github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-23 13:14:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selinux: preserve user SID across nested backing files

Browse Source 
SELinux saves the user file SID in a backing-file security blob so it
remains available after mmap() replaces vma->vm_file with a backing file.

For nested backing files (overlayfs over overlayfs, or FUSE passthrough
backed by overlayfs), user_file may itself be a backing file.  Its
fsec->sid is the SID of the mounter that opened it, rather than the user
that opened the top-level file.  mprotect() then checks fd { use } against
the mounter SID.  This can incorrectly deny access without a domain
transition, or check the wrong target SID after one.

Copy the saved user SID when user_file is a backing file.  Keep using the
regular file SID for the first backing layer.

With two nested overlayfs mounts and SELinux enforcing,
mprotect(PROT_READ) returns EACCES with an fd { use } denial against the
mounter SID.  With this change, mprotect() succeeds.

Tested on arm64 QEMU with a small BusyBox initramfs and a purpose-built
SELinux policy.  The original test was also repeated with Fedora Cloud
Base 44 userspace and gave the same result.

Cc: stable@vger.kernel.org
Fixes: 82544d36b1 ("selinux: fix overlayfs mmap() and mprotect() access checks")
Assisted-by: LLM
Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Karl Mehltretter 2026-08-29 23:32:55 +02:00 committed by Paul Moore
parent 8861db3051
commit 8c0c602202
2 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
security/selinux/hooks.c
View File

@ -3843,13 +3843,20 @@ static int selinux_file_alloc_security(struct file *file)
return 0;
}
static inline u32 selinux_file_user_sid(const struct file *file)
{
if (unlikely(file->f_mode & FMODE_BACKING))
return selinux_backing_file(file)->uf_sid;
return selinux_file(file)->sid;
}
static int selinux_backing_file_alloc(struct file *backing_file,
const struct file *user_file)
{
struct backing_file_security_struct *bfsec;
bfsec = selinux_backing_file(backing_file);
bfsec->uf_sid = selinux_file(user_file)->sid;
bfsec->uf_sid = selinux_file_user_sid(user_file);
return 0;
}

2
security/selinux/include/objsec.h
View File

@ -87,7 +87,7 @@ struct file_security_struct {
};
struct backing_file_security_struct {
u32 uf_sid; /* associated user file fsec->sid */
u32 uf_sid; /* top-level user file fsec->sid */
};
struct superblock_security_struct {