Commit ed868a56 authored by Eric Paris's avatar Eric Paris Committed by James Morris
Browse files

Creds: creds->security can be NULL is selinux is disabled 



__validate_process_creds should check if selinux is actually enabled before
running tests on the selinux portion of the credentials struct.

Signed-off-by: default avatarEric Paris <eparis@redhat.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 86d71014

include/linux/cred.h

+8 −5
Original line number Diff line number Diff line
@@ -15,6 +15,7 @@ 
#include <linux/capability.h>

#include <linux/init.h>

#include <linux/key.h>

#include <linux/selinux.h>

#include <asm/atomic.h>



struct user_struct;
@@ -182,11 +183,13 @@ static inline bool creds_are_invalid(const struct cred *cred) 
	if (atomic_read(&cred->usage) < atomic_read(&cred->subscribers))

		return true;

#ifdef CONFIG_SECURITY_SELINUX

	if (selinux_is_enabled()) {

		if ((unsigned long) cred->security < PAGE_SIZE)

			return true;

		if ((*(u32 *)cred->security & 0xffffff00) ==

		    (POISON_FREE << 24 | POISON_FREE << 16 | POISON_FREE << 8))

			return true;

	}

#endif

	return false;

}

include/linux/selinux.h

+9 −0
Original line number Diff line number Diff line
@@ -61,6 +61,11 @@ void selinux_secmark_refcount_inc(void); 
 *     existing SECMARK targets has been removed/flushed.

 */

void selinux_secmark_refcount_dec(void);



/**

 * selinux_is_enabled - is SELinux enabled?

 */

bool selinux_is_enabled(void);

#else



static inline int selinux_string_to_sid(const char *str, u32 *sid)
@@ -84,6 +89,10 @@ static inline void selinux_secmark_refcount_dec(void) 
	return;

}



static bool selinux_is_enabled(void)

{

	return false;

}

#endif	/* CONFIG_SECURITY_SELINUX */



#endif /* _LINUX_SELINUX_H */

security/selinux/exports.c

+6 −0
Original line number Diff line number Diff line
@@ -63,3 +63,9 @@ void selinux_secmark_refcount_dec(void) 
	atomic_dec(&selinux_secmark_refcount);

}

EXPORT_SYMBOL_GPL(selinux_secmark_refcount_dec);



bool selinux_is_enabled(void)

{

	return selinux_enabled;

}

EXPORT_SYMBOL_GPL(selinux_is_enabled);