lkml.org 
[lkml]   [2020]   [Dec]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 120/346] selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling
    Date
    From: Paul Moore <paul@paul-moore.com>

    [ Upstream commit 200ea5a2292dc444a818b096ae6a32ba3caa51b9 ]

    A previous fix, commit 83370b31a915 ("selinux: fix error initialization
    in inode_doinit_with_dentry()"), changed how failures were handled
    before a SELinux policy was loaded. Unfortunately that patch was
    potentially problematic for two reasons: it set the isec->initialized
    state without holding a lock, and it didn't set the inode's SELinux
    label to the "default" for the particular filesystem. The later can
    be a problem if/when a later attempt to revalidate the inode fails
    and SELinux reverts to the existing inode label.

    This patch should restore the default inode labeling that existed
    before the original fix, without affecting the LABEL_INVALID marking
    such that revalidation will still be attempted in the future.

    Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()")
    Reported-by: Sven Schnelle <svens@linux.ibm.com>
    Tested-by: Sven Schnelle <svens@linux.ibm.com>
    Reviewed-by: Ondrej Mosnacek <omosnace@redhat.com>
    Signed-off-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    security/selinux/hooks.c | 31 +++++++++++++------------------
    1 file changed, 13 insertions(+), 18 deletions(-)

    diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
    index 02afe52a55d0d..08833bbb97aab 100644
    --- a/security/selinux/hooks.c
    +++ b/security/selinux/hooks.c
    @@ -1618,13 +1618,7 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
    * inode_doinit with a dentry, before these inodes could
    * be used again by userspace.
    */
    - isec->initialized = LABEL_INVALID;
    - /*
    - * There is nothing useful to jump to the "out"
    - * label, except a needless spin lock/unlock
    - * cycle.
    - */
    - return 0;
    + goto out_invalid;
    }

    len = INITCONTEXTLEN;
    @@ -1739,15 +1733,8 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
    * inode_doinit() with a dentry, before these inodes
    * could be used again by userspace.
    */
    - if (!dentry) {
    - isec->initialized = LABEL_INVALID;
    - /*
    - * There is nothing useful to jump to the "out"
    - * label, except a needless spin lock/unlock
    - * cycle.
    - */
    - return 0;
    - }
    + if (!dentry)
    + goto out_invalid;
    rc = selinux_genfs_get_sid(dentry, sclass,
    sbsec->flags, &sid);
    dput(dentry);
    @@ -1760,11 +1747,10 @@ static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dent
    out:
    spin_lock(&isec->lock);
    if (isec->initialized == LABEL_PENDING) {
    - if (!sid || rc) {
    + if (rc) {
    isec->initialized = LABEL_INVALID;
    goto out_unlock;
    }
    -
    isec->initialized = LABEL_INITIALIZED;
    isec->sid = sid;
    }
    @@ -1772,6 +1758,15 @@ out:
    out_unlock:
    spin_unlock(&isec->lock);
    return rc;
    +
    +out_invalid:
    + spin_lock(&isec->lock);
    + if (isec->initialized == LABEL_PENDING) {
    + isec->initialized = LABEL_INVALID;
    + isec->sid = sid;
    + }
    + spin_unlock(&isec->lock);
    + return 0;
    }

    /* Convert a Linux signal to an access vector. */
    --
    2.27.0


    \
     
     \ /
      Last update: 2020-12-28 17:10    [W:4.140 / U:0.712 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site