Commit 1a37079c authored by Stephen Smalley's avatar Stephen Smalley Committed by Paul Moore
Browse files

selinux: revert "stop passing MAY_NOT_BLOCK to the AVC upon follow_link" 



This reverts commit e46e01ee ("selinux: stop passing MAY_NOT_BLOCK
to the AVC upon follow_link"). The correct fix is to instead fall
back to ref-walk if audit is required irrespective of the specific
audit data type.  This is done in the next commit.

Fixes: e46e01ee ("selinux: stop passing MAY_NOT_BLOCK to the AVC upon follow_link")
Reported-by: default avatarWill Deacon <will@kernel.org>
Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 59438b46

security/selinux/avc.c

+22 −2
Original line number Diff line number Diff line
@@ -862,8 +862,9 @@ static int avc_update_node(struct selinux_avc *avc, 
	 * permissive mode that only appear when in enforcing mode.

	 *

	 * See the corresponding handling in slow_avc_audit(), and the

	 * logic in selinux_inode_permission for the MAY_NOT_BLOCK flag,

	 * which is transliterated into AVC_NONBLOCKING.

	 * logic in selinux_inode_follow_link and selinux_inode_permission

	 * for the VFS MAY_NOT_BLOCK flag, which is transliterated into

	 * AVC_NONBLOCKING for avc_has_perm_noaudit().

	 */

	if (flags & AVC_NONBLOCKING)

		return 0;
@@ -1205,6 +1206,25 @@ int avc_has_perm(struct selinux_state *state, u32 ssid, u32 tsid, u16 tclass, 
	return rc;

}



int avc_has_perm_flags(struct selinux_state *state,

		       u32 ssid, u32 tsid, u16 tclass, u32 requested,

		       struct common_audit_data *auditdata,

		       int flags)

{

	struct av_decision avd;

	int rc, rc2;



	rc = avc_has_perm_noaudit(state, ssid, tsid, tclass, requested,

				  (flags & MAY_NOT_BLOCK) ? AVC_NONBLOCKING : 0,

				  &avd);



	rc2 = avc_audit(state, ssid, tsid, tclass, requested, &avd, rc,

			auditdata, flags);

	if (rc2)

		return rc2;

	return rc;

}



u32 avc_policy_seqno(struct selinux_state *state)

{

	return state->avc->avc_cache.latest_notif;

security/selinux/hooks.c

+3 −2
Original line number Diff line number Diff line
@@ -3004,8 +3004,9 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode, 
	if (IS_ERR(isec))

		return PTR_ERR(isec);



	return avc_has_perm(&selinux_state,

			    sid, isec->sid, isec->sclass, FILE__READ, &ad);

	return avc_has_perm_flags(&selinux_state,

				  sid, isec->sid, isec->sclass, FILE__READ, &ad,

				  rcu ? MAY_NOT_BLOCK : 0);

}



static noinline int audit_inode_permission(struct inode *inode,

security/selinux/include/avc.h

+5 −0
Original line number Diff line number Diff line
@@ -153,6 +153,11 @@ int avc_has_perm(struct selinux_state *state, 
		 u32 ssid, u32 tsid,

		 u16 tclass, u32 requested,

		 struct common_audit_data *auditdata);

int avc_has_perm_flags(struct selinux_state *state,

		       u32 ssid, u32 tsid,

		       u16 tclass, u32 requested,

		       struct common_audit_data *auditdata,

		       int flags);



int avc_has_extended_perms(struct selinux_state *state,

			   u32 ssid, u32 tsid, u16 tclass, u32 requested,

CRA Git | Maintained and supported by SUSTech CRA and CCSE