linux-toradex.git/security/selinux/avc.c, branch v6.11

selinux: add the processing of the failure of avc_add_xperms_decision()

2024-08-07T19:14:36+00:00

When avc_add_xperms_decision() fails, the information recorded by the new
avc node is incomplete. In this case, the new avc node should be released
instead of replacing the old avc node.

Cc: stable@vger.kernel.org
Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls")
Suggested-by: Stephen Smalley 
Signed-off-by: Zhen Lei 
Acked-by: Stephen Smalley 
Signed-off-by: Paul Moore

selinux: fix potential counting error in avc_add_xperms_decision()

2024-08-06T21:52:27+00:00

The count increases only when a node is successfully added to
the linked list.

Cc: stable@vger.kernel.org
Fixes: fa1aa143ac4a ("selinux: extended permissions for ioctls")
Signed-off-by: Zhen Lei 
Acked-by: Stephen Smalley 
Signed-off-by: Paul Moore

selinux: update my email address

2023-07-19T15:27:02+00:00

Update my email address; MAINTAINERS was updated some time ago.

Signed-off-by: Stephen Smalley 
Signed-off-by: Paul Moore

selinux: avoid implicit conversions in the AVC code

2023-07-18T22:29:48+00:00

Use a consistent type of u32 for sequence numbers.

Use a non-negative and input parameter matching type for the hash
result.

Signed-off-by: Christian Göttsche 
[PM: subject line tweaks]
Signed-off-by: Paul Moore

selinux: drop return at end of void function avc_insert()

2023-05-08T20:47:32+00:00

Commit 539813e4184a ("selinux: stop returning node from avc_insert()")
converted the return value of avc_insert() to void but left the now
unnecessary trailing return statement.

Signed-off-by: Christian Göttsche 
Signed-off-by: Paul Moore

selinux: avc: drop unused function avc_disable()

2023-05-08T20:45:36+00:00

Since commit f22f9aaf6c3d ("selinux: remove the runtime disable
functionality") the function avc_disable() is no longer used.

Signed-off-by: Christian Göttsche 
Signed-off-by: Paul Moore

selinux: stop returning node from avc_insert()

2023-04-04T16:05:42+00:00

The callers haven't used the returned node since
commit 21193dcd1f3570dd ("SELinux: more careful use of avd in
avc_has_perm_noaudit") and the return value assignments were removed in
commit 0a9876f36b08706d ("selinux: Remove redundant assignments"). Stop
returning the node altogether and make the functions return void.

Signed-off-by: Stephen Smalley 
PM: minor subj tweak, repair whitespace damage
Signed-off-by: Paul Moore

selinux: stop passing selinux_state pointers and their offspring

2023-03-14T19:22:45+00:00

Linus observed that the pervasive passing of selinux_state pointers
introduced by me in commit aa8e712cee93 ("selinux: wrap global selinux
state") adds overhead and complexity without providing any
benefit. The original idea was to pave the way for SELinux namespaces
but those have not yet been implemented and there isn't currently
a concrete plan to do so. Remove the passing of the selinux_state
pointers, reverting to direct use of the single global selinux_state,
and likewise remove passing of child pointers like the selinux_avc.
The selinux_policy pointer remains as it is needed for atomic switching
of policies.

Suggested-by: Linus Torvalds 
Reported-by: kernel test robot 
Link: https://lore.kernel.org/oe-kbuild-all/202303101057.mZ3Gv5fK-lkp@intel.com/
Signed-off-by: Stephen Smalley 
Signed-off-by: Paul Moore

selinux: uninline unlikely parts of avc_has_perm_noaudit()

2023-03-08T16:48:27+00:00

This is based on earlier patch posted to the list by Linus, his
commit description read:

 "avc_has_perm_noaudit()is one of those hot functions that end up
  being used by almost all filesystem operations (through
  "avc_has_perm()") and it's intended to be cheap enough to inline.

  However, it turns out that the unlikely parts of it (where it
  doesn't find an existing avc node) need a fair amount of stack
  space for the automatic replacement node, so if it were to be
  inlined (at least clang does not) it would just use stack space
  unnecessarily.

  So split the unlikely part out of it, and mark that part noinline.
  That improves the actual likely part."

The basic idea behind the patch was reasonable, but there were minor
nits (double indenting, etc.) and the RCU read lock unlock/re-lock in
avc_compute_av() began to look even more ugly.  This patch builds on
Linus' first effort by cleaning things up a bit and removing the RCU
unlock/lock dance in avc_compute_av().

Removing the RCU lock dance in avc_compute_av() is safe as there are
currently two callers of avc_compute_av(): avc_has_perm_noaudit() and
avc_has_extended_perms().  The first caller in avc_has_perm_noaudit()
does not require a RCU lock as there is no avc_node to protect so the
RCU lock can be dropped before calling avc_compute_av().  The second
caller, avc_has_extended_perms(), is similar in that there is no
avc_node that requires RCU protection, but the code is simplified by
holding the RCU look around the avc_compute_av() call, and given that
we enter a RCU critical section in security_compute_av() (called from
av_compute_av()) the impact will likely be unnoticeable.  It is also
worth noting that avc_has_extended_perms() is only called from the
SELinux ioctl() access control hook at the moment.

Acked-by: Linus Torvalds 
Signed-off-by: Paul Moore

selinux: declare data arrays const

2022-05-03T19:53:49+00:00

The arrays for the policy capability names, the initial sid identifiers
and the class and permission names are not changed at runtime.  Declare
them const to avoid accidental modification.

Do not override the classmap and the initial sid list in the build time
script genheaders.

Check flose(3) is successful in genheaders.c, otherwise the written data
might be corrupted or incomplete.

Signed-off-by: Christian Göttsche 
[PM: manual merge due to fuzz, minor style tweaks]
Signed-off-by: Paul Moore