lkml.org 
[lkml]   [2020]   [Feb]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.5 181/542] selinux: revert "stop passing MAY_NOT_BLOCK to the AVC upon follow_link"
    Date
    From: Stephen Smalley <sds@tycho.nsa.gov>

    [ Upstream commit 1a37079c236d55fb31ebbf4b59945dab8ec8764c ]

    This reverts commit e46e01eebbbc ("selinux: stop passing MAY_NOT_BLOCK
    to the AVC upon follow_link"). The correct fix is to instead fall
    back to ref-walk if audit is required irrespective of the specific
    audit data type. This is done in the next commit.

    Fixes: e46e01eebbbc ("selinux: stop passing MAY_NOT_BLOCK to the AVC upon follow_link")
    Reported-by: Will Deacon <will@kernel.org>
    Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
    Signed-off-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/selinux/avc.c | 24 ++++++++++++++++++++++--
    security/selinux/hooks.c | 5 +++--
    security/selinux/include/avc.h | 5 +++++
    3 files changed, 30 insertions(+), 4 deletions(-)

    diff --git a/security/selinux/avc.c b/security/selinux/avc.c
    index ecd3829996aa4..74c43ebe34bb8 100644
    --- a/security/selinux/avc.c
    +++ b/security/selinux/avc.c
    @@ -862,8 +862,9 @@ static int avc_update_node(struct selinux_avc *avc,
    * permissive mode that only appear when in enforcing mode.
    *
    * See the corresponding handling in slow_avc_audit(), and the
    - * logic in selinux_inode_permission for the MAY_NOT_BLOCK flag,
    - * which is transliterated into AVC_NONBLOCKING.
    + * logic in selinux_inode_follow_link and selinux_inode_permission
    + * for the VFS MAY_NOT_BLOCK flag, which is transliterated into
    + * AVC_NONBLOCKING for avc_has_perm_noaudit().
    */
    if (flags & AVC_NONBLOCKING)
    return 0;
    @@ -1205,6 +1206,25 @@ int avc_has_perm(struct selinux_state *state, u32 ssid, u32 tsid, u16 tclass,
    return rc;
    }

    +int avc_has_perm_flags(struct selinux_state *state,
    + u32 ssid, u32 tsid, u16 tclass, u32 requested,
    + struct common_audit_data *auditdata,
    + int flags)
    +{
    + struct av_decision avd;
    + int rc, rc2;
    +
    + rc = avc_has_perm_noaudit(state, ssid, tsid, tclass, requested,
    + (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,
    + &avd);
    +
    + rc2 = avc_audit(state, ssid, tsid, tclass, requested, &avd, rc,
    + auditdata, flags);
    + if (rc2)
    + return rc2;
    + return rc;
    +}
    +
    u32 avc_policy_seqno(struct selinux_state *state)
    {
    return state->avc->avc_cache.latest_notif;
    diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
    index 116b4d644f689..710a4fffa66f4 100644
    --- a/security/selinux/hooks.c
    +++ b/security/selinux/hooks.c
    @@ -3004,8 +3004,9 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
    if (IS_ERR(isec))
    return PTR_ERR(isec);

    - return avc_has_perm(&selinux_state,
    - sid, isec->sid, isec->sclass, FILE__READ, &ad);
    + return avc_has_perm_flags(&selinux_state,
    + sid, isec->sid, isec->sclass, FILE__READ, &ad,
    + rcu ? MAY_NOT_BLOCK : 0);
    }

    static noinline int audit_inode_permission(struct inode *inode,
    diff --git a/security/selinux/include/avc.h b/security/selinux/include/avc.h
    index 7be0e1e90e8be..74ea50977c201 100644
    --- a/security/selinux/include/avc.h
    +++ b/security/selinux/include/avc.h
    @@ -153,6 +153,11 @@ int avc_has_perm(struct selinux_state *state,
    u32 ssid, u32 tsid,
    u16 tclass, u32 requested,
    struct common_audit_data *auditdata);
    +int avc_has_perm_flags(struct selinux_state *state,
    + u32 ssid, u32 tsid,
    + u16 tclass, u32 requested,
    + struct common_audit_data *auditdata,
    + int flags);

    int avc_has_extended_perms(struct selinux_state *state,
    u32 ssid, u32 tsid, u16 tclass, u32 requested,
    --
    2.20.1
    \
     
     \ /
      Last update: 2020-02-14 19:14    [W:2.949 / U:0.228 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site