Skip to contentSkip to conversation

selinux: ignore unknown extended permissions

PATCH Superseded Thiébaud Weksteen 2 participants 2 messages Dec 3, 2024 – Dec 4, 2024

Subsystems (2)
Stable branch SELinux security module

v1 of 2 Superseded Latest is v2 →

lore
Share & tools
lore

Thiébaud Weksteen

author
#0 lore raw

PATCH 1/1 selinux: ignore unknown extended permissions

When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels.

Fixes fa1aa143ac4a ("selinux: extended permissions for ioctls")
Cc [email protected]
Signed-off-by Thiébaud Weksteen <[email protected]>
---
 security/selinux/ss/services.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
security/selinux/ss/services.c +2 -1
index 971c45d576ba..2fa8aebcb2e5 100644
@@ -979,7 +979,8 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd,
 			return;
 		break;
 	default:
-		BUG();
+		// An unknown extended permission has been found. Ignore it.
+		return;
 	}
 
 	if (node->key.specified == AVTAB_XPERMS_ALLOWED) {
Signature · 1 line
2.47.0.338.g60cca15819-goog
maintainer
#1 lore raw
Quoted 17 lines · Thiébaud Weksteen

When evaluating extended permissions, ignore unknown permissions instead of calling BUG(). This commit ensures that future permissions can be added without interfering with older kernels.

Fixes fa1aa143ac4a ("selinux: extended permissions for ioctls")
Cc [email protected]
Signed-off-by Thiébaud Weksteen <[email protected]>
---
 security/selinux/ss/services.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
security/selinux/ss/services.c +0 -0
index 971c45d576ba..2fa8aebcb2e5 100644

security/selinux/ss/services.c void services_compute_xperms_decision(struct extended_perms_decision *xpermd, · line 983

Quoted 6 lines
security/selinux/ss/services.c +2 -1
@@ -979,7 +979,8 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd,
                        return;
                break;
        default:
-               BUG();
+               // An unknown extended permission has been found. Ignore it.
+               return;

There is also a BUG() call lower in the function when it generates the extended data, do you want to update/remove that as well?

It also seems like we should have a pr_warn_once() or pr_warn_ratelimited() message here to alert the admin of a mismatch between the policy and the kernel.

Quoted 4 lines
security/selinux/ss/services.c +0 -1
        }
 
        if (node->key.specified == AVTAB_XPERMS_ALLOWED) {
--
Signature · 1 line
paul-moore.com