kevin/linux
1
Fork 0
Code

lsm/stable-6.12 PR 20240923

Browse Source 
-----BEGIN PGP SIGNATURE-----
 
 iQJIBAABCAAyFiEES0KozwfymdVUl37v6iDy2pc3iXMFAmbxyVEUHHBhdWxAcGF1
 bC1tb29yZS5jb20ACgkQ6iDy2pc3iXObWA//dDTn1UMEE2zBE5oF46Yw6FDIipEc
 TL7ulL6fXHKZnAGOfkNREKydkLddZVH+mG7AyJQL6A/06s3/tl3J6i8yLdYZ67iD
 6khZzXvwTA41oLKNB/gVCF3xUUIcifnEqoCIRA9AFg7ck+W/gjtXbHD1xaWYjpqX
 rAorbAu3YA1Rv+sOe2NWZ0EDUPUzfzBPJEZT27TSwCVoWED9r9BxMvQgdhijf0XZ
 a0T8wk1RfAvP4+Cf8XPLUkrgu/x9OauLAdx/a48TeODxQ6KjcFUTUtujRsBduzq/
 cnJEeXAJwD7YqbuoNmidwTul/RGZS3nsWhEr2i8JBVdWYSDACpahO1Ls3WtJuQt3
 oCEQGwrXyPlL4LlcSmRjxL+PLc+MIihjWetIOqgujxKQe82rG+fJlu42zBxbmqnI
 BglJ3Ps+kcHPdUh216NAiKwJXw00IsUsldCZpAe+ck7Tz3H1OhMtjKNa0H7nqYtn
 dMV3ieIKj+PVLJTjSeoLSQ3lxx8JFdH7owV7zO++NLsX05dQx8LTUeqSzL6skUk2
 ocn0ekBmH4GRSph2nUBsr5W575Zx2VKdGS8nS9d/TxXOzuwflOZpX81kAzwCX+Ru
 VN9wVlM8qgFwoeK8SlaOD94Jsy7nAeaBu0/H3fYdB5TX1MnNTIOqTtZgxpotr2Gw
 Z295YFAklGMv7zo=
 =KDfa
 -----END PGP SIGNATURE-----

Merge tag 'lsm-pr-20240923' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

Pull LSM fixes from Paul Moore:

 - Add a missing security_mmap_file() check to the remap_file_pages()
   syscall

 - Properly reference the SELinux and Smack LSM blobs in the
   security_watch_key() LSM hook

 - Fix a random IPE selftest crash caused by a missing list terminator
   in the test

* tag 'lsm-pr-20240923' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
  ipe: Add missing terminator to list of unit tests
  selinux,smack: properly reference the LSM blob in security_watch_key()
  mm: call the security_mmap_file() LSM hook in remap_file_pages()
This commit is contained in:
Linus Torvalds 2024-09-24 10:18:15 -07:00
commit 5c36498d06
4 changed files with 9 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
mm/mmap.c
View File

@ -1689,8 +1689,12 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
flags |= MAP_LOCKED; flags |= MAP_LOCKED;
file = get_file(vma->vm_file); file = get_file(vma->vm_file);
ret = security_mmap_file(vma->vm_file, prot, flags);
if (ret)
goto out_fput;
ret = do_mmap(vma->vm_file, start, size, ret = do_mmap(vma->vm_file, start, size,
prot, flags, 0, pgoff, &populate, NULL); prot, flags, 0, pgoff, &populate, NULL);
out_fput:
fput(file); fput(file);
out: out:
mmap_write_unlock(mm); mmap_write_unlock(mm);

1
security/ipe/policy_tests.c
View File

@ -286,6 +286,7 @@ static void ipe_parser_widestring_test(struct kunit *test)
static struct kunit_case ipe_parser_test_cases[] = { static struct kunit_case ipe_parser_test_cases[] = {
KUNIT_CASE_PARAM(ipe_parser_unsigned_test, ipe_policies_gen_params), KUNIT_CASE_PARAM(ipe_parser_unsigned_test, ipe_policies_gen_params),
KUNIT_CASE(ipe_parser_widestring_test), KUNIT_CASE(ipe_parser_widestring_test),
{ }
}; };
static struct kunit_suite ipe_parser_test_suite = { static struct kunit_suite ipe_parser_test_suite = {

2
security/selinux/hooks.c
View File

@ -6735,7 +6735,7 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer)
#ifdef CONFIG_KEY_NOTIFICATIONS #ifdef CONFIG_KEY_NOTIFICATIONS
static int selinux_watch_key(struct key *key) static int selinux_watch_key(struct key *key)
{ {
struct key_security_struct *ksec = key->security; struct key_security_struct *ksec = selinux_key(key);
u32 sid = current_sid(); u32 sid = current_sid();
return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL); return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);

13
security/smack/smack_lsm.c
View File

@ -4629,16 +4629,9 @@ static int smack_watch_key(struct key *key)
{ {
struct smk_audit_info ad; struct smk_audit_info ad;
struct smack_known *tkp = smk_of_current(); struct smack_known *tkp = smk_of_current();
struct smack_known **blob = smack_key(key);
int rc; int rc;
if (key == NULL)
return -EINVAL;
/*
* If the key hasn't been initialized give it access so that
* it may do so.
*/
if (key->security == NULL)
return 0;
/* /*
* This should not occur * This should not occur
*/ */
@ -4653,8 +4646,8 @@ static int smack_watch_key(struct key *key)
ad.a.u.key_struct.key = key->serial; ad.a.u.key_struct.key = key->serial;
ad.a.u.key_struct.key_desc = key->description; ad.a.u.key_struct.key_desc = key->description;
#endif #endif
rc = smk_access(tkp, key->security, MAY_READ, &ad); rc = smk_access(tkp, *blob, MAY_READ, &ad);
rc = smk_bu_note("key watch", tkp, key->security, MAY_READ, rc); rc = smk_bu_note("key watch", tkp, *blob, MAY_READ, rc);
return rc; return rc;
} }
#endif /* CONFIG_KEY_NOTIFICATIONS */ #endif /* CONFIG_KEY_NOTIFICATIONS */