Messages in this thread | | | From | Lucian Adrian Grijincu <> | Date | Tue, 1 Feb 2011 17:53:40 +0200 | Subject | Re: [PATCH] security/selinux: fix /proc/sys/ labeling |
| |
On Tue, Feb 1, 2011 at 5:02 PM, Stephen Smalley <sds@tycho.nsa.gov> wrote: > Is this patch really from Eric or just derived from an earlier patch by him?
No, sorry for the confusion. I seem to have triggered a git send-email bug.
>> Signed-off-by: Eric W. Biederman <ebiederm@xmission.com> > > And did Eric truly sign off on this patch or just on an earlier one?
Just the earlier one. I added his sign-off because of this paragraph in SubmittingPatches: | The Signed-off-by: tag indicates that the signer was involved in the | development of the patch, or that he/she was in the patch's delivery path.
> >> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c >> index e276eb4..7c5dfb1 100644 >> --- a/security/selinux/hooks.c >> +++ b/security/selinux/hooks.c >> @@ -1317,9 +1311,9 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent >> >> if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) { >> struct proc_inode *proci = PROC_I(inode); >> - if (proci->pde) { >> + if (opt_dentry && (proci->pde || proci->sysctl)) { >> isec->sclass = inode_mode_to_security_class(inode->i_mode); >> - rc = selinux_proc_get_sid(proci->pde, >> + rc = selinux_proc_get_sid(opt_dentry, >> isec->sclass, >> &sid); >> if (rc) > > It would be nice if we could eliminate the last remaining piece of proc > internal knowledge from this code - why do we need the proci->pde || > proci->sysctl test here? What changes without it?
Without we label all nodes in /proc/ through selinux_proc_get_sid.
/proc/1/limits should not get it's sid from here, but from security_task_to_inode -> selinux_task_to_inode.
Without the check we send "/1/limits" to selinux_proc_get_sid, which strips off "/1" leaving "/limits". This will be labeled with "proc_t" IIRC.
-- . ..: Lucian -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |