github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 01:32:21 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selinux/stable-7.2 PR 20260717

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmpaXtgUHHBhdWxAcGF1
 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXPAGxAAyCWrUecMqUOJTSYbTl5hjRqR6w9U
 +h1hfFaiukGgEokG9qrFBR7MTgei0ybcyt2d/Mn8r2Mz1C0kK4tBjtT8ho1tqVZD
 5ANfti4ffhw6H83ZHRf5h18vwNXldHjBsEwjthySRYwlK2KsV4tW/+WFCStdWzCH
 TOpUShUlkIMvibNbKf6vvqk75jP/SCZLpjsRBD+gdRSkXqcFLLqXrK+FiAw4NKXE
 z7nRc0KK161eT4GM+KPBYkC9hE6+PntamYL10nDgrz1r3hp/B2Wx66bO36NR7XvA
 5omsa/hJW7aXoQtXTxlf2+AuhYKjig+KYdxhidU8jKVXc16fUn4UmeUZJRvoDQKW
 ryjPALVnbBIrw/e+nDYV0wsJD6q8xAE3LuIQIMir661ZMtf7umdmm6G1anyhKYHe
 oLgjKyOiaGaY9WeW+g+bO29pmcpnmPPyiNI2KRkLsfgeCB2JKECDLyjZboCNjWGV
 ykdmt3kXndlaEwpmxvJBFCb4WlB2mKpCz6HxgNhM2jPu5X4MwS6fkrvIlBNHcdTg
 o2Sz5cuQLcnpD9A91AhKmKdxNYNeT7H4KlMm8x/8vRHNQbmi72WE7kkuEj09augt
 qeO8kbeq7dm13wY72MzNOQXwiNtmeCUDPwehud86Hqg0iZDDyB2RGWtn14AWQhGb
 Kmpyx9QglgeUEyc=
 =4P+L
 -----END PGP SIGNATURE-----

Merge tag 'selinux-pr-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux

Pull selinux fix from Paul Moore:
 "A single SELinux patch to correct a problem with the overlayfs mmap()
  and mprotect() fixes from earlier this year where we inadvertenly
  included an additional SELinux execmem permission check on some
  operations"

* tag 'selinux-pr-20260717' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  selinux: fix incorrect execmem checks on overlayfs
This commit is contained in:
Linus Torvalds 2026-07-17 11:04:46 -07:00
commit 8fc574321e
1 changed files with 24 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

42
security/selinux/hooks.c
View File

@ -3969,9 +3969,9 @@ static int selinux_file_ioctl_compat(struct file *file, unsigned int cmd,
static int default_noexec __ro_after_init;
static int __file_map_prot_check(const struct cred *cred,
const struct file *file, unsigned long prot,
bool shared, bool bf_user_file)
static int __file_map_prot_check(const struct file *file, unsigned long prot,
bool shared, bool mounter_check,
bool bf_user_file)
{
struct inode *inode = NULL;
bool prot_exec = prot & PROT_EXEC;
@ -3984,10 +3984,10 @@ static int __file_map_prot_check(const struct cred *cred,
inode = file_inode(file);
}
if (default_noexec && prot_exec &&
if (!mounter_check && default_noexec && prot_exec &&
(!file || IS_PRIVATE(inode) || (!shared && prot_write))) {
int rc;
u32 sid = cred_sid(cred);
u32 sid = current_sid();
/*
* We are making executable an anonymous mapping or a private
@ -4000,6 +4000,8 @@ static int __file_map_prot_check(const struct cred *cred,
}
if (file) {
const struct cred *cred = mounter_check ?
file->f_cred : current_cred();
/* "read" always possible, "write" only if shared */
u32 av = FILE__READ;
if (shared && prot_write)
@ -4013,11 +4015,11 @@ static int __file_map_prot_check(const struct cred *cred,
return 0;
}
static inline int file_map_prot_check(const struct cred *cred,
const struct file *file,
unsigned long prot, bool shared)
static inline int file_map_prot_check(const struct file *file,
unsigned long prot, bool shared,
bool mounter_check)
{
return __file_map_prot_check(cred, file, prot, shared, false);
return __file_map_prot_check(file, prot, shared, mounter_check, false);
}
static int selinux_mmap_addr(unsigned long addr)
@ -4033,12 +4035,14 @@ static int selinux_mmap_addr(unsigned long addr)
return rc;
}
static int selinux_mmap_file_common(const struct cred *cred, struct file *file,
unsigned long prot, bool shared)
static int selinux_mmap_file_common(struct file *file, unsigned long prot,
bool shared, bool mounter_check)
{
if (file) {
int rc;
struct common_audit_data ad;
const struct cred *cred = mounter_check ?
file->f_cred : current_cred();
ad.type = LSM_AUDIT_DATA_FILE;
ad.u.file = file;
@ -4047,15 +4051,16 @@ static int selinux_mmap_file_common(const struct cred *cred, struct file *file,
return rc;
}
return file_map_prot_check(cred, file, prot, shared);
return file_map_prot_check(file, prot, shared, mounter_check);
}
static int selinux_mmap_file(struct file *file,
unsigned long reqprot __always_unused,
unsigned long prot, unsigned long flags)
{
return selinux_mmap_file_common(current_cred(), file, prot,
(flags & MAP_TYPE) == MAP_SHARED);
return selinux_mmap_file_common(file, prot,
(flags & MAP_TYPE) == MAP_SHARED,
false);
}
/**
@ -4087,8 +4092,9 @@ static int selinux_mmap_backing_file(struct vm_area_struct *vma,
if (vma->vm_flags & VM_EXEC)
prot |= PROT_EXEC;
return selinux_mmap_file_common(backing_file->f_cred, backing_file,
prot, vma->vm_flags & VM_SHARED);
return selinux_mmap_file_common(backing_file, prot,
vma->vm_flags & VM_SHARED,
true);
}
static int selinux_file_mprotect(struct vm_area_struct *vma,
@ -4149,11 +4155,11 @@ static int selinux_file_mprotect(struct vm_area_struct *vma,
}
}
rc = __file_map_prot_check(cred, file, prot, shared, backing_file);
rc = __file_map_prot_check(file, prot, shared, false, backing_file);
if (rc)
return rc;
if (backing_file) {
rc = file_map_prot_check(file->f_cred, file, prot, shared);
rc = file_map_prot_check(file, prot, shared, true);
if (rc)
return rc;
}