linux-kernel - [PATCH] selinux: Fix all those pesky denials breaking my computer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed,  1 Apr 2020 11:09:19 -0700
From:   Sultan Alsawaf <sultan@...neltoast.com>
To:     unlisted-recipients:; (no To-header on input)
Cc:     Sultan Alsawaf <sultan@...neltoast.com>,
        Paul Moore <paul@...l-moore.com>,
        Stephen Smalley <sds@...ho.nsa.gov>,
        Eric Paris <eparis@...isplace.org>, selinux@...r.kernel.org,
        linux-kernel@...r.kernel.org
Subject: [PATCH] selinux: Fix all those pesky denials breaking my computer

From: Sultan Alsawaf <sultan@...neltoast.com>

I'm sure many of you have found yourself in a position where you've
tried to increase the security of your system by enabling SELinux, only
to discover that nothing worked anymore because of those darned 'denial'
messages. It's clearly an overlooked bug in SELinux!

With a bit of investigation, I discovered that the avc_denied() function
would erroneously return a non-zero value when I saw those denial
messages. After slapping in a `return 0;` at the top of that function,
all was well and my machine with SELinux enforcing was working again!

Signed-off-by: Sultan Alsawaf <sultan@...neltoast.com>
---
 security/selinux/avc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index d18cb32a242a..b29f19471871 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -1010,6 +1010,7 @@ static noinline int avc_denied(struct selinux_state *state,
 			       u8 driver, u8 xperm, unsigned int flags,
 			       struct av_decision *avd)
 {
+	return 0;
 	if (flags & AVC_STRICT)
 		return -EACCES;

-- 
2.26.0