[PATCH] selinux: always fill AVC decision in avc_has_perm_noaudit()

[PATCH] selinux: always fill AVC decision in avc_has_perm_noaudit()

[Christian Göttsche]

From: Christian Göttsche <cgzones@googlemail.com>

avc_has_perm_noaudit() is documented to return a copy of the access
decision in @avd, but its early return for an empty requested permission
set leaves the buffer untouched.  All callers pass an uninitialized
stack variable and afterwards feed it to avc_audit(), and the inode hook
even stores it in the per-task decision cache.

Fill in a deny-all, audit-all decision, similar to avd_init(), so every
caller receives a defined value at no cost on the hot path.

Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
---
 security/selinux/avc.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index a9401d6c2e5f..560a82c6d682 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -1149,8 +1149,11 @@ inline int avc_has_perm_noaudit(u32 ssid, u32 tsid,
 	u32 denied;
 	struct avc_node *node;
 
-	if (WARN_ON(!requested))
+	if (WARN_ON(!requested)) {
+		/* Provide a deny-all, audit-all decision to the caller. */
+		*avd = (struct av_decision){ .auditdeny = 0xffffffff };
 		return -EACCES;
+	}
 
 	rcu_read_lock();
 	node = avc_lookup(ssid, tsid, tclass);
-- 
2.55.0

Re: [PATCH] selinux: always fill AVC decision in avc_has_perm_noaudit()

[sashiko-bot]

> From: Christian Göttsche <cgzones@googlemail.com>
> 
> avc_has_perm_noaudit() is documented to return a copy of the access
> decision in @avd, but its early return for an empty requested permission
> set leaves the buffer untouched.  All callers pass an uninitialized
> stack variable and afterwards feed it to avc_audit(), and the inode hook
> even stores it in the per-task decision cache.
> 
> Fill in a deny-all, audit-all decision, similar to avd_init(), so every
> caller receives a defined value at no cost on the hot path.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260903114338.77055-1-cgoettsche@seltendoof.de?part=1

Re: [PATCH] selinux: always fill AVC decision in avc_has_perm_noaudit()

[Stephen Smalley]

On Thu, Sep 3, 2026 at 7:43 AM Christian Göttsche
<cgoettsche@seltendoof.de> wrote:
>
> From: Christian Göttsche <cgzones@googlemail.com>
>
> avc_has_perm_noaudit() is documented to return a copy of the access
> decision in @avd, but its early return for an empty requested permission
> set leaves the buffer untouched.  All callers pass an uninitialized
> stack variable and afterwards feed it to avc_audit(), and the inode hook
> even stores it in the per-task decision cache.
>
> Fill in a deny-all, audit-all decision, similar to avd_init(), so every
> caller receives a defined value at no cost on the hot path.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Fixes: e6f2f381e4015386 ("selinux: replace BUG_ONs with WARN_ONs in avc.c")
Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Re: [PATCH] selinux: always fill AVC decision in avc_has_perm_noaudit()

[Paul Moore]

On Sep  3, 2026 =?UTF-8?q?Christian=20G=C3=B6ttsche?= <cgoettsche@seltendoof.de> wrote:
> 
> avc_has_perm_noaudit() is documented to return a copy of the access
> decision in @avd, but its early return for an empty requested permission
> set leaves the buffer untouched.  All callers pass an uninitialized
> stack variable and afterwards feed it to avc_audit(), and the inode hook
> even stores it in the per-task decision cache.
> 
> Fill in a deny-all, audit-all decision, similar to avd_init(), so every
> caller receives a defined value at no cost on the hot path.
> 
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> Fixes: e6f2f381e4015386 ("selinux: replace BUG_ONs with WARN_ONs in avc.c")
> Reviewed-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
>  security/selinux/avc.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)

Good catch, thanks Christian.  I'm going to mark this for stable and
merge it via selinux/stable-7.3, if anyone would rather see this go via
the traditional selinux/dev branch please speak up in the next few days.

--
paul-moore.com