linux-stable.git/security, branch v4.9.337

device_cgroup: Roll back to original exceptions after copy failure

2023-01-07T11:07:37+00:00

commit e68bfbd3b3c3a0ec3cf8c230996ad8cabe90322f upstream.

When add the 'a *:* rwm' entry to devcgroup A's whitelist, at first A's
exceptions will be cleaned and A's behavior is changed to
DEVCG_DEFAULT_ALLOW. Then parent's exceptions will be copyed to A's
whitelist. If copy failure occurs, just return leaving A to grant
permissions to all devices. And A may grant more permissions than
parent.

Backup A's whitelist and recover original exceptions after copy
failure.

Cc: stable@vger.kernel.org
Fixes: 4cef7299b478 ("device_cgroup: add proper checking when changing default behavior")
Signed-off-by: Wang Weiyang 
Reviewed-by: Aristeu Rozanski 
Signed-off-by: Paul Moore 
Signed-off-by: Greg Kroah-Hartman

ima: Fix misuse of dereference of pointer in template_desc_init_fields()

2023-01-07T11:07:16+00:00

[ Upstream commit 25369175ce84813dd99d6604e710dc2491f68523 ]

The input parameter @fields is type of struct ima_template_field ***, so
when allocates array memory for @fields, the size of element should be
sizeof(**field) instead of sizeof(*field).

Actually the original code would not cause any runtime error, but it's
better to make it logically right.

Fixes: adf53a778a0a ("ima: new templates management mechanism")
Signed-off-by: Xiu Jianfeng 
Reviewed-by: Roberto Sassu 
Signed-off-by: Mimi Zohar 
Signed-off-by: Sasha Levin

selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling

2022-08-25T09:09:22+00:00

commit 200ea5a2292dc444a818b096ae6a32ba3caa51b9 upstream.

A previous fix, commit 83370b31a915 ("selinux: fix error initialization
in inode_doinit_with_dentry()"), changed how failures were handled
before a SELinux policy was loaded.  Unfortunately that patch was
potentially problematic for two reasons: it set the isec->initialized
state without holding a lock, and it didn't set the inode's SELinux
label to the "default" for the particular filesystem.  The later can
be a problem if/when a later attempt to revalidate the inode fails
and SELinux reverts to the existing inode label.

This patch should restore the default inode labeling that existed
before the original fix, without affecting the LABEL_INVALID marking
such that revalidation will still be attempted in the future.

Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()")
Reported-by: Sven Schnelle 
Tested-by: Sven Schnelle 
Reviewed-by: Ondrej Mosnacek 
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

selinux: fix error initialization in inode_doinit_with_dentry()

2022-08-25T09:09:21+00:00

commit 83370b31a915493231e5b9addc72e4bef69f8d31 upstream.

Mark the inode security label as invalid if we cannot find
a dentry so that we will retry later rather than marking it
initialized with the unlabeled SID.

Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock")
Signed-off-by: Tianyue Ren 
[PM: minor comment tweaks]
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

selinux: Convert isec->lock into a spinlock

2022-08-25T09:09:21+00:00

commit 9287aed2ad1ff1bde5eb190bcd6dccd5f1cf47d3 upstream.

Convert isec->lock from a mutex into a spinlock.  Instead of holding
the lock while sleeping in inode_doinit_with_dentry, set
isec->initialized to LABEL_PENDING and release the lock.  Then, when
the sid has been determined, re-acquire the lock.  If isec->initialized
is still set to LABEL_PENDING, set isec->sid; otherwise, the sid has
been set by another task (LABEL_INITIALIZED) or invalidated
(LABEL_INVALID) in the meantime.

This fixes a deadlock on gfs2 where

 * one task is in inode_doinit_with_dentry -> gfs2_getxattr, holds
   isec->lock, and tries to acquire the inode's glock, and

 * another task is in do_xmote -> inode_go_inval ->
   selinux_inode_invalidate_secctx, holds the inode's glock, and
   tries to acquire isec->lock.

Signed-off-by: Andreas Gruenbacher 
[PM: minor tweaks to keep checkpatch.pl happy]
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

selinux: Clean up initialization of isec->sclass

2022-08-25T09:09:21+00:00

commit 13457d073c29da92001f6ee809075eaa8757fb96 upstream.

Now that isec->initialized == LABEL_INITIALIZED implies that
isec->sclass is valid, skip such inodes immediately in
inode_doinit_with_dentry.

For the remaining inodes, initialize isec->sclass at the beginning of
inode_doinit_with_dentry to simplify the code.

Signed-off-by: Andreas Gruenbacher 
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

proc: Pass file mode to proc_pid_make_inode

2022-08-25T09:09:21+00:00

commit db978da8fa1d0819b210c137d31a339149b88875 upstream.

Pass the file mode of the proc inode to be created to
proc_pid_make_inode.  In proc_pid_make_inode, initialize inode->i_mode
before calling security_task_to_inode.  This allows selinux to set
isec->sclass right away without introducing "half-initialized" inode
security structs.

Signed-off-by: Andreas Gruenbacher 
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

selinux: Minor cleanups

2022-08-25T09:09:21+00:00

commit 420591128cb206201dc444c2d42fb6f299b2ecd0 upstream.

Fix the comment for function __inode_security_revalidate, which returns
an integer.

Use the LABEL_* constants consistently for isec->initialized.

Signed-off-by: Andreas Gruenbacher 
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

security,selinux,smack: kill security_task_wait hook

2022-07-29T15:05:44+00:00

commit 3a2f5a59a695a73e0cde9a61e0feae5fa730e936 upstream.

As reported by yangshukui, a permission denial from security_task_wait()
can lead to a soft lockup in zap_pid_ns_processes() since it only expects
sys_wait4() to return 0 or -ECHILD. Further, security_task_wait() can
in general lead to zombies; in the absence of some way to automatically
reparent a child process upon a denial, the hook is not useful.  Remove
the security hook and its implementations in SELinux and Smack.  Smack
already removed its check from its hook.

Reported-by: yangshukui 
Signed-off-by: Stephen Smalley 
Acked-by: Casey Schaufler 
Acked-by: Oleg Nesterov 
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

Fix incorrect type in assignment of ipv6 port for audit

2022-04-20T07:06:38+00:00

[ Upstream commit a5cd1ab7ab679d252a6d2f483eee7d45ebf2040c ]

Remove inappropriate use of ntohs() and assign the
port value directly.

Reported-by: kernel test robot 
Signed-off-by: Casey Schaufler 
Signed-off-by: Sasha Levin