diff options
author | Topi Miettinen <toiwoton@gmail.com> | 2020-02-18 20:38:00 +0200 |
---|---|---|
committer | Topi Miettinen <topimiettinen@users.noreply.github.com> | 2020-02-22 08:27:24 +0000 |
commit | 1ad2d54c014a49f6ad0b487dd0d9b361cb4d299e (patch) | |
tree | 415eb19d90e2ed1de7236c784c1e28d3acfbcaab /src/firejail/fs_dev.c | |
parent | Whitelist more /usr/share for okular and others (diff) | |
download | firejail-1ad2d54c014a49f6ad0b487dd0d9b361cb4d299e.tar.gz firejail-1ad2d54c014a49f6ad0b487dd0d9b361cb4d299e.tar.zst firejail-1ad2d54c014a49f6ad0b487dd0d9b361cb4d299e.zip |
Add support for SELinux labeling
Running `firejail --noprofile --private-bin=bash,ls ls -1Za /usr/bin`
shows that the SELinux labels are not correct:
```
user_u:object_r:user_tmpfs_t:s0 .
system_u:object_r:usr_t:s0 ..
user_u:object_r:user_tmpfs_t:s0 bash
user_u:object_r:user_tmpfs_t:s0 ls
```
After fixing this:
```
system_u:object_r:bin_t:s0 .
system_u:object_r:usr_t:s0 ..
system_u:object_r:shell_exec_t:s0 bash
system_u:object_r:bin_t:s0 ls
```
Most copied files and created directories should now have correct
labels (bind mounted objects keep their labels). This is useful to
avoid having to change the SELinux rules when using Firejail.
Diffstat (limited to 'src/firejail/fs_dev.c')
-rw-r--r-- | src/firejail/fs_dev.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/firejail/fs_dev.c b/src/firejail/fs_dev.c index 63911ab9e..500b6bf1b 100644 --- a/src/firejail/fs_dev.c +++ b/src/firejail/fs_dev.c | |||
@@ -167,6 +167,7 @@ static void create_link(const char *oldpath, const char *newpath) { | |||
167 | static void empty_dev_shm(void) { | 167 | static void empty_dev_shm(void) { |
168 | // create an empty /dev/shm directory | 168 | // create an empty /dev/shm directory |
169 | mkdir_attr("/dev/shm", 01777, 0, 0); | 169 | mkdir_attr("/dev/shm", 01777, 0, 0); |
170 | selinux_relabel_path("/dev/shm", "/dev/shm"); | ||
170 | fs_logger("mkdir /dev/shm"); | 171 | fs_logger("mkdir /dev/shm"); |
171 | fs_logger("create /dev/shm"); | 172 | fs_logger("create /dev/shm"); |
172 | } | 173 | } |
@@ -276,10 +277,13 @@ void fs_private_dev(void){ | |||
276 | // pseudo-terminal | 277 | // pseudo-terminal |
277 | mkdir_attr("/dev/pts", 0755, 0, 0); | 278 | mkdir_attr("/dev/pts", 0755, 0, 0); |
278 | fs_logger("mkdir /dev/pts"); | 279 | fs_logger("mkdir /dev/pts"); |
280 | selinux_relabel_path("/dev/pts", "/dev/pts"); | ||
279 | fs_logger("create /dev/pts"); | 281 | fs_logger("create /dev/pts"); |
280 | create_char_dev("/dev/pts/ptmx", 0666, 5, 2); //"mknod -m 666 /dev/pts/ptmx c 5 2"); | 282 | create_char_dev("/dev/pts/ptmx", 0666, 5, 2); //"mknod -m 666 /dev/pts/ptmx c 5 2"); |
283 | selinux_relabel_path("/dev/pts/ptmx", "/dev/pts/ptmx"); | ||
281 | fs_logger("mknod /dev/pts/ptmx"); | 284 | fs_logger("mknod /dev/pts/ptmx"); |
282 | create_link("/dev/pts/ptmx", "/dev/ptmx"); | 285 | create_link("/dev/pts/ptmx", "/dev/ptmx"); |
286 | selinux_relabel_path("/dev/ptmx", "/dev/ptmx"); | ||
283 | 287 | ||
284 | // code before github issue #351 | 288 | // code before github issue #351 |
285 | // mount -vt devpts -o newinstance -o ptmxmode=0666 devpts //dev/pts | 289 | // mount -vt devpts -o newinstance -o ptmxmode=0666 devpts //dev/pts |