github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-11 20:13:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

selinux/stable-7.3 PR 20260903

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCgAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmqZ2MkUHHBhdWxAcGF1
 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXPIuw/+OzHPcHAwO9q+ZX6jysmxZqSR+X7w
 NmvTTMGgKA+J2bhmRxuLTApzfx8w0IOq5ZXrPSysszophVpwvtH+UqHr2wuC9pcb
 0LO2vfJ4hr44+EKcajbjbwRf1zNpwjCYnIw2g6W5QdNFvnJVKoRLcYdUZzp2dVMl
 Q5hLeI2irijCOqxeIC4APOyXXUHhg418czvapq4M8MZtOcEICgkbdLYs/fglmo6M
 8i90j+HShcbOIH6hO0VDAAnRyYS8JkRFhzXIzSKKf3dtQbUlAwl97laUT2C5jcwr
 zQmRfnsasGGUQj19hW73Ksn6MuHhMb7XKafbL+De3jD2yHpHEvgrbjUllRBaDjp1
 J7V1q8B+FolD/T/Dceghs58lQk736KZvGvLEfoYiVde8BuhE0kqJWupf+KqECj18
 Zv8iVuyBC9PkGQPeVTV3V0VPZBvgZCrWhaiVAXRYOY/KqxqXGIcjgeuPU+7VNYl8
 lzvZDULYOJeiMSvkStFKy6RDtUtpxaMV4Pv3ZyRFX8p8QviyC/4WXy8DKlGkDCEn
 3TBX+PgCC8mGjRegM6GQXp74h3qZ0nAzrcThqaGTQlKqD6SUFwQawes5aRR4GT8j
 idiRGm6zYoCvFmZ2YFkZ1/LNHkouLLClCOJ4hXcpl19mka/qtASneKJOxPI8cA7Z
 ZrZQkVNNJipKu1s=
 =/GJM
 -----END PGP SIGNATURE-----

Merge tag 'selinux-pr-20260903' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux

Pull SELinux fixes from Paul Moore:
 "Two SELinux fixes: one to fix how we lookup a BPF token's creator
  label to prevent a possible TOCTOU, and one to update Ondrej's email
  address"

* tag 'selinux-pr-20260903' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:
  MAINTAINERS, mailmap: update email address for Ondrej Mosnáček
  selinux: fix BPF token permission checks
This commit is contained in:
Linus Torvalds 2026-09-03 13:36:21 -07:00
commit a500db7819
3 changed files with 12 additions and 27 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
.mailmap
View File

@ -699,6 +699,7 @@ Oliver Hartkopp <socketcan@hartkopp.net> <oliver.hartkopp@volkswagen.de>
Oliver Hartkopp <socketcan@hartkopp.net> <oliver@hartkopp.net>
Oliver Upton <oupton@kernel.org> <oupton@google.com>
Oliver Upton <oupton@kernel.org> <oliver.upton@linux.dev>
Ondrej Mosnáček <omosnacek@gmail.com> <omosnace@redhat.com>
Ondřej Jirman <megi@xff.cz> <megous@megous.com>
Oza Pawandeep <quic_poza@quicinc.com> <poza@codeaurora.org>
Pali Rohár <pali@kernel.org> <pali.rohar@gmail.com>

2
MAINTAINERS
View File

@ -24772,7 +24772,7 @@ K: \bsecurity_[a-z_0-9]\+\b
SELINUX SECURITY MODULE
M: Paul Moore <paul@paul-moore.com>
M: Stephen Smalley <stephen.smalley.work@gmail.com>
R: Ondrej Mosnacek <omosnace@redhat.com>
R: Ondrej Mosnáček <omosnacek@gmail.com>
L: selinux@vger.kernel.org
S: Supported
W: https://github.com/SELinuxProject

36
security/selinux/hooks.c
View File

@ -7267,24 +7267,6 @@ static int selinux_bpf_prog(struct bpf_prog *prog)
BPF__PROG_RUN, NULL);
}
static u32 selinux_bpffs_creator_sid(u32 fd)
{
struct path path;
struct super_block *sb;
struct superblock_security_struct *sbsec;
CLASS(fd, f)(fd);
if (fd_empty(f))
return SECSID_NULL;
path = fd_file(f)->f_path;
sb = path.dentry->d_sb;
sbsec = selinux_superblock(sb);
return sbsec->creator_sid;
}
static int selinux_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
struct bpf_token *token, bool kernel)
{
@ -7297,7 +7279,7 @@ static int selinux_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
if (!token)
ssid = bpfsec->sid;
else
ssid = selinux_bpffs_creator_sid(attr->map_token_fd);
ssid = selinux_bpf_token_security(token)->grantor_sid;
return avc_has_perm(ssid, bpfsec->sid, SECCLASS_BPF, BPF__MAP_CREATE,
NULL);
@ -7315,7 +7297,7 @@ static int selinux_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
if (!token)
ssid = bpfsec->sid;
else
ssid = selinux_bpffs_creator_sid(attr->prog_token_fd);
ssid = selinux_bpf_token_security(token)->grantor_sid;
return avc_has_perm(ssid, bpfsec->sid, SECCLASS_BPF, BPF__PROG_LOAD,
NULL);
@ -7329,12 +7311,14 @@ static int selinux_bpf_token_create(struct bpf_token *token,
const struct path *path)
{
struct bpf_security_struct *bpfsec;
u32 sid = selinux_bpffs_creator_sid(attr->token_create.bpffs_fd);
struct superblock_security_struct *sbsec;
int err;
sbsec = selinux_superblock(path->dentry->d_sb);
bpfsec = selinux_bpf_token_security(token);
bpfsec->sid = current_sid();
bpfsec->grantor_sid = sid;
bpfsec->grantor_sid = sbsec->creator_sid;
bpfsec->perms = 0;
/**
@ -7343,15 +7327,15 @@ static int selinux_bpf_token_create(struct bpf_token *token,
* in the allowed_cmds bitmap.
*/
if (bpf_token_cmd(token, BPF_MAP_CREATE)) {
err = avc_has_perm(bpfsec->sid, sid, SECCLASS_BPF,
BPF__MAP_CREATE_AS, NULL);
err = avc_has_perm(bpfsec->sid, bpfsec->grantor_sid,
SECCLASS_BPF, BPF__MAP_CREATE_AS, NULL);
if (err)
return err;
bpfsec->perms |= BPF__MAP_CREATE;
}
if (bpf_token_cmd(token, BPF_PROG_LOAD)) {
err = avc_has_perm(bpfsec->sid, sid, SECCLASS_BPF,
BPF__PROG_LOAD_AS, NULL);
err = avc_has_perm(bpfsec->sid, bpfsec->grantor_sid,
SECCLASS_BPF, BPF__PROG_LOAD_AS, NULL);
if (err)
return err;
bpfsec->perms |= BPF__PROG_LOAD;