diff options
| author |   Stephen Smalley <sds@tycho.nsa.gov> | 2018-04-09 14:36:05 -0400 |
|---|---|---|
| committer |   Linus Torvalds <torvalds@linux-foundation.org> | 2018-04-09 11:52:56 -0700 |
| commit | fd40ffc72e2f74c7db61e400903e7d50a88bc0b0 (patch) | |
| tree | b9c6028f1a132ec509c805eb63d8f16afc776e82 /security | |
| parent | Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm (diff) | |
| download | linux-dev-fd40ffc72e2f74c7db61e400903e7d50a88bc0b0.tar.xz linux-dev-fd40ffc72e2f74c7db61e400903e7d50a88bc0b0.zip | |
selinux: fix missing dput() before selinuxfs unmount
Commit 0619f0f5e36f ("selinux: wrap selinuxfs state") triggers a BUG
when SELinux is runtime-disabled (i.e. systemd or equivalent disables
SELinux before initial policy load via /sys/fs/selinux/disable based on
/etc/selinux/config SELINUX=disabled).
This does not manifest if SELinux is disabled via kernel command line
argument or if SELinux is enabled (permissive or enforcing).
Before:
SELinux: Disabled at runtime.
BUG: Dentry 000000006d77e5c7{i=17,n=null} still in use (1) [unmount of selinuxfs selinuxfs]
After:
SELinux: Disabled at runtime.
Fixes: 0619f0f5e36f ("selinux: wrap selinuxfs state")
Reported-by: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'security')
| -rw-r--r-- | security/selinux/selinuxfs.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index 4be683eeba01..245160373dab 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -2061,6 +2061,7 @@ __initcall(init_sel_fs); void exit_sel_fs(void) { sysfs_remove_mount_point(fs_kobj, "selinux"); + dput(selinux_null.dentry); kern_unmount(selinuxfs_mount); unregister_filesystem(&sel_fs_type); } |