Commit ba75082e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'selinux-pr-20191126' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux 

Pull selinux updates from Paul Moore:
 "Only three SELinux patches for v5.5:

   - Remove the size limit on SELinux policies, the limitation was a
     lingering vestige and no longer necessary.

   - Allow file labeling before the policy is loaded. This should ease
     some of the burden when the policy is initially loaded (no need to
     relabel files), but it should also help enable some new system
     concepts which dynamically create the root filesystem in the
     initrd.

   - Add support for the "greatest lower bound" policy construct which
     is defined as the intersection of the MLS range of two SELinux
     labels"

* tag 'selinux-pr-20191126' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: default_range glblub implementation
  selinux: allow labeling before policy is loaded
  selinux: remove load size limit
parents 8a99117f 42345b68

security/selinux/hooks.c

+12 −0
Original line number Diff line number Diff line
@@ -3144,6 +3144,9 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name, 
		return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);

	}



	if (!selinux_state.initialized)

		return (inode_owner_or_capable(inode) ? 0 : -EPERM);



	sbsec = inode->i_sb->s_security;

	if (!(sbsec->flags & SBLABEL_MNT))

		return -EOPNOTSUPP;
@@ -3227,6 +3230,15 @@ static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, 
		return;

	}



	if (!selinux_state.initialized) {

		/* If we haven't even been initialized, then we can't validate

		 * against a policy, so leave the label as invalid. It may

		 * resolve to a valid label on the next revalidation try if

		 * we've since initialized.

		 */

		return;

	}



	rc = security_context_to_sid_force(&selinux_state, value, size,

					   &newsid);

	if (rc) {

security/selinux/include/security.h

+2 −1
Original line number Diff line number Diff line
@@ -40,10 +40,11 @@ 
#define POLICYDB_VERSION_CONSTRAINT_NAMES	29

#define POLICYDB_VERSION_XPERMS_IOCTL	30

#define POLICYDB_VERSION_INFINIBAND		31

#define POLICYDB_VERSION_GLBLUB		32



/* Range of policy versions we understand*/

#define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE

#define POLICYDB_VERSION_MAX   POLICYDB_VERSION_INFINIBAND

#define POLICYDB_VERSION_MAX   POLICYDB_VERSION_GLBLUB



/* Mask for just the mount related flags */

#define SE_MNTMASK	0x0f

security/selinux/selinuxfs.c

+0 −4
Original line number Diff line number Diff line
@@ -548,10 +548,6 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf, 
	if (*ppos != 0)

		goto out;



	length = -EFBIG;

	if (count > 64 * 1024 * 1024)

		goto out;



	length = -ENOMEM;

	data = vmalloc(count);

	if (!data)

security/selinux/ss/context.h

+32 −0
Original line number Diff line number Diff line
@@ -95,6 +95,38 @@ out: 
	return rc;

}





static inline int mls_context_glblub(struct context *dst,

				     struct context *c1, struct context *c2)

{

	struct mls_range *dr = &dst->range, *r1 = &c1->range, *r2 = &c2->range;

	int rc = 0;



	if (r1->level[1].sens < r2->level[0].sens ||

	    r2->level[1].sens < r1->level[0].sens)

		/* These ranges have no common sensitivities */

		return -EINVAL;



	/* Take the greatest of the low */

	dr->level[0].sens = max(r1->level[0].sens, r2->level[0].sens);



	/* Take the least of the high */

	dr->level[1].sens = min(r1->level[1].sens, r2->level[1].sens);



	rc = ebitmap_and(&dr->level[0].cat,

			 &r1->level[0].cat, &r2->level[0].cat);

	if (rc)

		goto out;



	rc = ebitmap_and(&dr->level[1].cat,

			 &r1->level[1].cat, &r2->level[1].cat);

	if (rc)

		goto out;



out:

	return rc;

}



static inline int mls_context_cmp(struct context *c1, struct context *c2)

{

	return ((c1->range.level[0].sens == c2->range.level[0].sens) &&

security/selinux/ss/ebitmap.c

+18 −0
Original line number Diff line number Diff line
@@ -77,6 +77,24 @@ int ebitmap_cpy(struct ebitmap *dst, struct ebitmap *src) 
	return 0;

}



int ebitmap_and(struct ebitmap *dst, struct ebitmap *e1, struct ebitmap *e2)

{

	struct ebitmap_node *n;

	int bit, rc;



	ebitmap_init(dst);



	ebitmap_for_each_positive_bit(e1, n, bit) {

		if (ebitmap_get_bit(e2, bit)) {

			rc = ebitmap_set_bit(dst, bit, 1);

			if (rc < 0)

				return rc;

		}

	}

	return 0;

}





#ifdef CONFIG_NETLABEL

/**

 * ebitmap_netlbl_export - Export an ebitmap into a NetLabel category bitmap

CRA Git | Maintained and supported by SUSTech CRA and CCSE