kevin/linux
1
Fork 0
Code

scsi: target: Fix SELinux error when systemd-modules loads the target module

Browse Source 
If the systemd-modules service loads the target module, the credentials of
that userspace process will be used to validate the access to the target db
directory.  SELinux will prevent it, reporting an error like the following:

kernel: audit: type=1400 audit(1676301082.205:4): avc: denied  { read }
for  pid=1020 comm="systemd-modules" name="target" dev="dm-3"
ino=4657583 scontext=system_u:system_r:systemd_modules_load_t:s0
tcontext=system_u:object_r:targetd_etc_rw_t:s0 tclass=dir permissive=0

Fix the error by using the kernel credentials to access the db directory

Signed-off-by: Maurizio Lombardi <mlombard@redhat.com>
Link: https://lore.kernel.org/r/20240215143944.847184-2-mlombard@redhat.com
Reviewed-by: Mike Christie <michael.christie@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
This commit is contained in:
Maurizio Lombardi 2024-02-15 15:39:43 +01:00 committed by Martin K. Petersen
parent d4e655c49f
commit 97a54ef596
1 changed files with 12 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/target/target_core_configfs.c
View File

@ -3672,6 +3672,8 @@ static int __init target_core_init_configfs(void)
{ {
struct configfs_subsystem *subsys = &target_core_fabrics; struct configfs_subsystem *subsys = &target_core_fabrics;
struct t10_alua_lu_gp *lu_gp; struct t10_alua_lu_gp *lu_gp;
struct cred *kern_cred;
const struct cred *old_cred;
int ret; int ret;
pr_debug("TARGET_CORE[0]: Loading Generic Kernel Storage" pr_debug("TARGET_CORE[0]: Loading Generic Kernel Storage"
@ -3748,11 +3750,21 @@ static int __init target_core_init_configfs(void)
if (ret < 0) if (ret < 0)
goto out; goto out;
/* We use the kernel credentials to access the target directory */
kern_cred = prepare_kernel_cred(&init_task);
if (!kern_cred) {
ret = -ENOMEM;
goto out;
}
old_cred = override_creds(kern_cred);
target_init_dbroot(); target_init_dbroot();
revert_creds(old_cred);
put_cred(kern_cred);
return 0; return 0;
out: out:
target_xcopy_release_pt();
configfs_unregister_subsystem(subsys); configfs_unregister_subsystem(subsys);
core_dev_release_virtual_lun0(); core_dev_release_virtual_lun0();
rd_module_exit(); rd_module_exit();