diff mbox series

[RFC,37/44] selinux: disallow writes to /sys/fs/selinux/user in non-init namespaces

Message ID 20250102164509.25606-38-stephen.smalley.work@gmail.com (mailing list archive)
State New
Delegated to: Paul Moore
Headers show
Series SELinux namespace support | expand

Commit Message

Stephen Smalley Jan. 2, 2025, 4:45 p.m. UTC 
Disallow writes to /sys/fs/selinux/user in non-init SELinux namespaces.

Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
---
 security/selinux/selinuxfs.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)
diff mbox series

Patch

diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index c91bf329692c..de4d7eda415f 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c
@@ -1354,9 +1354,16 @@  static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
 	int rc;
 	u32 i, len, nsids;
 
-	pr_warn_ratelimited("SELinux: %s (%d) wrote to /sys/fs/selinux/user!"
-		" This will not be supported in the future; please update your"
-		" userspace.\n", current->comm, current->pid);
+	if (state == init_selinux_state) {
+		pr_warn_ratelimited("SELinux: %s (%d) wrote to /sys/fs/selinux/user!"
+				" This will not be supported in the future; please update your"
+				" userspace.\n", current->comm, current->pid);
+	} else {
+		pr_warn_ratelimited("SELinux: %s (%d) tried to write to /sys/fs/selinux/user!"
+				" This is not supported in non-init SELinux namespaces; please update your"
+				" userspace.\n", current->comm, current->pid);
+		return -EPERM;
+	}
 
 	/*
 	 * Only check against the current namespace because