diff mbox series

[RFC,4/6] selinux: explicitly skip mediation of O_PATH file descriptors

Message ID 20250312212148.274205-5-ryan.lee@canonical.com (mailing list archive)
State Handled Elsewhere
Delegated to: Paul Moore
Headers show
Series fs, lsm: mediate O_PATH fd creation in file_open hook | expand

Commit Message

Ryan Lee March 12, 2025, 9:21 p.m. UTC 
Now that O_PATH fds are being passed to the file_open hook,
unconditionally skip mediation of them to preserve existing behavior.

Signed-off-by: Ryan Lee <ryan.lee@canonical.com>
---
 security/selinux/hooks.c | 5 +++++
 1 file changed, 5 insertions(+)
diff mbox series

Patch

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 07f71e6c2660..886ee9381507 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4009,6 +4009,11 @@  static int selinux_file_open(struct file *file)
 	 */
 	fsec->isid = isec->sid;
 	fsec->pseqno = avc_policy_seqno();
+
+	/* Preserve the behavior of O_PATH fd creation not being mediated */
+	if (file->f_flags & O_PATH)
+		return 0;
+
 	/*
 	 * Since the inode label or policy seqno may have changed
 	 * between the selinux_inode_permission check and the saving