lkml.org 
[lkml]   [2021]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL 5.13 026/219] Smack: Fix wrong semantics in smk_access_entry()
    Date
    From: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>

    [ Upstream commit 6d14f5c7028eea70760df284057fe198ce7778dd ]

    In the smk_access_entry() function, if no matching rule is found
    in the rust_list, a negative error code will be used to perform bit
    operations with the MAY_ enumeration value. This is semantically
    wrong. This patch fixes this issue.

    Signed-off-by: Tianjia Zhang <tianjia.zhang@linux.alibaba.com>
    Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/smack/smack_access.c | 17 ++++++++---------
    1 file changed, 8 insertions(+), 9 deletions(-)

    diff --git a/security/smack/smack_access.c b/security/smack/smack_access.c
    index 7eabb448acab..169929c6c4eb 100644
    --- a/security/smack/smack_access.c
    +++ b/security/smack/smack_access.c
    @@ -81,23 +81,22 @@ int log_policy = SMACK_AUDIT_DENIED;
    int smk_access_entry(char *subject_label, char *object_label,
    struct list_head *rule_list)
    {
    - int may = -ENOENT;
    struct smack_rule *srp;

    list_for_each_entry_rcu(srp, rule_list, list) {
    if (srp->smk_object->smk_known == object_label &&
    srp->smk_subject->smk_known == subject_label) {
    - may = srp->smk_access;
    - break;
    + int may = srp->smk_access;
    + /*
    + * MAY_WRITE implies MAY_LOCK.
    + */
    + if ((may & MAY_WRITE) == MAY_WRITE)
    + may |= MAY_LOCK;
    + return may;
    }
    }

    - /*
    - * MAY_WRITE implies MAY_LOCK.
    - */
    - if ((may & MAY_WRITE) == MAY_WRITE)
    - may |= MAY_LOCK;
    - return may;
    + return -ENOENT;
    }

    /**
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-09-09 14:12    [W:2.740 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site