eparis@redhat 2ce9738bac cgroupfs: use init_cred when populating new cgroupfs mount ... We recently found that in some configurations SELinux was blocking the ability for cgroupfs to be mounted. The reason for this is because cgroupfs creates files and directories during the get_sb() call and also uses lookup_one_len() during that same get_sb() call. This is a problem since the security subsystem cannot initialize the superblock and the inodes in that filesystem until after the get_sb() call returns. Thus we leave the inodes in an unitialized state during get_sb(). For the vast majority of filesystems this is not an issue, but since cgroupfs uses lookup_on_len() it does search permission checks on the directories in the path it walks. Since the inode security state is not set up SELinux does these checks as if the inodes were 'unlabeled.' Many 'normal' userspace process do not have permission to interact with unlabeled inodes. The solution presented here is to do the permission checks of path walk and inode creation as the kernel rather than as the task that called mount. Since the kernel has permission to read/write/create unlabeled inodes the get_sb() call will complete successfully and the SELinux code will be able to initialize the superblock and those inodes created during the get_sb() call. This appears to be the same solution used by other filesystems such as devtmpfs to solve the same issue and should thus have no negative impact on other LSMs which currently work. Signed-off-by: Eric Paris <eparis@redhat.com> Acked-by: Paul Menage <menage@google.com> Signed-off-by: James Morris <jmorris@namei.org>		2011-06-09 11:59:53 +10:00
..
debug	Fix common misspellings	2011-03-31 11:26:23 -03:00
events	Merge branch 'perf/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/urgent	2011-06-04 12:13:06 +02:00
gcov	Merge branch 'trivial' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild-2.6	2011-03-20 18:14:55 -07:00
irq	genirq: Ensure we locate the passed IRQ in irq_alloc_descs()	2011-06-03 14:53:16 +02:00
power	PM / Hibernate: Update kerneldoc comments in hibernate.c	2011-05-24 23:36:06 +02:00
time	clockevents: Handle empty cpumask gracefully	2011-06-03 11:13:33 +02:00
trace	ftrace: Add internal recursive checks	2011-05-25 22:13:49 -04:00
.gitignore	…
Kconfig.freezer	…
Kconfig.hz	…
Kconfig.locks	arch:Kconfig.locks Remove unused config option.	2011-04-10 17:01:05 +02:00
Kconfig.preempt	…
Makefile	cgroup: remove the ns_cgroup	2011-05-26 17:12:34 -07:00
acct.c	…
async.c	…
audit.c	netlink: kill loginuid/sessionid/sid members from struct netlink_skb_parms	2011-03-03 10:55:40 -08:00
audit.h	audit: make functions static	2010-10-30 01:42:19 -04:00
audit_tree.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
audit_watch.c	kill path_lookup()	2011-03-14 09:15:23 -04:00
auditfilter.c	netlink: kill loginuid/sessionid/sid members from struct netlink_skb_parms	2011-03-03 10:55:40 -08:00
auditsc.c	audit: acquire creds selectively to reduce atomic op overhead	2011-04-27 15:11:03 +02:00
backtracetest.c	…
bounds.c	memcg: remove direct page_cgroup-to-page pointer	2011-03-23 19:46:28 -07:00
capability.c	Merge branch 'master' into next	2011-05-19 18:51:57 +10:00
cgroup.c	cgroupfs: use init_cred when populating new cgroupfs mount	2011-06-09 11:59:53 +10:00
cgroup_freezer.c	cgroups: add per-thread subsystem callbacks	2011-05-26 17:12:34 -07:00
compat.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/cmetcalf/linux-tile	2011-05-25 15:35:32 -07:00
configs.c	llseek: automatically add .llseek fop	2010-10-15 15:53:27 +02:00
cpu.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
cpuset.c	cpuset: Fix cpuset_cpus_allowed_fallback(), don't update tsk->rt.nr_cpus_allowed	2011-05-28 17:02:57 +02:00
crash_dump.c	crash_dump: export is_kdump_kernel to modules, consolidate elfcorehdr_addr, setup_elfcorehdr and saved_max_pfn	2011-03-23 19:47:19 -07:00
cred.c	Merge branch 'docs-move' of git://git.kernel.org/pub/scm/linux/kernel/git/rdunlap/linux-docs	2011-05-27 10:25:02 -07:00
delayacct.c	…
dma.c	…
elfcore.c	…
exec_domain.c	…
exit.c	Merge branch 'ptrace' of git://git.kernel.org/pub/scm/linux/kernel/git/oleg/misc	2011-05-20 13:33:21 -07:00
extable.c	extable, core_kernel_data(): Make sure all archs define _sdata	2011-05-20 08:56:56 +02:00
fork.c	mm: Fix boot crash in mm_alloc()	2011-05-29 11:32:28 -07:00
freezer.c	Freezer: Use SMP barriers	2011-05-17 23:19:17 +02:00
futex.c	futex: Set FLAGS_HAS_TIMEOUT during futex_wait restart setup	2011-04-15 16:34:32 +02:00
futex_compat.c	userns: user namespaces: convert several capable() calls	2011-03-23 19:47:08 -07:00
groups.c	userns: user namespaces: convert several capable() calls	2011-03-23 19:47:08 -07:00
hrtimer.c	hrtimers: Fix typo causing erratic timers	2011-05-25 15:31:58 -07:00
hung_task.c	watchdog, hung_task_timeout: Add Kconfig configurable default	2011-04-28 09:13:17 +02:00
irq_work.c	irq_work: Use per cpu atomics instead of regular atomics	2010-12-18 15:54:48 +01:00
itimer.c	…
jump_label.c	jump_label: Check entries limit in __jump_label_update	2011-05-25 19:56:36 -04:00
kallsyms.c	Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip	2011-03-25 17:52:22 -07:00
kexec.c	PM: Remove sysdev suspend, resume and shutdown operations	2011-05-11 21:37:15 +02:00
kfifo.c	kfifo: fix scatterlist usage	2010-10-01 10:50:58 -07:00
kmod.c	Merge branch 'next' into for-linus	2011-05-24 22:55:24 +10:00
kprobes.c	Merge branch 'for-2.6.38' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2011-01-07 17:02:58 -08:00
ksysfs.c	kernel/ksysfs.c: expose file_caps_enabled in sysfs	2011-04-19 16:45:51 -07:00
kthread.c	cpuset: Fix cpuset_cpus_allowed_fallback(), don't update tsk->rt.nr_cpus_allowed	2011-05-28 17:02:57 +02:00
latencytop.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
lockdep.c	lockdep: Fix lock_is_held() on recursion	2011-06-07 12:25:50 +02:00
lockdep_internals.h	…
lockdep_proc.c	lockdep: Remove unused 'factor' variable from lockdep_stats_show()	2011-03-23 13:54:47 +01:00
lockdep_states.h	…
module.c	Merge branch 'staging-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging-2.6	2011-05-23 12:49:28 -07:00
mutex-debug.c	mutex: Use p->on_cpu for the adaptive spin	2011-04-14 08:52:33 +02:00
mutex-debug.h	mutex: Use p->on_cpu for the adaptive spin	2011-04-14 08:52:33 +02:00
mutex.c	lockdep, mutex: provide mutex_lock_nest_lock	2011-05-25 08:39:17 -07:00
mutex.h	mutex: Use p->on_cpu for the adaptive spin	2011-04-14 08:52:33 +02:00
notifier.c	…
nsproxy.c	cgroup: remove the ns_cgroup	2011-05-26 17:12:34 -07:00
padata.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
panic.c	move x86 specific oops=panic to generic code	2011-03-22 17:44:11 -07:00
params.c	params.c: Use new strtobool function to process boolean inputs	2011-05-19 16:55:28 +09:30
pid.c	next_pidmap: fix overflow condition	2011-04-18 10:35:30 -07:00
pid_namespace.c	pidns: call pid_ns_prepare_proc() from create_pid_namespace()	2011-03-23 19:46:58 -07:00
pm_qos_params.c	Merge branch 'idle-release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux-idle-2.6	2011-05-29 11:18:09 -07:00
posix-cpu-timers.c	hrtimers: Avoid touching inactive timer bases	2011-05-23 13:59:54 +02:00
posix-timers.c	posix-timers: RCU conversion	2011-05-24 12:10:51 +02:00
printk.c	printk: allocate kernel log buffer earlier	2011-05-25 08:39:48 -07:00
profile.c	kernel/profile.c: remove some duplicate code from profile_hits()	2011-05-26 17:12:37 -07:00
ptrace.c	ptrace: ptrace_resume() shouldn't wake up !TASK_TRACED thread	2011-05-25 19:20:21 +02:00
range.c	kernel/range.c: fix clean_sort_range() for the case of full array	2010-11-12 07:55:31 -08:00
rcupdate.c	rcu: Use WARN_ON_ONCE for DEBUG_OBJECTS_RCU_HEAD warnings	2011-05-05 23:16:57 -07:00
rcutiny.c	sanitize <linux/prefetch.h> usage	2011-05-20 12:50:29 -07:00
rcutiny_plugin.h	rcu: Converge TINY_RCU expedited and normal boosting	2011-05-05 23:16:58 -07:00
rcutorture.c	rcu: mark rcutorture boosting callback as being on-stack	2011-05-05 23:16:57 -07:00
rcutree.c	rcu: Cure load woes	2011-05-31 10:01:48 +02:00
rcutree.h	rcu: Remove waitqueue usage for cpu, node, and boost kthreads	2011-05-28 17:41:52 +02:00
rcutree_plugin.h	rcu: Cure load woes	2011-05-31 10:01:48 +02:00
rcutree_trace.c	rcu: Decrease memory-barrier usage based on semi-formal proof	2011-05-26 09:42:23 -07:00
relay.c	Clean up relay_alloc_page_array() slightly by using vzalloc rather than vmalloc and memset	2010-11-05 08:21:34 -07:00
res_counter.c	memcg: res_counter_read_u64(): fix potential races on 32-bit machines	2011-03-23 19:46:22 -07:00
resource.c	resources: add arch hook for preventing allocation in reserved areas	2010-12-17 10:01:09 -08:00
rtmutex-debug.c	rtmutex: Simplify PI algorithm and make highest prio task get lock	2011-01-27 21:13:51 -05:00
rtmutex-debug.h	…
rtmutex-tester.c	rtmutex: tester: Remove the remaining BKL leftovers	2011-02-22 22:07:22 +01:00
rtmutex.c	rtmutex: Simplify PI algorithm and make highest prio task get lock	2011-01-27 21:13:51 -05:00
rtmutex.h	…
rtmutex_common.h	rtmutex: Simplify PI algorithm and make highest prio task get lock	2011-01-27 21:13:51 -05:00
rwsem.c	…
sched.c	sched: Fix/clarify set_task_cpu() locking rules	2011-06-07 12:26:40 +02:00
sched_autogroup.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
sched_autogroup.h	sched, autogroup: Stop going ahead if autogroup is disabled	2011-02-23 11:33:59 +01:00
sched_clock.c	sched: Add some clock info to sched_debug	2010-11-23 10:29:08 +01:00
sched_cpupri.c	…
sched_cpupri.h	…
sched_debug.c	sched: Get rid of lock_depth	2011-04-24 13:18:38 +02:00
sched_fair.c	sched: Fix ->min_vruntime calculation in dequeue_entity()	2011-05-28 17:02:56 +02:00
sched_features.h	sched: Move the second half of ttwu() to the remote cpu	2011-04-14 08:52:41 +02:00
sched_idletask.c	sched: Drop the rq argument to sched_class::select_task_rq()	2011-04-14 08:52:36 +02:00
sched_rt.c	sched: More sched_domain iterations fixes	2011-05-28 17:02:54 +02:00
sched_stats.h	sched: More sched_domain iterations fixes	2011-05-28 17:02:54 +02:00
sched_stoptask.c	sched: Drop the rq argument to sched_class::select_task_rq()	2011-04-14 08:52:36 +02:00
seccomp.c	…
semaphore.c	…
signal.c	signal: sys_pause() should check signal_pending()	2011-05-25 19:22:27 +02:00
smp.c	smp: move smp setup functions to kernel/smp.c	2011-03-22 17:44:11 -07:00
softirq.c	rcu: move TREE_RCU from softirq to kthread	2011-05-05 23:16:54 -07:00
spinlock.c	…
srcu.c	rcu: demote SRCU_SYNCHRONIZE_DELAY from kernel-parameter status	2011-01-14 04:56:49 -08:00
stacktrace.c	…
stop_machine.c	kthread: use kthread_create_on_node()	2011-03-22 17:44:01 -07:00
sys.c	Merge branch 'driver-core-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core-2.6	2011-05-19 18:24:11 -07:00
sys_ni.c	ipc: Add missing sys_ni entries for ipc/compat.c functions	2011-05-20 13:53:02 -07:00
sysctl.c	perf: Comment /proc/sys/kernel/perf_event_paranoid to be part of user ABI	2011-06-04 12:22:04 +02:00
sysctl_binary.c	open-style analog of vfs_path_lookup()	2011-03-14 09:15:28 -04:00
sysctl_check.c	sysctl_check: drop dead code	2011-03-23 19:46:51 -07:00
taskstats.c	taskstats: use appropriate printk priority level	2011-03-23 19:47:14 -07:00
test_kprobes.c	kprobes: Fix selftest to clear flags field for reusing probes	2010-10-14 08:55:27 +02:00
time.c	Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip	2011-03-15 18:53:35 -07:00
timeconst.pl	…
timer.c	timers: Consider slack value in mod_timer()	2011-06-03 15:02:32 +02:00
tracepoint.c	jump label: Introduce static_branch() interface	2011-04-04 12:48:08 -04:00
tsacct.c	taskstats: use real microsecond granularity for CPU times	2010-10-27 18:03:17 -07:00
uid16.c	userns: user namespaces: convert several capable() calls	2011-03-23 19:47:08 -07:00
up.c	…
user-return-notifier.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
user.c	userns: add a user_namespace as creator/owner of uts_namespace	2011-03-23 19:46:59 -07:00
user_namespace.c	user_ns: improve the user_ns on-the-slab packaging	2011-01-13 08:03:18 -08:00
utsname.c	ns proc: Add support for the uts namespace	2011-05-10 14:35:35 -07:00
utsname_sysctl.c	…
wait.c	Fix common misspellings	2011-03-31 11:26:23 -03:00
watchdog.c	kernel/watchdog.c: Use proper ANSI C prototypes	2011-05-23 21:07:40 -07:00
workqueue.c	Merge branch 'for-2.6.40' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu	2011-05-24 11:53:42 -07:00
workqueue_sched.h	…