Messages in this thread Patch in this message | | | From | Roland McGrath <> | Subject | [PATCH 2/2] SELinux: Do not apply MMAP_ZERO check to PROT_NONE mappings | Date | Fri, 21 Oct 2011 14:39:55 -0700 (PDT) |
| |
An mmap with PROT_NONE is done specifically to ensure that an address will fault. So doing this on addresses below CONFIG_LSM_MMAP_MIN_ADDR is not seeking a "dangerous" operation. Conversely, it's an attempt to ensure robustness in case CONFIG_LSM_MMAP_MIN_ADDR or vm.mmap_min_addr is less restrictive than the user wants to be.
Since we might let a low mapping exist at all without a check, we add another check to prevent mprotect from granting access to such a mapping without passing an MMAP_ZERO security check.
Signed-off-by: Roland McGrath <roland@hack.frob.com> --- security/selinux/hooks.c | 17 ++++++++++++++++- 1 files changed, 16 insertions(+), 1 deletions(-)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 76e6f04..1e3657b 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3062,7 +3062,8 @@ static int selinux_file_mmap(struct file *file, unsigned long reqprot, * at bad behaviour/exploit that we always want to get the AVC, even * if DAC would have also denied the operation. */ - if (addr < CONFIG_LSM_MMAP_MIN_ADDR) { + if (addr < CONFIG_LSM_MMAP_MIN_ADDR && + (addr_only || prot != PROT_NONE)) { rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT, MEMPROTECT__MMAP_ZERO, NULL); if (rc) @@ -3091,6 +3092,20 @@ static int selinux_file_mprotect(struct vm_area_struct *vma, if (selinux_checkreqprot) prot = reqprot; + /* + * Notice that we are intentionally putting the SELinux check before + * the secondary cap_file_mprotect check. This is such a likely attempt + * at bad behaviour/exploit that we always want to get the AVC, even + * if DAC would have also denied the operation. + */ + if (addr < CONFIG_LSM_MMAP_MIN_ADDR && prot != PROT_NONE) { + u32 sid = current_sid(); + rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT, + MEMPROTECT__MMAP_ZERO, NULL); + if (rc) + return rc; + } + /* do DAC check on address space usage */ rc = cap_file_mprotect(vma, reqprot, prot) if (rc)
| |