diff options
| author | Stephen Smalley <stephen.smalley.work@gmail.com> | 2025-06-10 22:48:27 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2025-07-10 17:05:04 +0300 |
| commit | acf9ab15ec978188b8ebc1f14b0c281d11d52ed9 (patch) | |
| tree | d59e8df6fb03fe6f65110e0f1449335544dab3e7 | |
| parent | 6d0b588614c43d6334b2d7a70a99f31f7b14ecc0 (diff) | |
| download | linux-acf9ab15ec978188b8ebc1f14b0c281d11d52ed9.tar.xz | |
selinux: change security_compute_sid to return the ssid or tsid on match
[ Upstream commit fde46f60f6c5138ee422087addbc5bf5b4968bf1 ]
If the end result of a security_compute_sid() computation matches the
ssid or tsid, return that SID rather than looking it up again. This
avoids the problem of multiple initial SIDs that map to the same
context.
Cc: stable@vger.kernel.org
Reported-by: Guido Trentalancia <guido@trentalancia.com>
Fixes: ae254858ce07 ("selinux: introduce an initial SID for early boot processes")
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Tested-by: Guido Trentalancia <guido@trentalancia.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | security/selinux/ss/services.c | 16 |
1 files changed, 11 insertions, 5 deletions
diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c index 88850405ded9..f36332e64c4d 100644 --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -1884,11 +1884,17 @@ retry: goto out_unlock; } /* Obtain the sid for the context. */ - rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid); - if (rc == -ESTALE) { - rcu_read_unlock(); - context_destroy(&newcontext); - goto retry; + if (context_cmp(scontext, &newcontext)) + *out_sid = ssid; + else if (context_cmp(tcontext, &newcontext)) + *out_sid = tsid; + else { + rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid); + if (rc == -ESTALE) { + rcu_read_unlock(); + context_destroy(&newcontext); + goto retry; + } } out_unlock: rcu_read_unlock(); |