@@ -171,6 +171,10 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
old_value = enforcing_enabled(state);
if (new_value != old_value) {
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
length = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETENFORCE,
@@ -344,6 +348,10 @@ static ssize_t sel_write_unshare(struct file *file, const char __user *buf,
if (*ppos != 0)
return -EINVAL;
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
rc = avc_has_perm(current_selinux_state, current_sid(),
SECINITSID_SECURITY, SECCLASS_SECURITY,
SECURITY__UNSHARE, NULL);
@@ -455,6 +463,10 @@ static int sel_open_policy(struct inode *inode, struct file *filp)
mutex_lock(&fsi->state->policy_mutex);
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
rc = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
@@ -517,6 +529,10 @@ static ssize_t sel_read_policy(struct file *filp, char __user *buf,
struct policy_load_memory *plm = filp->private_data;
int ret;
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
ret = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
@@ -674,6 +690,11 @@ static ssize_t sel_write_load(struct file *file, const char __user *buf,
return -EPERM;
mutex_lock(&fsi->state->policy_mutex);
+
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
length = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__LOAD_POLICY, NULL);
@@ -729,6 +750,10 @@ static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
u32 sid, len;
ssize_t length;
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
length = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__CHECK_CONTEXT, NULL);
@@ -780,6 +805,10 @@ static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
if (fsi->state != current_selinux_state)
return -EPERM;
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
length = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETCHECKREQPROT,
@@ -839,6 +868,10 @@ static ssize_t sel_write_validatetrans(struct file *file,
if (state != current_selinux_state)
return -EPERM;
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
rc = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__VALIDATE_TRANS, NULL);
@@ -972,6 +1005,10 @@ static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
struct av_decision avd;
ssize_t length;
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
length = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_AV, NULL);
@@ -1026,6 +1063,10 @@ static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
u32 len;
int nargs;
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
length = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_CREATE,
@@ -1128,6 +1169,10 @@ static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
char *newcon = NULL;
u32 len;
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
length = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_RELABEL,
@@ -1193,6 +1238,10 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
" This will not be supported in the future; please update your"
" userspace.\n", current->comm, current->pid);
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
length = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_USER,
@@ -1258,6 +1307,10 @@ static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
char *newcon = NULL;
u32 len;
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
length = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__COMPUTE_MEMBER,
@@ -1389,6 +1442,10 @@ static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
mutex_lock(&fsi->state->policy_mutex);
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
length = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETBOOL,
@@ -1448,6 +1505,10 @@ static ssize_t sel_commit_bools_write(struct file *filep,
mutex_lock(&fsi->state->policy_mutex);
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
length = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETBOOL,
@@ -1569,6 +1630,10 @@ static ssize_t sel_write_avc_cache_threshold(struct file *file,
if (state != current_selinux_state)
return -EPERM;
+ /*
+ * Only check against the current namespace because
+ * this operation only affects it and no others.
+ */
ret = avc_has_perm(current_selinux_state,
current_sid(), SECINITSID_SECURITY,
SECCLASS_SECURITY, SECURITY__SETSECPARAM,
Annotate the selinuxfs permission checks with comments explaining why we only check permissions against the current SELinux namespace (because these operations only read or modify the state of the current SELinux namespace). If we were instead to check permissions against ancestor namespaces, we would need to be allowed by the ancestor policies to perform the same operation in those namespaces, which would be undesirable. Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com> --- security/selinux/selinuxfs.c | 65 ++++++++++++++++++++++++++++++++++++ 1 file changed, 65 insertions(+)