diff mbox series

[RFC,19/44] selinux: fix selinux_lsm_getattr() check

Message ID 20250102164509.25606-20-stephen.smalley.work@gmail.com (mailing list archive)
State New
Delegated to: Paul Moore
Headers show
Series SELinux namespace support | expand

Commit Message

Stephen Smalley Jan. 2, 2025, 4:44 p.m. UTC 
Fix the selinux_lsm_getattr() permission check to use
cred_task_has_perm() instead of cred_has_perm() since we need
to use the target task's SID in the same namespace as current.

Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
---
 security/selinux/hooks.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)
diff mbox series

Patch

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index a19cfef5325a..728a59aa52d6 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -6448,14 +6448,14 @@  static int selinux_lsm_getattr(unsigned int attr, struct task_struct *p,
 	u32 len;
 
 	rcu_read_lock();
-	tsec = task_security(p);
 	if (p != current) {
-		error = cred_has_perm(current_cred(), tsec->sid,
-				      SECCLASS_PROCESS, PROCESS__GETATTR,
-				      NULL);
+		error = cred_task_has_perm(current_cred(), p,
+					   SECCLASS_PROCESS,
+					   PROCESS__GETATTR, NULL);
 		if (error)
 			goto err_unlock;
 	}
+	tsec = task_security(p);
 	switch (attr) {
 	case LSM_ATTR_CURRENT:
 		sid = tsec->sid;