mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-22 17:01:14 +00:00
kernfs: initialize security of newly created nodes
Use the new security_kernfs_init_security() hook to allow LSMs to possibly assign a non-default security context to a newly created kernfs node based on the attributes of the new node and also its parent node. This fixes an issue with cgroupfs under SELinux, where newly created cgroup subdirectories/files would not inherit its parent's context if it had been set explicitly to a non-default value (other than the genfs context specified by the policy). This can be reproduced as follows (on Fedora/RHEL): # mkdir /sys/fs/cgroup/unified/test # # Need permissive to change the label under Fedora policy: # setenforce 0 # chcon -t container_file_t /sys/fs/cgroup/unified/test # ls -lZ /sys/fs/cgroup/unified total 0 -r--r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Jan 29 03:06 cgroup.controllers -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Jan 29 03:06 cgroup.max.depth -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Jan 29 03:06 cgroup.max.descendants -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Jan 29 03:06 cgroup.procs -r--r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Jan 29 03:06 cgroup.stat -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Jan 29 03:06 cgroup.subtree_control -rw-r--r--. 1 root root system_u:object_r:cgroup_t:s0 0 Jan 29 03:06 cgroup.threads drwxr-xr-x. 2 root root system_u:object_r:cgroup_t:s0 0 Jan 29 03:06 init.scope drwxr-xr-x. 26 root root system_u:object_r:cgroup_t:s0 0 Jan 29 03:21 system.slice drwxr-xr-x. 3 root root system_u:object_r:container_file_t:s0 0 Jan 29 03:15 test drwxr-xr-x. 3 root root system_u:object_r:cgroup_t:s0 0 Jan 29 03:06 user.slice # mkdir /sys/fs/cgroup/unified/test/subdir Actual result: # ls -ldZ /sys/fs/cgroup/unified/test/subdir drwxr-xr-x. 2 root root system_u:object_r:cgroup_t:s0 0 Jan 29 03:15 /sys/fs/cgroup/unified/test/subdir Expected result: # ls -ldZ /sys/fs/cgroup/unified/test/subdir drwxr-xr-x. 2 root root unconfined_u:object_r:container_file_t:s0 0 Jan 29 03:15 /sys/fs/cgroup/unified/test/subdir Link: https://github.com/SELinuxProject/selinux-kernel/issues/39 Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Acked-by: Casey Schaufler <casey@schaufler-ca.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
parent
ec882da5cd
commit
e19dfdc83b
1 changed files with 9 additions and 2 deletions
|
@ -615,6 +615,7 @@ struct kernfs_node *kernfs_node_from_dentry(struct dentry *dentry)
|
||||||
}
|
}
|
||||||
|
|
||||||
static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
|
static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
|
||||||
|
struct kernfs_node *parent,
|
||||||
const char *name, umode_t mode,
|
const char *name, umode_t mode,
|
||||||
kuid_t uid, kgid_t gid,
|
kuid_t uid, kgid_t gid,
|
||||||
unsigned flags)
|
unsigned flags)
|
||||||
|
@ -671,6 +672,12 @@ static struct kernfs_node *__kernfs_new_node(struct kernfs_root *root,
|
||||||
goto err_out3;
|
goto err_out3;
|
||||||
}
|
}
|
||||||
|
|
||||||
|
if (parent) {
|
||||||
|
ret = security_kernfs_init_security(parent, kn);
|
||||||
|
if (ret)
|
||||||
|
goto err_out3;
|
||||||
|
}
|
||||||
|
|
||||||
return kn;
|
return kn;
|
||||||
|
|
||||||
err_out3:
|
err_out3:
|
||||||
|
@ -689,7 +696,7 @@ struct kernfs_node *kernfs_new_node(struct kernfs_node *parent,
|
||||||
{
|
{
|
||||||
struct kernfs_node *kn;
|
struct kernfs_node *kn;
|
||||||
|
|
||||||
kn = __kernfs_new_node(kernfs_root(parent),
|
kn = __kernfs_new_node(kernfs_root(parent), parent,
|
||||||
name, mode, uid, gid, flags);
|
name, mode, uid, gid, flags);
|
||||||
if (kn) {
|
if (kn) {
|
||||||
kernfs_get(parent);
|
kernfs_get(parent);
|
||||||
|
@ -958,7 +965,7 @@ struct kernfs_root *kernfs_create_root(struct kernfs_syscall_ops *scops,
|
||||||
INIT_LIST_HEAD(&root->supers);
|
INIT_LIST_HEAD(&root->supers);
|
||||||
root->next_generation = 1;
|
root->next_generation = 1;
|
||||||
|
|
||||||
kn = __kernfs_new_node(root, "", S_IFDIR | S_IRUGO | S_IXUGO,
|
kn = __kernfs_new_node(root, NULL, "", S_IFDIR | S_IRUGO | S_IXUGO,
|
||||||
GLOBAL_ROOT_UID, GLOBAL_ROOT_GID,
|
GLOBAL_ROOT_UID, GLOBAL_ROOT_GID,
|
||||||
KERNFS_DIR);
|
KERNFS_DIR);
|
||||||
if (!kn) {
|
if (!kn) {
|
||||||
|
|
Loading…
Reference in a new issue