Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e2f3b785 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security 

Pull SELinux regression fixes from James Morris.

Andrew Morton has a box that hit that open perms problem.

I also renamed the "epollwakeup" selinux name for the new capability to
be "block_suspend", to match the rename done by commit d9914cf6
("PM: Rename CAP_EPOLLWAKEUP to CAP_BLOCK_SUSPEND").

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  SELinux: do not check open perms if they are not known to policy
  SELinux: include definition of new capabilities
parents 6f702428 3d2195c3

security/selinux/hooks.c

+1 −1
Original line number Diff line number Diff line
@@ -2717,7 +2717,7 @@ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr) 
			ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))

		return dentry_has_perm(cred, dentry, FILE__SETATTR);



	if (ia_valid & ATTR_SIZE)

	if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))

		av |= FILE__OPEN;



	return dentry_has_perm(cred, dentry, av);

security/selinux/include/classmap.h

+3 −1
Original line number Diff line number Diff line
@@ -145,7 +145,9 @@ struct security_class_mapping secclass_map[] = { 
	    "node_bind", "name_connect", NULL } },

	{ "memprotect", { "mmap_zero", NULL } },

	{ "peer", { "recv", NULL } },

	{ "capability2", { "mac_override", "mac_admin", "syslog", NULL } },

	{ "capability2",

	  { "mac_override", "mac_admin", "syslog", "wake_alarm", "block_suspend",

	    NULL } },

	{ "kernel_service", { "use_as_override", "create_files_as", NULL } },

	{ "tun_socket",

	  { COMMON_SOCK_PERMS, NULL } },