Re: [PATCH] selinux: always fill AVC decision in avc_has_perm_noaudit()

[Paul Moore <paul@paul-moore.com>]

On Sep  3, 2026 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> avc_has_perm_noaudit() is documented to return a copy of the access
> decision in @avd, but its early return for an empty requested permission
> set leaves the buffer untouched.  All callers pass an uninitialized
> stack variable and afterwards feed it to avc_audit(), and the inode hook
> even stores it in the per-task decision cache.
> 
> Fill in a deny-all, audit-all decision, similar to avd_init(), so every
> caller receives a defined value at no cost on the hot path.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> Fixes: e6f2f381e4015386 ("selinux: replace BUG_ONs with WARN_ONs in avc.c")
> Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
>  security/selinux/avc.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)

Good catch, thanks Christian.  I'm going to mark this for stable and
merge it via selinux/stable-7.3, if anyone would rather see this go via
the traditional selinux/dev branch please speak up in the next few days.

--
paul-moore.com