Commit b3aa112d authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'selinux-pr-20200330' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux 

Pull SELinux updates from Paul Moore:
 "We've got twenty SELinux patches for the v5.7 merge window, the
  highlights are below:

   - Deprecate setting /sys/fs/selinux/checkreqprot to 1.

     This flag was originally created to deal with legacy userspace and
     the READ_IMPLIES_EXEC personality flag. We changed the default from
     1 to 0 back in Linux v4.4 and now we are taking the next step of
     deprecating it, at some point in the future we will take the final
     step of rejecting 1.

   - Allow kernfs symlinks to inherit the SELinux label of the parent
     directory. In order to preserve backwards compatibility this is
     protected by the genfs_seclabel_symlinks SELinux policy capability.

   - Optimize how we store filename transitions in the kernel, resulting
     in some significant improvements to policy load times.

   - Do a better job calculating our internal hash table sizes which
     resulted in additional policy load improvements and likely general
     SELinux performance improvements as well.

   - Remove the unused initial SIDs (labels) and improve how we handle
     initial SIDs.

   - Enable per-file labeling for the bpf filesystem.

   - Ensure that we properly label NFS v4.2 filesystems to avoid a
     temporary unlabeled condition.

   - Add some missing XFS quota command types to the SELinux quota
     access controls.

   - Fix a problem where we were not updating the seq_file position
     index correctly in selinuxfs.

   - We consolidate some duplicated code into helper functions.

   - A number of list to array conversions.

   - Update Stephen Smalley's email address in MAINTAINERS"

* tag 'selinux-pr-20200330' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: clean up indentation issue with assignment statement
  NFS: Ensure security label is set for root inode
  MAINTAINERS: Update my email address
  selinux: avtab_init() and cond_policydb_init() return void
  selinux: clean up error path in policydb_init()
  selinux: remove unused initial SIDs and improve handling
  selinux: reduce the use of hard-coded hash sizes
  selinux: Add xfs quota command types
  selinux: optimize storage of filename transitions
  selinux: factor out loop body from filename_trans_read()
  security: selinux: allow per-file labeling for bpffs
  selinux: generalize evaluate_cond_node()
  selinux: convert cond_expr to array
  selinux: convert cond_av_list to array
  selinux: convert cond_list to array
  selinux: sel_avc_get_stat_idx should increase position index
  selinux: allow kernfs symlinks to inherit parent directory context
  selinux: simplify evaluate_cond_node()
  Documentation,selinux: deprecate setting checkreqprot to 1
  selinux: move status variables out of selinux_ss
parents 674d85eb c753924b

Documentation/ABI/obsolete/sysfs-selinux-checkreqprot

0 → 100644
+23 −0
Original line number Diff line number Diff line 
What:		/sys/fs/selinux/checkreqprot

Date:		April 2005 (predates git)

KernelVersion:	2.6.12-rc2 (predates git)

Contact:	selinux@vger.kernel.org

Description:



	The selinuxfs "checkreqprot" node allows SELinux to be configured

	to check the protection requested by userspace for mmap/mprotect

	calls instead of the actual protection applied by the kernel.

	This was a compatibility mechanism for legacy userspace and

	for the READ_IMPLIES_EXEC personality flag.  However, if set to

	1, it weakens security by allowing mappings to be made executable

	without authorization by policy.  The default value of checkreqprot

	at boot was changed starting in Linux v4.4 to 0 (i.e. check the

	actual protection), and Android and Linux distributions have been

	explicitly writing a "0" to /sys/fs/selinux/checkreqprot during

	initialization for some time.  Support for setting checkreqprot to 1

	will be	removed in a future kernel release, at which point the kernel

	will always cease using checkreqprot internally and will always

	check the actual protections being applied upon mmap/mprotect calls.

	The checkreqprot selinuxfs node will remain for backward compatibility

	but will discard writes of the "0" value and will reject writes of the

	"1" value when this mechanism is removed.

Documentation/admin-guide/kernel-parameters.txt

+1 −0
Original line number Diff line number Diff line
@@ -525,6 +525,7 @@ 
			Default value is set via a kernel config option.

			Value can be changed at runtime via

				/sys/fs/selinux/checkreqprot.

			Setting checkreqprot to 1 is deprecated.



	cio_ignore=	[S390]

			See Documentation/s390/common_io.rst for details.

MAINTAINERS

+2 −1
Original line number Diff line number Diff line
@@ -15027,7 +15027,7 @@ X: security/selinux/ 














SELINUX SECURITY MODULE















M:	Paul Moore <paul@paul-moore.com>













M:	Stephen Smalley <sds@tycho.nsa.gov>













M:	Stephen Smalley <stephen.smalley.work@gmail.com>















M:	Eric Paris <eparis@parisplace.org>















L:	selinux@vger.kernel.org















W:	https://selinuxproject.org









@@ -15039,6 +15039,7 @@ F:	security/selinux/













F:	scripts/selinux/















F:	Documentation/admin-guide/LSM/SELinux.rst















F:	Documentation/ABI/obsolete/sysfs-selinux-disable













F:	Documentation/ABI/obsolete/sysfs-selinux-checkreqprot





























SENSABLE PHANTOM















M:	Jiri Slaby <jirislaby@gmail.com>

































fs/nfs/getroot.c



+35
−4






























Original line number
Diff line number
Diff line








@@ -73,6 +73,7 @@ int nfs_get_root(struct super_block *s, struct fs_context *fc)













	struct inode *inode;















	char *name;















	int error = -ENOMEM;













	unsigned long kflags = 0, kflags_out = 0;































	name = kstrdup(fc->source, GFP_KERNEL);















	if (!name)









@@ -83,11 +84,14 @@ int nfs_get_root(struct super_block *s, struct fs_context *fc)













	if (fsinfo.fattr == NULL)















		goto out_name;





























	fsinfo.fattr->label = nfs4_label_alloc(server, GFP_KERNEL);













	if (IS_ERR(fsinfo.fattr->label))













		goto out_fattr;















	error = server->nfs_client->rpc_ops->getroot(server, ctx->mntfh, &fsinfo);















	if (error < 0) {















		dprintk("nfs_get_root: getattr error = %d\n", -error);















		nfs_errorf(fc, "NFS: Couldn't getattr on root");













		goto out_fattr;













		goto out_label;















	}































	inode = nfs_fhget(s, ctx->mntfh, fsinfo.fattr, NULL);









@@ -95,12 +99,12 @@ int nfs_get_root(struct super_block *s, struct fs_context *fc)













		dprintk("nfs_get_root: get root inode failed\n");















		error = PTR_ERR(inode);















		nfs_errorf(fc, "NFS: Couldn't get root inode");













		goto out_fattr;













		goto out_label;















	}































	error = nfs_superblock_set_dummy_root(s, inode);















	if (error != 0)













		goto out_fattr;













		goto out_label;































	/* root dentries normally start off anonymous and get spliced in later















	 * if the dentry tree reaches them; however if the dentry already









@@ -111,7 +115,7 @@ int nfs_get_root(struct super_block *s, struct fs_context *fc)













		dprintk("nfs_get_root: get root dentry failed\n");















		error = PTR_ERR(root);















		nfs_errorf(fc, "NFS: Couldn't get root dentry");













		goto out_fattr;













		goto out_label;















	}































	security_d_instantiate(root, inode);









@@ -123,12 +127,39 @@ int nfs_get_root(struct super_block *s, struct fs_context *fc)













	}















	spin_unlock(&root->d_lock);















	fc->root = root;













	if (NFS_SB(s)->caps & NFS_CAP_SECURITY_LABEL)













		kflags |= SECURITY_LSM_NATIVE_LABELS;













	if (ctx->clone_data.sb) {













		if (d_inode(fc->root)->i_fop != &nfs_dir_operations) {













			error = -ESTALE;













			goto error_splat_root;













		}













		/* clone lsm security options from the parent to the new sb */













		error = security_sb_clone_mnt_opts(ctx->clone_data.sb,













						   s, kflags, &kflags_out);













	} else {













		error = security_sb_set_mnt_opts(s, fc->security,













							kflags, &kflags_out);













	}













	if (error)













		goto error_splat_root;













	if (NFS_SB(s)->caps & NFS_CAP_SECURITY_LABEL &&













		!(kflags_out & SECURITY_LSM_NATIVE_LABELS))













		NFS_SB(s)->caps &= ~NFS_CAP_SECURITY_LABEL;



























	nfs_setsecurity(inode, fsinfo.fattr, fsinfo.fattr->label);















	error = 0;





























out_label:













	nfs4_label_free(fsinfo.fattr->label);















out_fattr:















	nfs_free_fattr(fsinfo.fattr);















out_name:















	kfree(name);















out:















	return error;













error_splat_root:













	dput(fc->root);













	fc->root = NULL;













	goto out_label;















}
























fs/nfs/nfs4proc.c



+3
−9






























Original line number
Diff line number
Diff line








@@ -4002,7 +4002,7 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *mntfh,













{















	int error;















	struct nfs_fattr *fattr = info->fattr;













	struct nfs4_label *label = NULL;













	struct nfs4_label *label = fattr->label;































	error = nfs4_server_capabilities(server, mntfh);















	if (error < 0) {









@@ -4010,23 +4010,17 @@ static int nfs4_proc_get_root(struct nfs_server *server, struct nfs_fh *mntfh,













		return error;















	}





























	label = nfs4_label_alloc(server, GFP_KERNEL);













	if (IS_ERR(label))













		return PTR_ERR(label);





























	error = nfs4_proc_getattr(server, mntfh, fattr, label, NULL);















	if (error < 0) {















		dprintk("nfs4_get_root: getattr error = %d\n", -error);













		goto err_free_label;













		goto out;















	}































	if (fattr->valid & NFS_ATTR_FATTR_FSID &&















	    !nfs_fsid_equal(&server->fsid, &fattr->fsid))















		memcpy(&server->fsid, &fattr->fsid, sizeof(server->fsid));





























err_free_label:













	nfs4_label_free(label);



























out:















	return error;















}

























































































CRA Git | Maintained and supported by SUSTech CRA and CCSE