| Message ID | 20240807090057.1334-1-thunder.leizhen@huaweicloud.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | [1/1] selinux: add the processing of the failure of avc_add_xperms_decision() | expand |
On Wed, Aug 7, 2024 at 5:02 AM <thunder.leizhen@huaweicloud.com> wrote: > > From: Zhen Lei <thunder.leizhen@huawei.com> > > When avc_add_xperms_decision() fails, the information recorded by the new > avc node is incomplete. In this case, the new avc node should be released > instead of replacing the old avc node. > > Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls") > Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com> > Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> > --- > security/selinux/avc.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) > > diff --git a/security/selinux/avc.c b/security/selinux/avc.c > index 7087cd2b802d8d8..b49c44869dc4627 100644 > --- a/security/selinux/avc.c > +++ b/security/selinux/avc.c > @@ -907,7 +907,11 @@ static int avc_update_node(u32 event, u32 perms, u8 driver, u8 xperm, u32 ssid, > node->ae.avd.auditdeny &= ~perms; > break; > case AVC_CALLBACK_ADD_XPERMS: > - avc_add_xperms_decision(node, xpd); > + rc = avc_add_xperms_decision(node, xpd); > + if (rc) { > + avc_node_kill(node); > + goto out_unlock; > + } > break; > } > avc_node_replace(node, orig); > -- > 2.34.1 >
On Aug 7, 2024 thunder.leizhen@huaweicloud.com wrote: > > When avc_add_xperms_decision() fails, the information recorded by the new > avc node is incomplete. In this case, the new avc node should be released > instead of replacing the old avc node. > > Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls") > Suggested-by: Stephen Smalley <stephen.smalley.work@gmail.com> > Signed-off-by: Zhen Lei <thunder.leizhen@huawei.com> > Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> > --- > security/selinux/avc.c | 6 +++++- > 1 file changed, 5 insertions(+), 1 deletion(-) Thanks, this looks good to me. I'm going to merge this into selinux/stable-6.11 with the idea of sending it, and your other patch, up to Linus tomorrow, or potentially next week. Thanks for your help! -- paul-moore.com
diff --git a/security/selinux/avc.c b/security/selinux/avc.c index 7087cd2b802d8d8..b49c44869dc4627 100644 --- a/security/selinux/avc.c +++ b/security/selinux/avc.c @@ -907,7 +907,11 @@ static int avc_update_node(u32 event, u32 perms, u8 driver, u8 xperm, u32 ssid, node->ae.avd.auditdeny &= ~perms; break; case AVC_CALLBACK_ADD_XPERMS: - avc_add_xperms_decision(node, xpd); + rc = avc_add_xperms_decision(node, xpd); + if (rc) { + avc_node_kill(node); + goto out_unlock; + } break; } avc_node_replace(node, orig);