Add a SELinux access control for the newly introduced set_mempolicy lsm
hook. A new permission "setmempolicy" is defined under the "process" class
for it.
Signed-off-by: Yafang Shao <laoar.shao@xxxxxxxxx>
---
security/selinux/hooks.c | 8 ++++++++
security/selinux/include/classmap.h | 2 +-
2 files changed, 9 insertions(+), 1 deletion(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index feda711c6b7b..1528d4dcfa03 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4238,6 +4238,13 @@ static int selinux_userns_create(const struct cred *cred)
USER_NAMESPACE__CREATE, NULL);
}
+static int selinux_set_mempolicy(unsigned long mode, unsigned short mode_flags,
+ nodemask_t *nmask, unsigned int flags)
+{
+ return avc_has_perm(current_sid(), task_sid_obj(current), SECCLASS_PROCESS,
+ PROCESS__SETMEMPOLICY, NULL);
+}
+
/* Returns error only if unable to parse addresses */
static int selinux_parse_skb_ipv4(struct sk_buff *skb,
struct common_audit_data *ad, u8 *proto)
@@ -7072,6 +7079,7 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = {
LSM_HOOK_INIT(task_kill, selinux_task_kill),
LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
LSM_HOOK_INIT(userns_create, selinux_userns_create),
+ LSM_HOOK_INIT(set_mempolicy, selinux_set_mempolicy),
LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index a3c380775d41..c280d92a409f 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -51,7 +51,7 @@ const struct security_class_mapping secclass_map[] = {
"getattr", "setexec", "setfscreate", "noatsecure", "siginh",
"setrlimit", "rlimitinh", "dyntransition", "setcurrent",
"execmem", "execstack", "execheap", "setkeycreate",
- "setsockcreate", "getrlimit", NULL } },
+ "setsockcreate", "getrlimit", "setmempolicy", NULL } },
{ "process2",
{ "nnp_transition", "nosuid_transition", NULL } },
{ "system",
--
2.30.1 (Apple Git-130)
