aboutsummaryrefslogtreecommitdiffstats
path: root/security/selinux/hooks.c
diff options
context:
space:
mode:
authorStephen Smalley <sds@tycho.nsa.gov>2018-12-12 10:10:56 -0500
committerPaul Moore <paul@paul-moore.com>2019-01-10 20:34:37 -0500
commite46e01eebbbcf2ff6d28ee7cae9f117e9d1572c8 (patch)
tree21fb06603d0a98d0146053922e1a93ba5ded5817 /security/selinux/hooks.c
parentselinux: avoid silent denials in permissive mode under RCU walk (diff)
downloadlinux-dev-e46e01eebbbcf2ff6d28ee7cae9f117e9d1572c8.tar.xz
linux-dev-e46e01eebbbcf2ff6d28ee7cae9f117e9d1572c8.zip
selinux: stop passing MAY_NOT_BLOCK to the AVC upon follow_link
commit bda0be7ad9948 ("security: make inode_follow_link RCU-walk aware") switched selinux_inode_follow_link() to use avc_has_perm_flags() and pass down the MAY_NOT_BLOCK flag if called during RCU walk. However, the only test of MAY_NOT_BLOCK occurs during slow_avc_audit() and only if passing an inode as audit data (LSM_AUDIT_DATA_INODE). Since selinux_inode_follow_link() passes a dentry directly, passing MAY_NOT_BLOCK here serves no purpose. Switch selinux_inode_follow_link() to use avc_has_perm() and drop avc_has_perm_flags() since there are no other users. Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to '')
-rw-r--r--security/selinux/hooks.c5
1 files changed, 2 insertions, 3 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 7f6068489a02..f08a0f201967 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2925,9 +2925,8 @@ static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
if (IS_ERR(isec))
return PTR_ERR(isec);
- return avc_has_perm_flags(&selinux_state,
- sid, isec->sid, isec->sclass, FILE__READ, &ad,
- rcu ? MAY_NOT_BLOCK : 0);
+ return avc_has_perm(&selinux_state,
+ sid, isec->sid, isec->sclass, FILE__READ, &ad);
}
static noinline int audit_inode_permission(struct inode *inode,