On Fri, Nov 12, 2021 at 05:11:38PM +0100, Greg KH wrote:
> On Wed, Nov 10, 2021 at 02:59:10PM -0800, Todd Kjos wrote:
> > commit 52f88693378a58094c538662ba652aff0253c4fe upstream.
> >
> > Since binder was integrated with selinux, it has passed
> > 'struct task_struct' associated with the binder_proc
> > to represent the source and target of transactions.
> > The conversion of task to SID was then done in the hook
> > implementations. It turns out that there are race conditions
> > which can result in an incorrect security context being used.
> >
> > Fix by using the 'struct cred' saved during binder_open and pass
> > it to the selinux subsystem.
> >
> > Cc: stable@xxxxxxxxxxxxxxx # 5.14 (need backport for earlier stables)
> > Fixes: 79af73079d75 ("Add security hooks to binder and implement the hooks for SELinux.")
> > Suggested-by: Jann Horn <jannh@xxxxxxxxxx>
> > Signed-off-by: Todd Kjos <tkjos@xxxxxxxxxx>
> > Acked-by: Casey Schaufler <casey@xxxxxxxxxxxxxxxx>
> > Signed-off-by: Paul Moore <paul@xxxxxxxxxxxxxx>
> > Change-Id: Id7157515d2b08f11683aeb8ad9b8f1da075d34e7
> > ---
> > drivers/android/binder.c | 18 +++++++++---------
> > include/linux/lsm_hooks.h | 32 ++++++++++++++++----------------
> > include/linux/security.h | 28 ++++++++++++++--------------
> > security/security.c | 14 +++++++-------
> > security/selinux/hooks.c | 31 +++++++++++++------------------
> > 5 files changed, 59 insertions(+), 64 deletions(-)
>
> This doesn't apply at all. I've applied patch 1/2 here, but can you
> redo this one and submit it again?
Ugh, nope, my fault, sorry, this worked just fine.
It's been a long day...
greg k-h
