[PATCH] selinux: check MAP_SHARED_VALIDATE mappings as shared

[PATCH] selinux: check MAP_SHARED_VALIDATE mappings as shared

[Stephen Smalley]

selinux_mmap_file() only recognizes MAP_SHARED as a shared mapping,
but MAP_SHARED_VALIDATE is also a shared mapping type. The mmap flags
reach this hook before the mm code processes the mapping type.

Consequently, a writable MAP_SHARED_VALIDATE mapping was failing to
check the file write permission at mmap time, and a writable
executable file mapping was wrongly checking process execmem
permission as if it were private.

Link: https://github.com/SELinuxProject/selinux-kernel/issues/78
Fixes: 1c9725974074 ("mm: introduce MAP_SHARED_VALIDATE, a mechanism to safely define new mmap flags")
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
---
 security/selinux/hooks.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 6168dd5f91c2..ce92632e7db6 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4180,8 +4180,11 @@ static int selinux_mmap_file(struct file *file,
 			     unsigned long reqprot __always_unused,
 			     unsigned long prot, unsigned long flags)
 {
+	const unsigned long map_type = (flags & MAP_TYPE);
+
 	return selinux_mmap_file_common(file, prot,
-					(flags & MAP_TYPE) == MAP_SHARED,
+					(map_type == MAP_SHARED ||
+					 map_type == MAP_SHARED_VALIDATE),
 					false);
 }
 
-- 
2.56.0

Re: [PATCH] selinux: check MAP_SHARED_VALIDATE mappings as shared

[sashiko-bot]

> selinux_mmap_file() only recognizes MAP_SHARED as a shared mapping,
> but MAP_SHARED_VALIDATE is also a shared mapping type. The mmap flags
> reach this hook before the mm code processes the mapping type.
> 
> Consequently, a writable MAP_SHARED_VALIDATE mapping was failing to
> check the file write permission at mmap time, and a writable
> executable file mapping was wrongly checking process execmem
> permission as if it were private.
> 
> Link: https://github.com/SELinuxProject/selinux-kernel/issues/78
> Fixes: 1c9725974074 ("mm: introduce MAP_SHARED_VALIDATE, a mechanism to safely define new mmap flags")
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106182913.15233-1-stephen.smalley.work@gmail.com?part=1

Re: [PATCH] selinux: check MAP_SHARED_VALIDATE mappings as shared

[Paul Moore]

On Nov  6, 2026 sashiko-bot@kernel.org wrote:
> 
> selinux_mmap_file() only recognizes MAP_SHARED as a shared mapping,
> but MAP_SHARED_VALIDATE is also a shared mapping type. The mmap flags
> reach this hook before the mm code processes the mapping type.
> 
> Consequently, a writable MAP_SHARED_VALIDATE mapping was failing to
> check the file write permission at mmap time, and a writable
> executable file mapping was wrongly checking process execmem
> permission as if it were private.
> 
> Link: https://github.com/SELinuxProject/selinux-kernel/issues/78
> Fixes: 1c9725974074 ("mm: introduce MAP_SHARED_VALIDATE, a mechanism to safely define new mmap flags")
> Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
> ---
>  security/selinux/hooks.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)

Looks good, thanks Stephen.  Merging into selinux/stable-7.4.

--
paul-moore.com