Annotate all process transition-related permission checks that are only
performed against the current SELinux namespace and not ancestors with
comments. These checks are only applied against the current namespace
because the process SID only changes in the current namespace; the SID
in ancestor namespaces remains unchanged.
Signed-off-by: Stephen Smalley <stephen.smalley.work@xxxxxxxxx>
---
security/selinux/hooks.c | 46 ++++++++++++++++++++++++++++++++++------
1 file changed, 40 insertions(+), 6 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 3fd787bf5cc6..5730138d4eb8 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2385,19 +2385,23 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
if (rc)
return rc;
} else {
+ /* Check permissions for the transition. */
/*
* Only check against the current SELinux namespace
* because only the SID in the current namespace
* is changed by a transition.
*/
-
- /* Check permissions for the transition. */
rc = avc_has_perm(current_selinux_state,
old_tsec->sid, new_tsec->sid,
SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
if (rc)
return rc;
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
+ */
rc = avc_has_perm(current_selinux_state,
new_tsec->sid, isec->sid,
SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
@@ -2406,6 +2410,11 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
/* Check for shared state */
if (bprm->unsafe & LSM_UNSAFE_SHARE) {
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
+ */
rc = avc_has_perm(current_selinux_state,
old_tsec->sid, new_tsec->sid,
SECCLASS_PROCESS, PROCESS__SHARE,
@@ -2419,6 +2428,12 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
u32 ptsid = ptrace_parent_sid();
if (ptsid != 0) {
+ /*
+ * Only check against the current SELinux
+ * namespace because only the SID in the
+ * current namespace is changed by a
+ * transition.
+ */
rc = avc_has_perm(current_selinux_state,
ptsid, new_tsec->sid,
SECCLASS_PROCESS,
@@ -2434,6 +2449,11 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
/* Enable secure mode for SIDs transitions unless
the noatsecure permission is granted between
the two SIDs, i.e. ahp returns 0. */
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
+ */
rc = avc_has_perm(current_selinux_state,
old_tsec->sid, new_tsec->sid,
SECCLASS_PROCESS, PROCESS__NOATSECURE,
@@ -2540,8 +2560,10 @@ static void selinux_bprm_committing_creds(const struct linux_binprm *bprm)
* higher than the default soft limit for cases where the default is
* lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
*/
- /* Only check against the current namespace because the SID
- * does not change in the parent.
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
*/
rc = avc_has_perm(current_selinux_state,
new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
@@ -2583,8 +2605,10 @@ static void selinux_bprm_committed_creds(const struct linux_binprm *bprm)
* This must occur _after_ the task SID has been updated so that any
* kill done after the flush will be checked against the new SID.
*/
- /* Only check against the current namespace because the SID
- * does not change in the parent.
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
*/
rc = avc_has_perm(current_selinux_state,
osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
@@ -6651,6 +6675,11 @@ static int selinux_lsm_setattr(u64 attr, void *value, size_t size)
}
/* Check permissions for the transition. */
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
+ */
error = avc_has_perm(current_selinux_state,
tsec->sid, sid, SECCLASS_PROCESS,
PROCESS__DYNTRANSITION, NULL);
@@ -6661,6 +6690,11 @@ static int selinux_lsm_setattr(u64 attr, void *value, size_t size)
Otherwise, leave SID unchanged and fail. */
ptsid = ptrace_parent_sid();
if (ptsid != 0) {
+ /*
+ * Only check against the current SELinux namespace
+ * because only the SID in the current namespace
+ * is changed by a transition.
+ */
error = avc_has_perm(current_selinux_state,
ptsid, sid, SECCLASS_PROCESS,
PROCESS__PTRACE, NULL);
--
2.47.1
