| Message ID | 161906228493.81125.6079062739552342511.stgit@olly (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | selinux: add proper NULL termination to the secclass_map permissions | expand |
On Wed, Apr 21, 2021 at 11:31 PM Paul Moore <paul@paul-moore.com> wrote: > > This patch adds the missing NULL termination to the "bpf" and > "perf_event" object class permission lists. > > This missing NULL termination should really only affect the tools > under scripts/selinux, with the most important being genheaders.c, > although in practice this has not been an issue on any of my dev/test > systems. If the problem were to manifest itself it would likely > result in bogus permissions added to the end of the object class; > thankfully with no access control checks using these bogus > permissions and no policies defining these permissions the impact > would likely be limited to some noise about undefined permissions > during policy load. > > Cc: stable@vger.kernel.org > Fixes: ec27c3568a34 ("selinux: bpf: Add selinux check for eBPF syscall operations") > Fixes: da97e18458fb ("perf_event: Add support for LSM and SELinux checks") > Signed-off-by: Paul Moore <paul@paul-moore.com> > --- > security/selinux/include/classmap.h | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) I just merged this into selinux/next, and given that we are at -rc8 I felt a bit of an explanation was a good idea. Typically fixes like this would be merged via the current selinux/stable-X.YY branch and sent to Linus via a PR after a few days of soaking and test runs. However, with the v5.12 release likely this weekend, only a few days away, it seems overly risky to send this to Linus now when one considers the nature of the patch and the fact that we can send it to Linus as part of the v5.13 merge window next week.
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index ba2e01a6955c..62d19bccf3de 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -242,11 +242,12 @@ struct security_class_mapping secclass_map[] = { { "infiniband_endport", { "manage_subnet", NULL } }, { "bpf", - {"map_create", "map_read", "map_write", "prog_load", "prog_run"} }, + { "map_create", "map_read", "map_write", "prog_load", "prog_run", + NULL } }, { "xdp_socket", { COMMON_SOCK_PERMS, NULL } }, { "perf_event", - {"open", "cpu", "kernel", "tracepoint", "read", "write"} }, + { "open", "cpu", "kernel", "tracepoint", "read", "write", NULL } }, { "lockdown", { "integrity", "confidentiality", NULL } }, { "anon_inode",
This patch adds the missing NULL termination to the "bpf" and "perf_event" object class permission lists. This missing NULL termination should really only affect the tools under scripts/selinux, with the most important being genheaders.c, although in practice this has not been an issue on any of my dev/test systems. If the problem were to manifest itself it would likely result in bogus permissions added to the end of the object class; thankfully with no access control checks using these bogus permissions and no policies defining these permissions the impact would likely be limited to some noise about undefined permissions during policy load. Cc: stable@vger.kernel.org Fixes: ec27c3568a34 ("selinux: bpf: Add selinux check for eBPF syscall operations") Fixes: da97e18458fb ("perf_event: Add support for LSM and SELinux checks") Signed-off-by: Paul Moore <paul@paul-moore.com> --- security/selinux/include/classmap.h | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)