Commit 65881e1d authored by Richard Haines's avatar Richard Haines Committed by Paul Moore
Browse files

selinux: allow FIOCLEX and FIONCLEX with policy capability 



These ioctls are equivalent to fcntl(fd, F_SETFD, flags), which SELinux
always allows too.  Furthermore, a failed FIOCLEX could result in a file
descriptor being leaked to a process that should not have access to it.

As this patch removes access controls, a policy capability needs to be
enabled in policy to always allow these ioctls.

Based-on-patch-by: default avatarDemi Marie Obenour <demiobenour@gmail.com>
Signed-off-by: default avatarRichard Haines <richard_c_haines@btinternet.com>
[PM: subject line tweak]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent b97df7c0

security/selinux/hooks.c

+6 −0
Original line number Diff line number Diff line
@@ -3682,6 +3682,12 @@ static int selinux_file_ioctl(struct file *file, unsigned int cmd, 
					    CAP_OPT_NONE, true);

		break;



	case FIOCLEX:

	case FIONCLEX:

		if (!selinux_policycap_ioctl_skip_cloexec())

			error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);

		break;



	/* default case assumes that the command will go

	 * to the file's ioctl() function.

	 */

security/selinux/include/policycap.h

+1 −0
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ enum { 
	POLICYDB_CAPABILITY_CGROUPSECLABEL,

	POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION,

	POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS,

	POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC,

	__POLICYDB_CAPABILITY_MAX

};

#define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)

security/selinux/include/policycap_names.h

+2 −1
Original line number Diff line number Diff line
@@ -12,7 +12,8 @@ const char *selinux_policycap_names[__POLICYDB_CAPABILITY_MAX] = { 
	"always_check_network",

	"cgroup_seclabel",

	"nnp_nosuid_transition",

	"genfs_seclabel_symlinks"

	"genfs_seclabel_symlinks",

	"ioctl_skip_cloexec"

};



#endif /* _SELINUX_POLICYCAP_NAMES_H_ */

security/selinux/include/security.h

+7 −0
Original line number Diff line number Diff line
@@ -219,6 +219,13 @@ static inline bool selinux_policycap_genfs_seclabel_symlinks(void) 
	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS]);

}



static inline bool selinux_policycap_ioctl_skip_cloexec(void)

{

	struct selinux_state *state = &selinux_state;



	return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_IOCTL_SKIP_CLOEXEC]);

}



struct selinux_policy_convert_data;



struct selinux_load_state {