diff mbox

selinux: fix missing dput() before selinuxfs unmount

Message ID 20180409183605.5956-1-sds@tycho.nsa.gov (mailing list archive)
State Accepted
Headers show

Commit Message

Stephen Smalley April 9, 2018, 6:36 p.m. UTC 
Commit 0619f0f5e36f ("selinux: wrap selinuxfs state") triggers
a BUG when SELinux is runtime-disabled (i.e. systemd or equivalent
disables SELinux before initial policy load via /sys/fs/selinux/disable
based on /etc/selinux/config SELINUX=disabled).  This does not manifest
if SELinux is disabled via kernel command line argument or if
SELinux is enabled (permissive or enforcing).

Before:
SELinux:  Disabled at runtime.
BUG: Dentry 000000006d77e5c7{i=17,n=null}  still in use (1) [unmount of selinuxfs selinuxfs]

After:
SELinux:  Disabled at runtime.

Fixes: 0619f0f5e36f ("selinux: wrap selinuxfs state")
Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
---
 security/selinux/selinuxfs.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Linus Torvalds April 9, 2018, 6:53 p.m. UTC | #1 
On Mon, Apr 9, 2018 at 11:36 AM, Stephen Smalley <sds@tycho.nsa.gov> wrote:
> Commit 0619f0f5e36f ("selinux: wrap selinuxfs state") triggers
> a BUG when SELinux is runtime-disabled (i.e. systemd or equivalent
> disables SELinux before initial policy load via /sys/fs/selinux/disable
> based on /etc/selinux/config SELINUX=disabled).

Thanks, applied.

               Linus
diff mbox

Patch

diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 4be683eeba01..245160373dab 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -2061,6 +2061,7 @@  __initcall(init_sel_fs);
 void exit_sel_fs(void)
 {
 	sysfs_remove_mount_point(fs_kobj, "selinux");
+	dput(selinux_null.dentry);
 	kern_unmount(selinuxfs_mount);
 	unregister_filesystem(&sel_fs_type);
 }