diff options
| author |   Stephen Smalley <stephen.smalley.work@gmail.com> | 2025-06-10 15:48:27 -0400 |
|---|---|---|
| committer |   Paul Moore <paul@paul-moore.com> | 2025-06-19 16:13:16 -0400 |
| commit | fde46f60f6c5138ee422087addbc5bf5b4968bf1 (patch) | |
| tree | ca3e5acb47fecdb305f92160e18a4857a5814645 | |
| parent | selinux: fix selinux_xfrm_alloc_user() to set correct ctx_len (diff) | |
| download | wireguard-linux-fde46f60f6c5138ee422087addbc5bf5b4968bf1.tar.xz wireguard-linux-fde46f60f6c5138ee422087addbc5bf5b4968bf1.zip | |
selinux: change security_compute_sid to return the ssid or tsid on match
If the end result of a security_compute_sid() computation matches the
ssid or tsid, return that SID rather than looking it up again. This
avoids the problem of multiple initial SIDs that map to the same
context.
Cc: stable@vger.kernel.org
Reported-by: Guido Trentalancia <guido@trentalancia.com>
Fixes: ae254858ce07 ("selinux: introduce an initial SID for early boot processes")
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Tested-by: Guido Trentalancia <guido@trentalancia.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
| -rw-r--r-- | security/selinux/ss/services.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 7becf3808818..d185754c2786 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -1909,11 +1909,17 @@ retry: goto out_unlock; } /* Obtain the sid for the context. */ - rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid); - if (rc == -ESTALE) { - rcu_read_unlock(); - context_destroy(&newcontext); - goto retry; + if (context_equal(scontext, &newcontext)) + *out_sid = ssid; + else if (context_equal(tcontext, &newcontext)) + *out_sid = tsid; + else { + rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid); + if (rc == -ESTALE) { + rcu_read_unlock(); + context_destroy(&newcontext); + goto retry; + } } out_unlock: rcu_read_unlock(); |