lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20250610172226.1470741-33-stephen.smalley.work@gmail.com> Date: Tue, 10 Jun 2025 13:22:03 -0400 From: Stephen Smalley <stephen.smalley.work@...il.com> To: selinux@...r.kernel.org Cc: paul@...l-moore.com, omosnace@...hat.com, netdev@...r.kernel.org, Stephen Smalley <stephen.smalley.work@...il.com> Subject: [PATCH v4 32/42] selinux: update cred_tsid_has_perm_noaudit() to return the combined avd cred_tsid_has_perm_noaudit() currently just returns the last computed av_decision (avd) structure, which in the case of multiple SELinux namespaces will only contain the decisions from the init SELinux namespace. Generally this has no effect since a permission denial by any namespace will cause an immediate error return with -EACCES, but in the case where permission is allowed and the caller caches the avd itself for later reuse, it could lead to the caller incorrectly only using the cached decisions from the init namespace. Change cred_tsid_has_perm_noaudit() to combine the results from any avc_has_perm_noaudit() calls to produce the final avd that is returned to the caller to avoid this problem. The combining logic varies for different fields of the avd, e.g. intersection for allowed and flags (per-domain permissive), union for auditallow and auditdeny, and the seqno is always set from the current namespace only. Signed-off-by: Stephen Smalley <stephen.smalley.work@...il.com> --- security/selinux/avc.c | 30 ++++++++++++++++++++---------- 1 file changed, 20 insertions(+), 10 deletions(-) diff --git a/security/selinux/avc.c b/security/selinux/avc.c index efafe8a06908..c81b511ed1f8 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c @@ -1557,28 +1557,38 @@ int cred_tsid_has_perm_noaudit(const struct cred *cred, u32 tsid, u16 tclass, { struct task_security_struct *tsec; struct selinux_state *state; + struct av_decision tmp_avd; u32 ssid; int rc; - do { + tsec = selinux_cred(cred); + ssid = tsec->sid; + state = tsec->state; + + rc = avc_has_perm_noaudit(state, ssid, tsid, tclass, + requested, 0, avd); + if (rc) + return rc; + + cred = tsec->parent_cred; + while (cred) { tsec = selinux_cred(cred); ssid = tsec->sid; state = tsec->state; - /* - * TODO Do we need to use a tmp avd for each - * avc_has_perm_noaudit() call and intersect/union - * the sets as appropriate as we go? Or can we - * simply use the last result since we generally - * only care when there is a denial? - */ rc = avc_has_perm_noaudit(state, ssid, tsid, tclass, - requested, 0, avd); + requested, 0, &tmp_avd); + + avd->allowed &= tmp_avd.allowed; + avd->auditallow |= tmp_avd.auditallow; + avd->auditdeny |= tmp_avd.auditdeny; + avd->flags &= tmp_avd.flags; + if (rc) return rc; cred = tsec->parent_cred; - } while (cred); + } return 0; } -- 2.49.0
Powered by blists - more mailing lists