| Message ID | 20250108231554.3634987-1-tweek@google.com (mailing list archive) |
|---|---|
| State | New |
| Headers | show |
| Series | selinux: map RTM_DELNSID to nlmsg_write | expand |
Le 09/01/2025 à 00:15, Thiébaud Weksteen a écrit : > The mapping for RTM_DELNSID was added in commit 387f989a60db > ("selinux/nlmsg: add RTM_GETNSID"). While this message type is not > expected from userspace, other RTM_DEL* types are mapped to the more > restrictive nlmsg_write permission. Move RTM_DELNSID to nlmsg_write in > case the implementation is changed in the future. Frankly, I don't think this will ever change. It's not a problem of implementing the delete command, it's conceptually no sense. I don't see why the DEL should be restricted in any way. Regards, Nicolas > > Fixes: 387f989a60db ("selinux/nlmsg: add RTM_GETNSID") > Signed-off-by: Thiébaud Weksteen <tweek@google.com> > --- > security/selinux/nlmsgtab.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c > index 3a95986b134f..f97e75301018 100644 > --- a/security/selinux/nlmsgtab.c > +++ b/security/selinux/nlmsgtab.c > @@ -71,7 +71,7 @@ static const struct nlmsg_perm nlmsg_route_perms[] = { > { RTM_DELMDB, NETLINK_ROUTE_SOCKET__NLMSG_WRITE }, > { RTM_GETMDB, NETLINK_ROUTE_SOCKET__NLMSG_READ }, > { RTM_NEWNSID, NETLINK_ROUTE_SOCKET__NLMSG_WRITE }, > - { RTM_DELNSID, NETLINK_ROUTE_SOCKET__NLMSG_READ }, > + { RTM_DELNSID, NETLINK_ROUTE_SOCKET__NLMSG_WRITE }, > { RTM_GETNSID, NETLINK_ROUTE_SOCKET__NLMSG_READ }, > { RTM_NEWSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ }, > { RTM_GETSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
diff --git a/security/selinux/nlmsgtab.c b/security/selinux/nlmsgtab.c index 3a95986b134f..f97e75301018 100644 --- a/security/selinux/nlmsgtab.c +++ b/security/selinux/nlmsgtab.c @@ -71,7 +71,7 @@ static const struct nlmsg_perm nlmsg_route_perms[] = { { RTM_DELMDB, NETLINK_ROUTE_SOCKET__NLMSG_WRITE }, { RTM_GETMDB, NETLINK_ROUTE_SOCKET__NLMSG_READ }, { RTM_NEWNSID, NETLINK_ROUTE_SOCKET__NLMSG_WRITE }, - { RTM_DELNSID, NETLINK_ROUTE_SOCKET__NLMSG_READ }, + { RTM_DELNSID, NETLINK_ROUTE_SOCKET__NLMSG_WRITE }, { RTM_GETNSID, NETLINK_ROUTE_SOCKET__NLMSG_READ }, { RTM_NEWSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ }, { RTM_GETSTATS, NETLINK_ROUTE_SOCKET__NLMSG_READ },
The mapping for RTM_DELNSID was added in commit 387f989a60db ("selinux/nlmsg: add RTM_GETNSID"). While this message type is not expected from userspace, other RTM_DEL* types are mapped to the more restrictive nlmsg_write permission. Move RTM_DELNSID to nlmsg_write in case the implementation is changed in the future. Fixes: 387f989a60db ("selinux/nlmsg: add RTM_GETNSID") Signed-off-by: Thiébaud Weksteen <tweek@google.com> --- security/selinux/nlmsgtab.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)