diff mbox series

[RFC,36/44] selinux: set initial SID context for init to "kernel" in global SID table

Message ID 20250102164509.25606-37-stephen.smalley.work@gmail.com (mailing list archive)
State New
Delegated to: Paul Moore
Headers show
Series SELinux namespace support | expand

Commit Message

Stephen Smalley Jan. 2, 2025, 4:45 p.m. UTC 
Userspace treats any non-null value other than "kernel" as an
indicator that SELinux policy has already been loaded, so
the global SID table needs to transparently remap the init
initial SID to "kernel" just like the security server does.

Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
---
 security/selinux/global_sidtab.c | 9 +++++++++
 1 file changed, 9 insertions(+)
diff mbox series

Patch

diff --git a/security/selinux/global_sidtab.c b/security/selinux/global_sidtab.c
index 983b406389cb..50c3d58a11ed 100644
--- a/security/selinux/global_sidtab.c
+++ b/security/selinux/global_sidtab.c
@@ -21,6 +21,15 @@  int global_sidtab_init(void)
 
 		if (!str)
 			continue;
+		/*
+		 * Before the policy is loaded, translate
+		 * SECINITSID_INIT to "kernel", because systemd and
+		 * libselinux < 2.6 take a getcon_raw() result that is
+		 * both non-null and not "kernel" to mean that a policy
+		 * is already loaded.
+		 */
+		if (sid == SECINITSID_INIT)
+			str = "kernel";
 		ctx.str = (char *)str;
 		ctx.len = strlen(str)+1;
 		rc = sidtab_set_initial(&global_sidtab, sid, &ctx);