)]}'
{
  "commit": "01593d3299a1cfdb5e08acf95f63ec59dd674906",
  "tree": "8effe4c871d480da9ac231fbeaab8caf68c9252b",
  "parents": [
    "ef37979a2cfa3905adbf0c2a681ce16c0aaea92d"
  ],
  "author": {
    "name": "Stephen Smalley",
    "email": "sds@tycho.nsa.gov",
    "time": "Mon Jan 09 10:07:31 2017 -0500"
  },
  "committer": {
    "name": "Paul Moore",
    "email": "paul@paul-moore.com",
    "time": "Mon Jan 09 10:07:31 2017 -0500"
  },
  "message": "selinux: allow context mounts on tmpfs, ramfs, devpts within user namespaces\n\ncommit aad82892af261b9903cc11c55be3ecf5f0b0b4f8 (\"selinux: Add support for\nunprivileged mounts from user namespaces\") prohibited any use of context\nmount options within non-init user namespaces.  However, this breaks\nuse of context mount options for tmpfs mounts within user namespaces,\nwhich are being used by Docker/runc.  There is no reason to block such\nusage for tmpfs, ramfs or devpts.  Exempt these filesystem types\nfrom this restriction.\n\nBefore:\nsh$ userns_child_exec  -p -m -U -M \u00270 1000 1\u0027 -G \u00270 1000 1\u0027 bash\nsh# mount -t tmpfs -o context\u003dsystem_u:object_r:user_tmp_t:s0:c13 none /tmp\nmount: tmpfs is write-protected, mounting read-only\nmount: cannot mount tmpfs read-only\n\nAfter:\nsh$ userns_child_exec  -p -m -U -M \u00270 1000 1\u0027 -G \u00270 1000 1\u0027 bash\nsh# mount -t tmpfs -o context\u003dsystem_u:object_r:user_tmp_t:s0:c13 none /tmp\nsh# ls -Zd /tmp\nunconfined_u:object_r:user_tmp_t:s0:c13 /tmp\n\nSigned-off-by: Stephen Smalley \u003csds@tycho.nsa.gov\u003e\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "e4b953f760dd72c1929f2ec09fd10e87ddc02535",
      "old_mode": 33188,
      "old_path": "security/selinux/hooks.c",
      "new_id": "e32f4b5f23a5627584196183285c659ecb3ebd85",
      "new_mode": 33188,
      "new_path": "security/selinux/hooks.c"
    }
  ]
}