e3
From 641a7f0c61ff42ea55ad7152e7f874ea5d680a2d Mon Sep 17 00:00:00 2001
b9a1e3
From: Dan Walsh <dwalsh@redhat.com>
b9a1e3
Date: Wed, 9 Mar 2016 09:29:25 -0500
b9a1e3
Subject: [PATCH] /dev/console must be labeled with SELinux label
b9a1e3
b9a1e3
If the user specifies an selinux_apifs_context all content created in
b9a1e3
the container including /dev/console should use this label.
b9a1e3
b9a1e3
Currently when this uses the default label it gets labeled user_devpts_t,
b9a1e3
which would require us to write a policy allowing container processes to
b9a1e3
manage user_devpts_t.  This means that an escaped process would be allowed
b9a1e3
to attack all users terminals as well as other container terminals.  Changing
b9a1e3
the label to match the apifs_context, means the processes would only be allowed
b9a1e3
to manage their specific tty.
b9a1e3
b9a1e3
This change fixes a problem preventing RKT containers from working with systemd-nspawn.
b9a1e3
b9a1e3
(cherry picked from commit 68b020494d1ff085281061413d9236b5865ef238)
b9a1e3
---
b9a1e3
 src/nspawn/nspawn.c | 7 +++++++
b9a1e3
 1 file changed, 7 insertions(+)
b9a1e3
b9a1e3
diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c
b9a1e3
index ef348c335b..8c06f6ef75 100644
b9a1e3
--- a/src/nspawn/nspawn.c
b9a1e3
+++ b/src/nspawn/nspawn.c
b9a1e3
@@ -87,6 +87,7 @@
b9a1e3
 #ifdef HAVE_SECCOMP
b9a1e3
 #include "seccomp-util.h"
b9a1e3
 #endif
b9a1e3
+#include "selinux-util.h"
b9a1e3
 #include "signal-util.h"
b9a1e3
 #include "socket-util.h"
b9a1e3
 #include "stat-util.h"
b9a1e3
@@ -3286,6 +3287,12 @@ int main(int argc, char *argv[]) {
b9a1e3
                 goto finish;
b9a1e3
         }
b9a1e3
 
b9a1e3
+        if (arg_selinux_apifs_context) {
b9a1e3
+                r = mac_selinux_apply(console, arg_selinux_apifs_context);
b9a1e3
+                if (r < 0)
b9a1e3
+                        goto finish;
b9a1e3
+        }
b9a1e3
+
b9a1e3
         if (unlockpt(master) < 0) {
b9a1e3
                 r = log_error_errno(errno, "Failed to unlock tty: %m");
b9a1e3
                 goto finish;