diff options
| author | Richard Haines <richard_c_haines@btinternet.com> | 2022-02-25 17:54:38 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2022-04-08 14:40:31 +0200 |
| commit | 448857f58009fd950f4d732e8f1e4fcf859cb4b1 (patch) | |
| tree | 167cb7566974183e1f4d455160e36aceb9969f8b /security/selinux/include/security.h | |
| parent | 4b9b60b5bfc86b9ee7f02c822de4f13116e118c3 (diff) | |
selinux: allow FIOCLEX and FIONCLEX with policy capability
[ Upstream commit 65881e1db4e948614d9eb195b8e1197339822949 ]
These ioctls are equivalent to fcntl(fd, F_SETFD, flags), which SELinux
always allows too. Furthermore, a failed FIOCLEX could result in a file
descriptor being leaked to a process that should not have access to it.
As this patch removes access controls, a policy capability needs to be
enabled in policy to always allow these ioctls.
Based-on-patch-by: Demi Marie Obenour <demiobenour@gmail.com>
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
[PM: subject line tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'security/selinux/include/security.h')
| -rw-r--r-- | security/selinux/include/security.h | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h index 63ca6e79daeb..1521460a97d4 100644 --- a/security/selinux/include/security.h +++ b/security/selinux/include/security.h @@ -219,6 +219,13 @@ static inline bool selinux_policycap_genfs_seclabel_symlinks(void) return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS]); } +static inline bool selinux_policycap_ioctl_skip_cloexec(void) +{ + struct selinux_state *state = &selinux_state; + + return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC]); +} + struct selinux_policy_convert_data; struct selinux_load_state { |