Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 22:19:30 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge tag 'selinux-pr-20260903' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux

Browse Source 
Pull SELinux fixes from Paul Moore:
 "Two SELinux fixes: one to fix how we lookup a BPF token's creator
  label to prevent a possible TOCTOU, and one to update Ondrej's email
  address"

* tag 'selinux-pr-20260903' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  MAINTAINERS, mailmap: update email address for Ondrej Mosnáček
  selinux: fix BPF token permission checks
This commit is contained in:
Linus Torvalds
2026-09-03 13:36:21 -07:00
parent 36b03c3e27 4299767d77
commit a500db7819
3 changed files with 12 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.mailmap
+1
View File
@@ -699,6 +699,7 @@ Oliver Hartkopp <socketcan@hartkopp.net> <oliver.hartkopp@volkswagen.de>
Oliver Hartkopp <socketcan@hartkopp.net> <oliver@hartkopp.net>
Oliver Upton <oupton@kernel.org> <oupton@google.com>
Oliver Upton <oupton@kernel.org> <oliver.upton@linux.dev>
Ondrej Mosnáček <omosnacek@gmail.com> <omosnace@redhat.com>
Ondřej Jirman <megi@xff.cz> <megous@megous.com>
Oza Pawandeep <quic_poza@quicinc.com> <poza@codeaurora.org>
Pali Rohár <pali@kernel.org> <pali.rohar@gmail.com>
MAINTAINERS
+1 -1
View File
@@ -24772,7 +24772,7 @@ K: \bsecurity_[a-z_0-9]\+\b
SELINUX SECURITY MODULE
M: Paul Moore <paul@paul-moore.com>
M: Stephen Smalley <stephen.smalley.work@gmail.com>
R: Ondrej Mosnacek <omosnace@redhat.com>
R: Ondrej Mosnáček <omosnacek@gmail.com>
L: selinux@vger.kernel.org
S: Supported
W: https://github.com/SELinuxProject
security/selinux/hooks.c
+10 -26
View File
@@ -7267,24 +7267,6 @@ static int selinux_bpf_prog(struct bpf_prog *prog)
BPF__PROG_RUN, NULL);
}
static u32 selinux_bpffs_creator_sid(u32 fd)
{
struct path path;
struct super_block *sb;
struct superblock_security_struct *sbsec;
CLASS(fd, f)(fd);
if (fd_empty(f))
return SECSID_NULL;
path = fd_file(f)->f_path;
sb = path.dentry->d_sb;
sbsec = selinux_superblock(sb);
return sbsec->creator_sid;
}
static int selinux_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
struct bpf_token *token, bool kernel)
{
@@ -7297,7 +7279,7 @@ static int selinux_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
if (!token)
ssid = bpfsec->sid;
else
ssid = selinux_bpffs_creator_sid(attr->map_token_fd);
ssid = selinux_bpf_token_security(token)->grantor_sid;
return avc_has_perm(ssid, bpfsec->sid, SECCLASS_BPF, BPF__MAP_CREATE,
NULL);
@@ -7315,7 +7297,7 @@ static int selinux_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
if (!token)
ssid = bpfsec->sid;
else
ssid = selinux_bpffs_creator_sid(attr->prog_token_fd);
ssid = selinux_bpf_token_security(token)->grantor_sid;
return avc_has_perm(ssid, bpfsec->sid, SECCLASS_BPF, BPF__PROG_LOAD,
NULL);
@@ -7329,12 +7311,14 @@ static int selinux_bpf_token_create(struct bpf_token *token,
const struct path *path)
{
struct bpf_security_struct *bpfsec;
u32 sid = selinux_bpffs_creator_sid(attr->token_create.bpffs_fd);
struct superblock_security_struct *sbsec;
int err;
sbsec = selinux_superblock(path->dentry->d_sb);
bpfsec = selinux_bpf_token_security(token);
bpfsec->sid = current_sid();
bpfsec->grantor_sid = sid;
bpfsec->grantor_sid = sbsec->creator_sid;
bpfsec->perms = 0;
/**
@@ -7343,15 +7327,15 @@ static int selinux_bpf_token_create(struct bpf_token *token,
* in the allowed_cmds bitmap.
*/
if (bpf_token_cmd(token, BPF_MAP_CREATE)) {
err = avc_has_perm(bpfsec->sid, sid, SECCLASS_BPF,
BPF__MAP_CREATE_AS, NULL);
err = avc_has_perm(bpfsec->sid, bpfsec->grantor_sid,
SECCLASS_BPF, BPF__MAP_CREATE_AS, NULL);
if (err)
return err;
bpfsec->perms |= BPF__MAP_CREATE;
}
if (bpf_token_cmd(token, BPF_PROG_LOAD)) {
err = avc_has_perm(bpfsec->sid, sid, SECCLASS_BPF,
BPF__PROG_LOAD_AS, NULL);
err = avc_has_perm(bpfsec->sid, bpfsec->grantor_sid,
SECCLASS_BPF, BPF__PROG_LOAD_AS, NULL);
if (err)
return err;
bpfsec->perms |= BPF__PROG_LOAD;