On Tue, Jan 25, 2022 at 4:34 PM Demi Marie Obenour <demiobenour@xxxxxxxxx> wrote: > > These ioctls are equivalent to fcntl(fd, F_SETFD, flags), which SELinux > always allows too. Furthermore, a failed FIOCLEX could result in a file > descriptor being leaked to a process that should not have access to it. > > Signed-off-by: Demi Marie Obenour <demiobenour@xxxxxxxxx> > --- > security/selinux/hooks.c | 5 +++++ > 1 file changed, 5 insertions(+) I'm not convinced that these two ioctls should be exempt from SELinux policy control, can you explain why allowing these ioctls with the file:ioctl permission is not sufficient for your use case? Is it a matter of granularity? > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 5b6895e4fc29..8f3b2f15c1f3 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -3728,6 +3728,11 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd, > error = file_has_perm(cred, file, FILE__GETATTR); > break; > > + /* must always succeed */ > + case FIOCLEX: > + case FIONCLEX: > + break; > + > case FS_IOC_SETFLAGS: > case FS_IOC_SETVERSION: > error = file_has_perm(cred, file, FILE__SETATTR); -- paul-moore.com
