| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250520120000.25501-37-stephen.smalley.work@gmail.com>
Date: Tue, 20 May 2025 07:59:33 -0400
From: Stephen Smalley <stephen.smalley.work@...il.com>
To: selinux@...r.kernel.org
Cc: paul@...l-moore.com,
omosnace@...hat.com,
netdev@...r.kernel.org,
Stephen Smalley <stephen.smalley.work@...il.com>
Subject: [PATCH v3 35/42] selinux: annotate process transition permission checks
Annotate all process transition-related permission checks that are only
performed against the current SELinux namespace and not ancestors with
comments. These checks are only applied against the current namespace
because the process SID only changes in the current namespace; the SID
in ancestor namespaces remains unchanged.
Signed-off-by: Stephen Smalley <stephen.smalley.work@...il.com>
---
security/selinux/hooks.c | 46 ++++++++++++++++++++++++++++++++++------
1 file changed, 40 insertions(+), 6 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 185a528a01c4..6368c3d5643a 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2389,19 +2389,23 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
if (rc)
return rc;
} else {
+ /* Check permissions for the transition. */
/*
* Only check against the current SELinux namespace
* because only the SID in the current namespace
* is changed by a transition.
*/
-
- /* Check permissions for the transition. */
rc = avc_has_perm(current_selinux_state,
old_tsec->sid, new_tsec->sid,
SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
if (rc)
return rc;
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
+ */
rc = avc_has_perm(current_selinux_state,
new_tsec->sid, isec->sid,
SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
@@ -2410,6 +2414,11 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
/* Check for shared state */
if (bprm->unsafe & LSM_UNSAFE_SHARE) {
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
+ */
rc = avc_has_perm(current_selinux_state,
old_tsec->sid, new_tsec->sid,
SECCLASS_PROCESS, PROCESS__SHARE,
@@ -2423,6 +2432,12 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
u32 ptsid = ptrace_parent_sid();
if (ptsid != 0) {
+ /*
+ * Only check against the current SELinux
+ * namespace because only the SID in the
+ * current namespace is changed by a
+ * transition.
+ */
rc = avc_has_perm(current_selinux_state,
ptsid, new_tsec->sid,
SECCLASS_PROCESS,
@@ -2438,6 +2453,11 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
/* Enable secure mode for SIDs transitions unless
the noatsecure permission is granted between
the two SIDs, i.e. ahp returns 0. */
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
+ */
rc = avc_has_perm(current_selinux_state,
old_tsec->sid, new_tsec->sid,
SECCLASS_PROCESS, PROCESS__NOATSECURE,
@@ -2544,8 +2564,10 @@ static void selinux_bprm_committing_creds(const struct linux_binprm *bprm)
* higher than the default soft limit for cases where the default is
* lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
*/
- /* Only check against the current namespace because the SID
- * does not change in the parent.
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
*/
rc = avc_has_perm(current_selinux_state,
new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
@@ -2587,8 +2609,10 @@ static void selinux_bprm_committed_creds(const struct linux_binprm *bprm)
* This must occur _after_ the task SID has been updated so that any
* kill done after the flush will be checked against the new SID.
*/
- /* Only check against the current namespace because the SID
- * does not change in the parent.
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
*/
rc = avc_has_perm(current_selinux_state,
osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
@@ -6818,6 +6842,11 @@ static int selinux_lsm_setattr(u64 attr, void *value, size_t size)
}
/* Check permissions for the transition. */
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
+ */
error = avc_has_perm(current_selinux_state,
tsec->sid, sid, SECCLASS_PROCESS,
PROCESS__DYNTRANSITION, NULL);
@@ -6828,6 +6857,11 @@ static int selinux_lsm_setattr(u64 attr, void *value, size_t size)
Otherwise, leave SID unchanged and fail. */
ptsid = ptrace_parent_sid();
if (ptsid != 0) {
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
+ */
error = avc_has_perm(current_selinux_state,
ptsid, sid, SECCLASS_PROCESS,
PROCESS__PTRACE, NULL);
--
2.49.0
Powered by blists - more mailing lists