linux-stable/security/selinux
Richard Haines b531d4ead7 selinux: allow FIOCLEX and FIONCLEX with policy capability
[ Upstream commit 65881e1db4 ]

These ioctls are equivalent to fcntl(fd, F_SETFD, flags), which SELinux
always allows too.  Furthermore, a failed FIOCLEX could result in a file
descriptor being leaked to a process that should not have access to it.

As this patch removes access controls, a policy capability needs to be
enabled in policy to always allow these ioctls.

Based-on-patch-by: Demi Marie Obenour <demiobenour@gmail.com>
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
[PM: subject line tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-04-08 13:58:37 +02:00
..
include selinux: allow FIOCLEX and FIONCLEX with policy capability 2022-04-08 13:58:37 +02:00
ss selinux: fix double free of cond_list on error paths 2022-02-02 11:02:10 -05:00
.gitignore .gitignore: add SPDX License Identifier 2020-03-25 11:50:48 +01:00
avc.c selinux: fix all of the W=1 build warnings 2021-10-13 16:31:51 -04:00
hooks.c selinux: allow FIOCLEX and FIONCLEX with policy capability 2022-04-08 13:58:37 +02:00
ibpkey.c selinux: remove unused global variables 2021-01-12 09:49:01 -05:00
ima.c selinux: fix misuse of mutex_is_locked() 2022-02-22 18:02:58 -05:00
Kconfig Documentation,selinux: deprecate setting checkreqprot to 1 2020-02-10 10:49:01 -05:00
Makefile selinux: include a consumer of the new IMA critical data hook 2021-01-14 23:41:46 -05:00
netif.c selinux: remove unused global variables 2021-01-12 09:49:01 -05:00
netlabel.c security: pass asoc to sctp_assoc_request and sctp_sk_clone 2021-11-03 11:09:20 +00:00
netlink.c selinux: mark some global variables __ro_after_init 2021-01-12 10:08:55 -05:00
netnode.c selinux: remove unused global variables 2021-01-12 09:49:01 -05:00
netport.c selinux: fix all of the W=1 build warnings 2021-10-13 16:31:51 -04:00
nlmsgtab.c include/uapi/linux/xfrm.h: Fix XFRM_MSG_MAPPING ABI breakage 2021-09-14 10:31:35 +02:00
selinuxfs.c selinux: check return value of sel_make_avc_files 2022-04-08 13:57:32 +02:00
status.c selinux: move status variables out of selinux_ss 2020-02-10 10:49:01 -05:00
xfrm.c selinux: use correct type for context length 2022-04-08 13:58:37 +02:00