diff options
| author |   Richard Haines <richard_c_haines@btinternet.com> | 2022-02-25 17:54:38 +0000 |
|---|---|---|
| committer |   Paul Moore <paul@paul-moore.com> | 2022-02-25 15:35:19 -0500 |
| commit | 65881e1db4e948614d9eb195b8e1197339822949 (patch) | |
| tree | 5412d30772bda69f399724371c13d53cfa4c1d96 /security/selinux/hooks.c | |
| parent | selinux: use correct type for context length (diff) | |
| download | linux-dev-65881e1db4e948614d9eb195b8e1197339822949.tar.xz linux-dev-65881e1db4e948614d9eb195b8e1197339822949.zip | |
selinux: allow FIOCLEX and FIONCLEX with policy capability
These ioctls are equivalent to fcntl(fd, F_SETFD, flags), which SELinux
always allows too. Furthermore, a failed FIOCLEX could result in a file
descriptor being leaked to a process that should not have access to it.
As this patch removes access controls, a policy capability needs to be
enabled in policy to always allow these ioctls.
Based-on-patch-by: Demi Marie Obenour <demiobenour@gmail.com>
Signed-off-by: Richard Haines <richard_c_haines@btinternet.com>
[PM: subject line tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'security/selinux/hooks.c')
| -rw-r--r-- | security/selinux/hooks.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 1e69f88eb326..b12e14b2797b 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3682,6 +3682,12 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd, CAP_OPT_NONE, true); break; + case FIOCLEX: + case FIONCLEX: + if (!selinux_policycap_ioctl_skip_cloexec()) + error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd); + break; + /* default case assumes that the command will go * to the file's ioctl() function. */ |