mbox series

[V2,0/2] Fix SELinux denials against target driver

Message ID 20240215143944.847184-1-mlombard@redhat.com (mailing list archive)
Headers show
Series Fix SELinux denials against target driver | expand

Message

Maurizio Lombardi Feb. 15, 2024, 2:39 p.m. UTC
Steps to reproduce:

1) install the ibacm, rdma-core and targetcli
2) service ibacm start   (ignore the errors)
3) Look at the dmesg, you will see an error message like
   "db_root: cannot open: /etc/target"

4) Execute $ sudo ausearch -m AVC,USER_AVC -ts recent

   type=AVC msg=audit(1707990698.893:610): avc:  denied  { read } for  pid=26447
   comm="systemd-modules" name="target" dev="dm-0" ino=973050 scontext=system_u:system_r:systemd_modules_load_t:s0
   tcontext=system_u:object_r:targetd_etc_rw_t:s0 tclass=dir permissive=0

Fix inspired by commit 581dd69830341d299b0c097fc366097ab497d679

V2: fix a memory leak in the error path, add a patch to set
    a freed pointer to NULL to avoid possible double frees

Maurizio Lombardi (2):
  target: fix selinux error when systemd-modules loads the target module
  target: set the xcopy_wq pointer to NULL after free.

 drivers/target/target_core_configfs.c | 12 ++++++++++++
 drivers/target/target_core_xcopy.c    |  4 +++-
 2 files changed, 15 insertions(+), 1 deletion(-)

Comments

Martin K. Petersen April 6, 2024, 1:58 a.m. UTC | #1
On Thu, 15 Feb 2024 15:39:42 +0100, Maurizio Lombardi wrote:

> Steps to reproduce:
> 
> 1) install the ibacm, rdma-core and targetcli
> 2) service ibacm start   (ignore the errors)
> 3) Look at the dmesg, you will see an error message like
>    "db_root: cannot open: /etc/target"
> 
> [...]

Applied to 6.9/scsi-fixes, thanks!

[1/2] target: fix selinux error when systemd-modules loads the target module
      https://git.kernel.org/mkp/scsi/c/97a54ef596c3