Re: [PATCH v2 5/5] selinux: do not cache permissive grants after enabling enforcing mode

[sashiko-bot@kernel.org]

> From: Christian Göttsche <cgzones@googlemail.com>
> 
> In permissive mode avc_denied() allows a denied access and records the
> grant in the AVC node via avc_update_node(AVC_CALLBACK_GRANT).  Enabling
> enforcing mode relies on the subsequent avc_ss_reset() to flush such
> grants.  The enforcing check and the node update are not atomic though:
> 
>   CPU A (permissive check)     CPU B (setenforce 1)  CPU C (same access)
>   avc_denied()
>     enforcing_enabled() false
>                                enforcing_set(1)
>                                avc_flush()
>                                                      cache miss,
>                                                      avc_insert()
>     avc_update_node(GRANT)
> [ ... ]
> before is removed by the flush.  The current access is still allowed,
> as it was checked before the switch; only the grant is not cached.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109153802.76176-5-cgoettsche@seltendoof.de?part=5