9004-mount-setup-mount-etc-with-specific-label.patch

From 29bf558a8437f9ed570f8ff0797590b8281db4d5 Mon Sep 17 00:00:00 2001
From: Ben Cressey <bcressey@amazon.com>
Date: Thu, 9 Jul 2020 20:00:36 +0000
Subject: [PATCH 9004/9007] mount-setup: mount /etc with specific label

The filesystem is mounted after we load the SELinux policy, so we can
apply the label we need to restrict access.

Signed-off-by: Ben Cressey <bcressey@amazon.com>
---
 src/shared/mount-setup.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/shared/mount-setup.c b/src/shared/mount-setup.c
index 7917968..74d7595 100644
--- a/src/shared/mount-setup.c
+++ b/src/shared/mount-setup.c
@@ -76,6 +76,8 @@ static const MountPoint mount_table[] = {
         { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777,smackfsroot=*",                 MS_NOSUID|MS_NODEV|MS_STRICTATIME,
           mac_smack_use, MNT_FATAL                  },
 #endif
+        { "tmpfs",       "/etc",                      "tmpfs",      "mode=755,context=system_u:object_r:etc_t:s0", MS_NOSUID|MS_NODEV|MS_NOATIME|MS_NOEXEC,
+          NULL,          MNT_FATAL|MNT_IN_CONTAINER },
         { "tmpfs",       "/dev/shm",                  "tmpfs",      "mode=1777",                               MS_NOSUID|MS_NODEV|MS_STRICTATIME,
           NULL,          MNT_FATAL|MNT_IN_CONTAINER },
         { "devpts",      "/dev/pts",                  "devpts",     "mode=620,gid=" STRINGIFY(TTY_GID),        MS_NOSUID|MS_NOEXEC,
-- 
2.33.1