selinux: ignore unknown extended permissions
Subsystems (2)
PATCH v2 1/1 selinux: ignore unknown extended permissions
When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels.
---
v2: Add pr_warn_once, remove other BUG() call for key.specified
security/selinux/ss/services.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
security/selinux/ss/services.c +6 -2
@@ -979,7 +979,10 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd,return ;break ;default : -BUG (); +pr_warn_once ( +"SELinux: unknown extended permission (%u) will be ignored\n" , + node->datum.u.xperms->specified); +return ; }if (node->key.specified ==AVTAB_XPERMS_ALLOWED ) {
@@ -998,7 +1001,8 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, &node->datum.u.xperms->perms, xpermd->dontaudit); }else { -BUG (); +pr_warn_once ("SELinux: unknown specified key (%u)\n" , + node->key.specified); } }
Signature · 1 line
2.47.0.338.g60cca15819-goog
A message that is not in the archive (sent off-list or not yet received): [email protected]
Quoted 11 lines · Christian Göttsche
Dec 5, 2024 02:09:39 Thiébaud Weksteen <[email protected]>:
Quoted 7 lines
When evaluating extended permissions, ignore unknown permissions instead of calling
BUG(). This commit ensures that future permissions can be added without interfering with older kernels.Fixes fa1aa143ac4a ("selinux: extended permissions for ioctls")Signed-off-by Thiébaud Weksteen <[email protected]>
Quoted 9 lines
security/selinux/ss/services.c void services_compute_xperms_decision(struct extended_perms_decision *xpermd, · line 986
Quoted 6 lines
security/selinux/ss/services.c +4
-1-BUG (); +pr_warn_once ( +"SELinux: unknown extended permission (%u) will be ignored\n" , + node->datum.u.xperms->specified); +return ; }What about instead of logging once per boot at access decision time logging once per policyload at parse time, like suggested for patch https://patchwork.kernel.org/project/selinux/patch/[email protected]/ ?
I agree, warning when the policy is loaded makes more sense. For this particular bug, I am trying to keep the patch to a bare minimum as I intend to backport it to stable kernels (on Android, this is preventing us from deploying a policy compatible with both older and newer kernels). Maybe we could land the first version of this patch (without any warning message), with the understanding that your patch will land soon after?
Quoted 5 lines · On Dec 4, 2024 "=?UTF-8?q?Thi=C3=A9baud=20Weksteen?=" <[email protected]> wrote:
When evaluating extended permissions, ignore unknown permissions instead of calling
BUG(). This commit ensures that future permissions can be added without interfering with older kernels.
Quoted 8 lines
Fixes fa1aa143ac4a ("selinux: extended permissions for ioctls")Signed-off-by Thiébaud Weksteen <[email protected]>---
v2: Addpr_warn_once, remove otherBUG()call for key.specifiedsecurity/selinux/ss/services.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-)
Merged into selinux/stable-6.13, thanks!
--
paul-moore.com