bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-04-18 14:53:58 -04:00
Code Issues Packages Projects Releases Wiki Activity

selinux: fix overlayfs mmap() and mprotect() access checks

Browse Source 
The existing SELinux security model for overlayfs is to allow access if
the current task is able to access the top level file (the "user" file)
and the mounter's credentials are sufficient to access the lower
level file (the "backing" file).  Unfortunately, the current code does
not properly enforce these access controls for both mmap() and mprotect()
operations on overlayfs filesystems.

This patch makes use of the newly created security_mmap_backing_file()
LSM hook to provide the missing backing file enforcement for mmap()
operations, and leverages the backing file API and new LSM blob to
provide the necessary information to properly enforce the mprotect()
access controls.

Cc: stable@vger.kernel.org
Acked-by: Amir Goldstein <amir73il@gmail.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Paul Moore
2026-01-01 17:19:18 -05:00
parent 6af36aeb14
commit 82544d36b1
2 changed files with 196 additions and 71 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
security/selinux/include/objsec.h
View File

@@ -88,6 +88,10 @@ struct file_security_struct {
u32 pseqno; /* Policy seqno at the time of file open */
};
struct backing_file_security_struct {
u32 uf_sid; /* associated user file fsec->sid */
};
struct superblock_security_struct {
u32 sid; /* SID of file system superblock */
u32 def_sid; /* default SID for labeling */
@@ -195,6 +199,13 @@ static inline struct file_security_struct *selinux_file(const struct file *file)
return file->f_security + selinux_blob_sizes.lbs_file;
}
static inline struct backing_file_security_struct *
selinux_backing_file(const struct file *backing_file)
{
void *blob = backing_file_security(backing_file);
return blob + selinux_blob_sizes.lbs_backing_file;
}
static inline struct inode_security_struct *
selinux_inode(const struct inode *inode)
{