kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-16 22:39:48 +00:00
Code Issues Releases Packages Activity
linux/security/selinux/include
History
Stephen Smalley cf1e870707 selinux: avoid silent denials in permissive mode under RCU walk 
commit 3a28cff3bd upstream.

commit 0dc1ba24f7 ("SELINUX: Make selinux cache VFS RCU walks safe")
results in no audit messages at all if in permissive mode because the
cache is updated during the rcu walk and thus no denial occurs on
the subsequent ref walk.  Fix this by not updating the cache when
performing a non-blocking permission check.  This only affects search
and symlink read checks during rcu walk.

Fixes: 0dc1ba24f7 ("SELINUX: Make selinux cache VFS RCU walks safe")
Reported-by: BMK <bmktuwien@gmail.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <paul@paul-moore.com>
[bwh: Backported to 3.16:
 - Add flags parameter to avc_update_node(), done upstream in commit
   fa1aa143ac "selinux: extended permissions for ioctls"
 - Adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2019-07-09 22:03:45 +01:00
..
audit.h SELinux: keep the code clean formating and syntax 2008-07-14 15:01:36 +10:00
avc.h selinux: avoid silent denials in permissive mode under RCU walk 2019-07-09 22:03:45 +01:00
avc_ss.h selinux: sparse fix: fix several warnings in the security server code 2011-09-09 16:56:32 -07:00
classmap.h audit: add netlink audit protocol bind to check capabilities on multicast join 2014-04-22 21:42:27 -04:00
conditional.h Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00
initial_sid_to_string.h selinux: const strings in tables 2010-03-08 09:33:53 +11:00
netif.h doc: Update the email address for Paul Moore in various source files 2011-08-01 17:58:33 -07:00
netlabel.h doc: Update the email address for Paul Moore in various source files 2011-08-01 17:58:33 -07:00
netnode.h doc: Update the email address for Paul Moore in various source files 2011-08-01 17:58:33 -07:00
netport.h doc: Update the email address for Paul Moore in various source files 2011-08-01 17:58:33 -07:00
objsec.h SELinux: Fix possible NULL pointer dereference in selinux_inode_permission() 2014-01-12 16:53:13 +07:00
security.h selinux: add gfp argument to security_xfrm_policy_alloc and fix callers 2014-03-10 08:30:02 +01:00
xfrm.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-03-25 20:29:20 -04:00