Skip to content

Commit

Permalink
SELinux: pass last path component in may_create
Browse files Browse the repository at this point in the history
New inodes are created in a two stage process.  We first will compute the
label on a new inode in security_inode_create() and check if the
operation is allowed.  We will then actually re-compute that same label and
apply it in security_inode_init_security().  The change to do new label
calculations based in part on the last component of the path name only
passed the path component information all the way down the
security_inode_init_security hook.  Down the security_inode_create hook the
path information did not make it past may_create.  Thus the two calculations
came up differently and the permissions check might not actually be against
the label that is created.  Pass and use the same information in both places
to harmonize the calculations and checks.

Reported-by: Dominick Grift <[email protected]>
Signed-off-by: Eric Paris <[email protected]>
eparis committed Apr 28, 2011

Verified

This commit was created on GitHub.com and signed with GitHub’s verified signature. The key has expired.
1 parent 2463c26 commit 562abf6
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion security/selinux/hooks.c
Original file line number Diff line number Diff line change
@@ -1579,7 +1579,8 @@ static int may_create(struct inode *dir,
return rc;

if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
rc = security_transition_sid(sid, dsec->sid, tclass, NULL, &newsid);
rc = security_transition_sid(sid, dsec->sid, tclass,
&dentry->d_name, &newsid);
if (rc)
return rc;
}

0 comments on commit 562abf6

Please sign in to comment.