lkml.org 
[lkml]   [2020]   [Aug]   [24]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] SELinux: Measure state and hash of policy using IMA
From
Date
On 8/24/20 7:00 AM, Stephen Smalley wrote:
> On Fri, Aug 21, 2020 at 9:00 PM Lakshmi Ramasubramanian

>
>> +int security_read_policy_kernel(struct selinux_state *state,
>> + void **data, size_t *len)
>> +{
>> + int rc;
>> +
>> + rc = security_read_policy_len(state, len);
>> + if (rc)
>> + return rc;
>> +
>> + *data = vmalloc(*len);
>> + if (!*data)
>> + return -ENOMEM;
>>
>> + return security_read_selinux_policy(state, data, len);
>> }
>
> See the discussion here:
> https://lore.kernel.org/selinux/20200824113015.1375857-1-omosnace@redhat.com/T/#t
>
> In order for this to be safe, you need to ensure that all callers of
> security_read_policy_kernel() have taken fsi->mutex in selinuxfs and
> any use of security_read_policy_len() occurs while holding the mutex.
> Otherwise, the length can change between security_read_policy_len()
> and security_read_selinux_policy() if policy is reloaded.
>

Thanks. I'll make this change.

-lakshmi

\
 
 \ /
  Last update: 2020-08-24 16:36    [W:0.063 / U:0.124 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site