Commit 483613d2 authored by Thiébaud Weksteen's avatar Thiébaud Weksteen Committed by Gu Bowen
Browse files

selinux: ignore unknown extended permissions 

mainline inclusion
from mainline-v6.13-rc4
commit 900f83cf376bdaf798b6f5dcb2eae0c822e908b6
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBEUBD

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=900f83cf376bdaf798b6f5dcb2eae0c822e908b6



--------------------------------

When evaluating extended permissions, ignore unknown permissions instead
of calling BUG(). This commit ensures that future permissions can be
added without interfering with older kernels.

Cc: stable@vger.kernel.org
Fixes: fa1aa143 ("selinux: extended permissions for ioctls")
Signed-off-by: default avatarThiébaud Weksteen <tweek@google.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
Conflicts:
	security/selinux/ss/services.c
[Due to commit d1d991efaf346 ("selinux: Add netlink xperm support") add a
new policy and refactored the function, there are context conflicts
happened.]
Signed-off-by: default avatarGu Bowen <gubowen5@huawei.com>
parent 21eb7b92

security/selinux/ss/services.c

+6 −2
Original line number Diff line number Diff line
@@ -965,7 +965,10 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, 
					xpermd->driver))

			return;

	} else {

		BUG();

		pr_warn_once(

			"SELinux: unknown extended permission (%u) will be ignored\n",

			node->datum.u.xperms->specified);

		return;

	}



	if (node->key.specified == AVTAB_XPERMS_ALLOWED) {
@@ -1002,7 +1005,8 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, 
					node->datum.u.xperms->perms.p[i];

		}

	} else {

		BUG();

		pr_warn_once("SELinux: unknown specified key (%u)\n",

				node->key.specified);

	}

}