The patch titled selinux: adjust rules for ATTR_FORCE has been added to the -mm tree. Its filename is selinux-adjust-rules-for-attr_force.patch Before you just go and hit "reply", please: a) Consider who else should be cc'ed b) Prefer to cc a suitable mailing list as well c) Ideally: find the original patch on the mailing list and do a reply-to-all to that, adding suitable additional cc's *** Remember to use Documentation/SubmitChecklist when testing your code *** See http://userweb.kernel.org/~akpm/stuff/added-to-mm.txt to find out what to do about this The current -mm tree may be found at http://userweb.kernel.org/~akpm/mmotm/ ------------------------------------------------------ Subject: selinux: adjust rules for ATTR_FORCE From: Amerigo Wang <amwang@xxxxxxxxxx> As suggested by OGAWA Hirofumi in thread: http://lkml.org/lkml/2009/8/7/132, we should let selinux_inode_setattr() to match our ATTR_* rules. ATTR_FORCE should not force things like ATTR_SIZE. [hirofumi@xxxxxxxxxxxxxxxxxx: tweaks] Signed-off-by: WANG Cong <amwang@xxxxxxxxxx> Signed-off-by: OGAWA Hirofumi <hirofumi@xxxxxxxxxxxxxxxxxx> Acked-by: Stephen Smalley <sds@xxxxxxxxxxxxx> Cc: Eric Paris <eparis@xxxxxxxxxx> Cc: Eugene Teo <eteo@xxxxxxxxxx> Cc: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Cc: Christoph Hellwig <hch@xxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- security/selinux/hooks.c | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff -puN security/selinux/hooks.c~selinux-adjust-rules-for-attr_force security/selinux/hooks.c --- a/security/selinux/hooks.c~selinux-adjust-rules-for-attr_force +++ a/security/selinux/hooks.c @@ -2711,12 +2711,18 @@ static int selinux_inode_permission(stru static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr) { const struct cred *cred = current_cred(); + unsigned int ia_valid = iattr->ia_valid; - if (iattr->ia_valid & ATTR_FORCE) - return 0; + /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */ + if (ia_valid & ATTR_FORCE) { + ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE | + ATTR_FORCE); + if (!ia_valid) + return 0; + } - if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | - ATTR_ATIME_SET | ATTR_MTIME_SET)) + if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | + ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET)) return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR); return dentry_has_perm(cred, NULL, dentry, FILE__WRITE); _ Patches currently in -mm which might be from amwang@xxxxxxxxxx are origin.patch linux-next.patch selinux-adjust-rules-for-attr_force.patch vfs-allow-file-truncations-when-both-suid-and-write-permissions-set.patch xtensa-use-generic-sys_pipe.patch kcore-fix-proc-kcores-statst_size.patch elf-clean-up-fill_note_info.patch elf-clean-up-fill_note_info-fix.patch -- To unsubscribe from this list: send the line "unsubscribe mm-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html