kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-20 19:23:40 +00:00
Code Issues Releases Packages Activity
linux/security/smack
History
Konstantin Andreev 6b1e45e135 smack: fix bug: unprivileged task can create labels 
[ Upstream commit c147e13ea7 ]

If an unprivileged task is allowed to relabel itself
(/smack/relabel-self is not empty),
it can freely create new labels by writing their
names into own /proc/PID/attr/smack/current

This occurs because do_setattr() imports
the provided label in advance,
before checking "relabel-self" list.

This change ensures that the "relabel-self" list
is checked before importing the label.

Fixes: 38416e5393 ("Smack: limited capability for changing process label")
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-01-19 13:09:22 +01:00
..
Kconfig treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
Makefile treewide: Add SPDX license identifier - Makefile/Kconfig 2019-05-21 10:50:46 +02:00
smack.h smack: Record transmuting in smk_transmuted 2023-10-06 13:18:20 +02:00
smack_access.c Smack: Fix wrong semantics in smk_access_entry() 2021-07-20 09:17:36 -07:00
smack_lsm.c smack: fix bug: unprivileged task can create labels 2026-01-19 13:09:22 +01:00
smack_netfilter.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500 2019-06-19 17:09:55 +02:00
smackfs.c smack: recognize ipv4 CIPSO w/o categories 2025-06-04 14:38:02 +02:00