Re: [PATCH v2 3/5] selinux: prevent stale AVC insertions after policy changes

[sashiko-bot@kernel.org]

> From: Christian Göttsche <cgzones@googlemail.com>
> 
> A cache miss can compute a decision under the old policy and pass the
> latest_notif check in avc_insert(), then be delayed until after a policy
> change has flushed the AVC and updated latest_notif.  Inserting the old
> decision at that point allows subsequent cache hits to keep using the
> old permissions, including permissions revoked by the new policy.
> 
> Keep security_compute_av() and avc_insert() in one RCU read-side
> critical section.  Both selinux_policy_commit() and security_set_bools()
> publish the new policy and wait for an RCU grace period before flushing
> the AVC.  This ensures that insertions based on the old policy finish
> before the flush.  The sequence-number check alone cannot provide that
> guarantee, even when it takes the notification lock.
> 
> The insertion path uses nonblocking allocations and already runs under
> RCU when called from avc_has_extended_perms(), where the new read-side
> critical section simply nests within the existing one.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109153802.76176-5-cgoettsche@seltendoof.de?part=3