Commit e2f3b785 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull SELinux regression fixes from James Morris.

Andrew Morton has a box that hit that open perms problem.

I also renamed the "epollwakeup" selinux name for the new capability to
be "block_suspend", to match the rename done by commit d9914cf6
("PM: Rename CAP_EPOLLWAKEUP to CAP_BLOCK_SUSPEND").

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  SELinux: do not check open perms if they are not known to policy
  SELinux: include definition of new capabilities
parents 6f702428 3d2195c3
...@@ -2717,7 +2717,7 @@ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr) ...@@ -2717,7 +2717,7 @@ static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET)) ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
return dentry_has_perm(cred, dentry, FILE__SETATTR); return dentry_has_perm(cred, dentry, FILE__SETATTR);
if (ia_valid & ATTR_SIZE) if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
av |= FILE__OPEN; av |= FILE__OPEN;
return dentry_has_perm(cred, dentry, av); return dentry_has_perm(cred, dentry, av);
......
...@@ -145,7 +145,9 @@ struct security_class_mapping secclass_map[] = { ...@@ -145,7 +145,9 @@ struct security_class_mapping secclass_map[] = {
"node_bind", "name_connect", NULL } }, "node_bind", "name_connect", NULL } },
{ "memprotect", { "mmap_zero", NULL } }, { "memprotect", { "mmap_zero", NULL } },
{ "peer", { "recv", NULL } }, { "peer", { "recv", NULL } },
{ "capability2", { "mac_override", "mac_admin", "syslog", NULL } }, { "capability2",
{ "mac_override", "mac_admin", "syslog", "wake_alarm", "block_suspend",
NULL } },
{ "kernel_service", { "use_as_override", "create_files_as", NULL } }, { "kernel_service", { "use_as_override", "create_files_as", NULL } },
{ "tun_socket", { "tun_socket",
{ COMMON_SOCK_PERMS, NULL } }, { COMMON_SOCK_PERMS, NULL } },
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment