| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250520120000.25501-10-stephen.smalley.work@gmail.com>
Date: Tue, 20 May 2025 07:59:06 -0400
From: Stephen Smalley <stephen.smalley.work@...il.com>
To: selinux@...r.kernel.org
Cc: paul@...l-moore.com,
omosnace@...hat.com,
netdev@...r.kernel.org,
Stephen Smalley <stephen.smalley.work@...il.com>
Subject: [PATCH v3 08/42] selinux: introduce cred_selinux_state() and use it
When using the SID from a cred, we should pass the selinux
namespace associated with the cred on security server calls
rather than the current selinux namespace, since they could differ.
In some of these cases, the cred is always obtained from the current
task so there is no real change, but this is cleaner and hopefully
less fragile. In other cases, the cred could in fact differ.
Signed-off-by: Stephen Smalley <stephen.smalley.work@...il.com>
---
security/selinux/hooks.c | 44 ++++++++++++++---------------
security/selinux/include/security.h | 2 ++
2 files changed, 24 insertions(+), 22 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index ad86e814aacd..884c96758624 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -465,13 +465,13 @@ static int may_context_mount_sb_relabel(u32 sid,
const struct task_security_struct *tsec = selinux_cred(cred);
int rc;
- rc = avc_has_perm(current_selinux_state,
+ rc = avc_has_perm(cred_selinux_state(cred),
tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
FILESYSTEM__RELABELFROM, NULL);
if (rc)
return rc;
- rc = avc_has_perm(current_selinux_state,
+ rc = avc_has_perm(cred_selinux_state(cred),
tsec->sid, sid, SECCLASS_FILESYSTEM,
FILESYSTEM__RELABELTO, NULL);
return rc;
@@ -483,13 +483,13 @@ static int may_context_mount_inode_relabel(u32 sid,
{
const struct task_security_struct *tsec = selinux_cred(cred);
int rc;
- rc = avc_has_perm(current_selinux_state,
+ rc = avc_has_perm(cred_selinux_state(cred),
tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
FILESYSTEM__RELABELFROM, NULL);
if (rc)
return rc;
- rc = avc_has_perm(current_selinux_state,
+ rc = avc_has_perm(cred_selinux_state(cred),
sid, sbsec->sid, SECCLASS_FILESYSTEM,
FILESYSTEM__ASSOCIATE, NULL);
return rc;
@@ -1686,10 +1686,10 @@ static int cred_has_capability(const struct cred *cred,
return -EINVAL;
}
- rc = avc_has_perm_noaudit(current_selinux_state,
+ rc = avc_has_perm_noaudit(cred_selinux_state(cred),
sid, sid, sclass, av, 0, &avd);
if (!(opts & CAP_OPT_NOAUDIT)) {
- int rc2 = avc_audit(current_selinux_state,
+ int rc2 = avc_audit(cred_selinux_state(cred),
sid, sid, sclass, av, &avd, rc, &ad);
if (rc2)
return rc2;
@@ -1714,7 +1714,7 @@ static int inode_has_perm(const struct cred *cred,
sid = cred_sid(cred);
isec = selinux_inode(inode);
- return avc_has_perm(current_selinux_state,
+ return avc_has_perm(cred_selinux_state(cred),
sid, isec->sid, isec->sclass, perms, adp);
}
@@ -1794,7 +1794,7 @@ static int file_has_perm(const struct cred *cred,
ad.u.file = file;
if (sid != fsec->sid) {
- rc = avc_has_perm(current_selinux_state,
+ rc = avc_has_perm(cred_selinux_state(cred),
sid, fsec->sid,
SECCLASS_FD,
FD__USE,
@@ -2009,7 +2009,7 @@ static int superblock_has_perm(const struct cred *cred,
u32 sid = cred_sid(cred);
sbsec = selinux_superblock(sb);
- return avc_has_perm(current_selinux_state,
+ return avc_has_perm(cred_selinux_state(cred),
sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
}
@@ -2191,7 +2191,7 @@ static int selinux_capset(struct cred *new, const struct cred *old,
const kernel_cap_t *inheritable,
const kernel_cap_t *permitted)
{
- return avc_has_perm(current_selinux_state,
+ return avc_has_perm(cred_selinux_state(old),
cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
PROCESS__SETCAP, NULL);
}
@@ -3877,7 +3877,7 @@ static int ioctl_has_perm(const struct cred *cred, struct file *file,
ad.u.op->path = file->f_path;
if (ssid != fsec->sid) {
- rc = avc_has_perm(current_selinux_state,
+ rc = avc_has_perm(cred_selinux_state(cred),
ssid, fsec->sid,
SECCLASS_FD,
FD__USE,
@@ -3988,7 +3988,7 @@ static int file_map_prot_check(struct file *file, unsigned long prot, int shared
* private file mapping that will also be writable.
* This has an additional check.
*/
- rc = avc_has_perm(current_selinux_state,
+ rc = avc_has_perm(cred_selinux_state(cred),
sid, sid, SECCLASS_PROCESS,
PROCESS__EXECMEM, NULL);
if (rc)
@@ -4068,14 +4068,14 @@ static int selinux_file_mprotect(struct vm_area_struct *vma,
*/
if (vma->vm_start >= vma->vm_mm->start_brk &&
vma->vm_end <= vma->vm_mm->brk) {
- rc = avc_has_perm(current_selinux_state,
- sid, sid, SECCLASS_PROCESS,
- PROCESS__EXECHEAP, NULL);
+ rc = avc_has_perm(cred_selinux_state(cred), sid, sid,
+ SECCLASS_PROCESS, PROCESS__EXECHEAP,
+ NULL);
} else if (!vma->vm_file && (vma_is_initial_stack(vma) ||
vma_is_stack_for_current(vma))) {
- rc = avc_has_perm(current_selinux_state,
- sid, sid, SECCLASS_PROCESS,
- PROCESS__EXECSTACK, NULL);
+ rc = avc_has_perm(cred_selinux_state(cred), sid, sid,
+ SECCLASS_PROCESS, PROCESS__EXECSTACK,
+ NULL);
} else if (vma->vm_file && vma->anon_vma) {
/*
* We are making executable a file mapping that has
@@ -4278,7 +4278,7 @@ static int selinux_kernel_act_as(struct cred *new, u32 secid)
u32 sid = current_sid();
int ret;
- ret = avc_has_perm(current_selinux_state,
+ ret = avc_has_perm(tsec->state,
sid, secid,
SECCLASS_KERNEL_SERVICE,
KERNEL_SERVICE__USE_AS_OVERRIDE,
@@ -4303,7 +4303,7 @@ static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
u32 sid = current_sid();
int ret;
- ret = avc_has_perm(current_selinux_state,
+ ret = avc_has_perm(tsec->state,
sid, isec->sid,
SECCLASS_KERNEL_SERVICE,
KERNEL_SERVICE__CREATE_FILES_AS,
@@ -4495,7 +4495,7 @@ static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcre
av |= PROCESS__SETRLIMIT;
if (flags & LSM_PRLIMIT_READ)
av |= PROCESS__GETRLIMIT;
- return avc_has_perm(current_selinux_state,
+ return avc_has_perm(cred_selinux_state(cred),
cred_sid(cred), cred_sid(tcred),
SECCLASS_PROCESS, av, NULL);
}
@@ -7116,7 +7116,7 @@ static int selinux_key_permission(key_ref_t key_ref,
key = key_ref_to_ptr(key_ref);
ksec = selinux_key(key);
- return avc_has_perm(current_selinux_state,
+ return avc_has_perm(cred_selinux_state(cred),
sid, ksec->sid, SECCLASS_KEY, perm, NULL);
}
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
index d7ce97bb9464..a2c833df53f5 100644
--- a/security/selinux/include/security.h
+++ b/security/selinux/include/security.h
@@ -180,6 +180,8 @@ static inline u32 current_sid(void)
#define current_selinux_state (selinux_cred(current_cred())->state)
+#define cred_selinux_state(cred) (selinux_cred(cred)->state)
+
static inline bool selinux_initialized(const struct selinux_state *state)
{
/* do a synchronized load to avoid race conditions */
--
2.49.0
Powered by blists - more mailing lists