From: Carlos Llamas <cmllamas@google.com>
To: Stephen Smalley <stephen.smalley.work@gmail.com>
Cc: selinux@vger.kernel.org, paul@paul-moore.com,
omosnacek@gmail.com, jeffv@google.com, tweek@google.com
Subject: Re: [PATCH] tests/binder: fix binder tests to work with the Rust binder driver
Date: Tue, 10 Nov 2026 19:15:30 +0000 [thread overview]
Message-ID: <avNtUlzhXQprWQBA@google.com> (raw)
In-Reply-To: <20261110153110.29256-1-stephen.smalley.work@gmail.com>
On Tue, Nov 10, 2026 at 10:31:10AM -0500, Stephen Smalley wrote:
> With the original Android binder driver it was possible for a process
> to invoke binder transactions on a binder fd opened by another
> process. Hence, SELinux originally implemented an impersonate
> permission check to control such usage. This however was never used in
> practice by the Android userspace and never allowed in Android SELinux
> policy.
>
> The Rust reimplementation of the binder driver intentionally prevents
> such impersonation from ever happening, failing such operations with
> EINVAL. Update the SELinux binder tests accordingly to drop the
> testing of this now-obsolete SELinux permission and to not rely on its
> availability for the other tests. It doesn't seem worthwhile to retain
> the test for the older driver since it was never allowed in Android
> even when it was possible.
>
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
FWIW, this looks correct to me. Thanks!
Reviewed-by: Carlos Llamas <cmllamas@google.com>
prev parent reply other threads:[~2026-11-10 19:15 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-10 15:31 [PATCH] tests/binder: fix binder tests to work with the Rust binder driver Stephen Smalley
2026-11-10 19:15 ` Carlos Llamas [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=avNtUlzhXQprWQBA@google.com \
--to=cmllamas@google.com \
--cc=jeffv@google.com \
--cc=omosnacek@gmail.com \
--cc=paul@paul-moore.com \
--cc=selinux@vger.kernel.org \
--cc=stephen.smalley.work@gmail.com \
--cc=tweek@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.