netdev - Re: [PATCH v4 04/42] selinux: dynamically allocate selinux namespace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAEjxPJ5vWnRCMd85F2ycKNrkyJUPoumkugEJo1sq7rRuMKw2SQ@mail.gmail.com>
Date: Fri, 13 Jun 2025 14:17:21 -0400
From: Stephen Smalley <stephen.smalley.work@...il.com>
To: Simon Horman <horms@...nel.org>
Cc: selinux@...r.kernel.org, paul@...l-moore.com, omosnace@...hat.com, 
	netdev@...r.kernel.org
Subject: Re: [PATCH v4 04/42] selinux: dynamically allocate selinux namespace

On Fri, Jun 13, 2025 at 10:14 AM Simon Horman <horms@...nel.org> wrote:
>
> On Tue, Jun 10, 2025 at 01:21:35PM -0400, Stephen Smalley wrote:
> > Move from static allocation of a single selinux namespace to
> > dynamic allocation.  Include necessary support for lifecycle management
> > of the selinux namespace, modeled after the user namespace support.
> >
> > Signed-off-by: Stephen Smalley <stephen.smalley.work@...il.com>
>
> ...
>
> > diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
> > index 112edf9b2106..c67965cbfcba 100644
> > --- a/security/selinux/ss/services.c
> > +++ b/security/selinux/ss/services.c
> > @@ -2202,7 +2202,7 @@ static void security_load_policycaps(struct selinux_state *state,
> >  static int security_preserve_bools(struct selinux_policy *oldpolicy,
> >                               struct selinux_policy *newpolicy);
> >
> > -static void selinux_policy_free(struct selinux_policy *policy)
> > +void selinux_policy_free(struct selinux_policy __rcu *policy)
>
> Hi Stephen,
>
> It looks like this __rcu annotation is insufficient, and further updates
> are needed. I didn't look further, but Sparse says:
>
>   .../services.c:2212:27: warning: incorrect type in argument 1 (different address spaces)
>   .../services.c:2212:27:    expected struct policydb *p
>   .../services.c:2212:27:    got struct policydb [noderef] __rcu *
>   .../services.c:2214:15: warning: incorrect type in argument 1 (different address spaces)
>   .../services.c:2214:15:    expected void const *objp
>   .../services.c:2214:15:    got struct selinux_policy [noderef] __rcu *policy
>   .../services.c:2232:39: warning: incorrect type in argument 1 (different address spaces)
>   .../services.c:2232:39:    expected struct selinux_policy [noderef] __rcu *policy
>   .../services.c:2232:39:    got struct selinux_policy *policy
>   .../services.c:2297:29: warning: incorrect type in argument 1 (different address spaces)
>   .../services.c:2297:29:    expected struct selinux_policy [noderef] __rcu *policy
>   .../services.c:2297:29:    got struct selinux_policy *[assigned] oldpolicy
>   .../services.c:2210:24: warning: dereference of noderef expression
>   .../services.c:2211:15: warning: dereference of noderef expression
>   .../services.c:2213:15: warning: dereference of noderef expression

Thank you, fixed via
https://github.com/stephensmalley/selinux-kernel/commit/66c448df995fb8d6c5c9a4875efc0ab56a5dd21d
and will likely squash into this patch for next submission.

>
>
>
> >  {
> >       if (!policy)
> >               return;
>
> ...