These ioctls are equivalent to fcntl(fd, F_SETFD, flags), which SELinux always allows too. Furthermore, a failed FIOCLEX could result in a file descriptor being leaked to a process that should not have access to it. Signed-off-by: Demi Marie Obenour <demiobenour@xxxxxxxxx> --- security/selinux/hooks.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 5b6895e4fc29..8f3b2f15c1f3 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3728,6 +3728,11 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd, error = file_has_perm(cred, file, FILE__GETATTR); break; + /* must always succeed */ + case FIOCLEX: + case FIONCLEX: + break; + case FS_IOC_SETFLAGS: case FS_IOC_SETVERSION: error = file_has_perm(cred, file, FILE__SETATTR); -- Sincerely, Demi Marie Obenour
