From 43b24f0132bc7e48044af062b25cf009c6f136d7 Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Tue, 28 Feb 2017 10:26:48 -0500 Subject: [PATCH] libsepol: Define cgroup_seclabel policy capability Define the new cgroup_seclabel policy capability used to enable userspace setting of security labels on cgroup files via setfscreatecon() aka /proc/self/attr/fscreate and/or setfilecon() aka setxattr(). Signed-off-by: Stephen Smalley --- libsepol/include/sepol/policydb/polcaps.h | 1 + libsepol/src/polcaps.c | 1 + 2 files changed, 2 insertions(+) diff --git a/libsepol/include/sepol/policydb/polcaps.h b/libsepol/include/sepol/policydb/polcaps.h index 623818ab..087541d1 100644 --- a/libsepol/include/sepol/policydb/polcaps.h +++ b/libsepol/include/sepol/policydb/polcaps.h @@ -11,6 +11,7 @@ enum { POLICYDB_CAPABILITY_OPENPERM, POLICYDB_CAPABILITY_EXTSOCKCLASS, POLICYDB_CAPABILITY_ALWAYSNETWORK, + POLICYDB_CAPABILITY_CGROUPSECLABEL, __POLICYDB_CAPABILITY_MAX }; #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1) diff --git a/libsepol/src/polcaps.c b/libsepol/src/polcaps.c index 248d2f52..06a868c4 100644 --- a/libsepol/src/polcaps.c +++ b/libsepol/src/polcaps.c @@ -10,6 +10,7 @@ static const char *polcap_names[] = { "open_perms", /* POLICYDB_CAPABILITY_OPENPERM */ "extended_socket_class", /* POLICYDB_CAPABILITY_EXTSOCKCLASS */ "always_check_network", /* POLICYDB_CAPABILITY_ALWAYSNETWORK */ + "cgroup_seclabel", /* POLICYDB_CAPABILITY_SECLABEL */ NULL };