Dan Walsh 68b020494d /dev/console must be labeled with SELinux label ...

If the user specifies an selinux_apifs_context all content created in
the container including /dev/console should use this label.

Currently when this uses the default label it gets labeled user_devpts_t,
which would require us to write a policy allowing container processes to
manage user_devpts_t.  This means that an escaped process would be allowed
to attack all users terminals as well as other container terminals.  Changing
the label to match the apifs_context, means the processes would only be allowed
to manage their specific tty.

This change fixes a problem preventing RKT containers from working with systemd-nspawn.

2016-03-09 11:19:45 -05:00

..

.gitignore

nspawn: add new .nspawn files for container settings

2015-09-06 01:49:06 +02:00

Makefile

build-sys: add stub makefiles to all subdirs to ease development with emacs

2012-04-13 21:37:59 +02:00

nspawn-cgroup.c

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-cgroup.h

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-expose-ports.c

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-expose-ports.h

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-gperf.gperf

nspawn: optionally run a stub init process as PID 1

2016-02-03 23:58:24 +01:00

nspawn-mount.c

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-mount.h

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-network.c

tree-wide: make ++/-- usage consistent WRT spacing

2016-02-22 20:32:04 -08:00

nspawn-network.h

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-register.c

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-register.h

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-settings.c

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-settings.h

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-setuid.c

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-setuid.h

tree-wide: remove Emacs lines from all files

2016-02-10 13:41:57 +01:00

nspawn-stub-pid1.c

nspawn: optionally run a stub init process as PID 1

2016-02-03 23:58:24 +01:00

nspawn-stub-pid1.h

nspawn: optionally run a stub init process as PID 1

2016-02-03 23:58:24 +01:00

nspawn.c

/dev/console must be labeled with SELinux label

2016-03-09 11:19:45 -05:00