From: NeilBrown <neilb@suse.de>
To: Al Viro <viro@ZenIV.linux.org.uk>
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 04/13] security/selinux: check for LOOKUP_RCU in _follow_link.
Date: Mon, 16 Mar 2015 15:43:19 +1100 [thread overview]
Message-ID: <20150316044319.23648.82820.stgit@notabene.brown> (raw)
In-Reply-To: <20150316043602.23648.52734.stgit@notabene.brown>
Some of dentry_has_perm() is not rcu-safe, so if LOOKUP_RCU
is set in selinux_inode_follow_link(), give up with
-ECHILD.
It is possible that dentry_has_perm could sometimes complete
in RCU more, in which case the flag could be propagated further
down the stack...
Signed-off-by: NeilBrown <neilb@suse.de>
---
security/selinux/hooks.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index e3074e01f058..5d4de8cbfaa6 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2866,6 +2866,8 @@ static int selinux_inode_follow_link(struct dentry *dentry, int flags)
{
const struct cred *cred = current_cred();
+ if (flags & LOOKUP_RCU)
+ return -ECHILD;
return dentry_has_perm(cred, dentry, FILE__READ);
}
next prev parent reply other threads:[~2015-03-16 4:43 UTC|newest]
Thread overview: 27+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-16 4:43 [PATCH 00/13] Support follow_link in RCU-walk. - V2 NeilBrown
2015-03-16 4:43 ` [PATCH 01/13] VFS: replace {, total_}link_count in task_struct with pointer to nameidata NeilBrown
2015-03-16 19:46 ` Al Viro
2015-03-16 4:43 ` NeilBrown [this message]
2015-03-16 21:00 ` [PATCH 04/13] security/selinux: check for LOOKUP_RCU in _follow_link Al Viro
2015-03-20 4:39 ` NeilBrown
2015-03-20 5:12 ` Al Viro
2015-03-16 4:43 ` [PATCH 03/13] VFS: remove nameidata args from ->follow_link and ->put_link NeilBrown
2015-03-16 20:47 ` Al Viro
2015-03-16 4:43 ` [PATCH 02/13] VFS: make all ->follow_link handlers aware for LOOKUP_RCU NeilBrown
2015-03-16 4:43 ` [PATCH 11/13] xfs: use RCU to free 'struct xfs_mount' NeilBrown
2015-03-16 4:43 ` [PATCH 13/13] NFS: support LOOKUP_RCU in nfs_follow_link NeilBrown
2015-03-16 4:43 ` [PATCH 09/13] VFS/namei: enable RCU-walk when following symlinks NeilBrown
2015-03-16 22:44 ` Al Viro
2015-03-16 4:43 ` [PATCH 08/13] VFS/namei: enhance follow_link to support RCU-walk NeilBrown
2015-03-16 4:43 ` [PATCH 07/13] VFS/namei: abort RCU-walk on symlink if atime needs updating NeilBrown
2015-03-16 4:43 ` [PATCH 06/13] VFS/namei: new flag to support RCU symlinks: LOOKUP_LINK_RCU NeilBrown
2015-03-16 22:33 ` Al Viro
2015-03-17 0:59 ` Al Viro
2015-03-16 4:43 ` [PATCH 12/13] XFS: allow follow_link to often succeed in RCU-walk NeilBrown
2015-03-16 22:37 ` Al Viro
2015-03-16 4:43 ` [PATCH 05/13] VFS/namei: use terminate_walk when symlink lookup fails NeilBrown
2015-03-16 4:43 ` [PATCH 10/13] VFS/namei: handle LOOKUP_RCU in page_follow_link_light NeilBrown
2015-03-16 22:50 ` Al Viro
2015-03-19 22:38 ` NeilBrown
2015-03-19 23:46 ` Al Viro
2015-03-16 19:14 ` [PATCH 00/13] Support follow_link in RCU-walk. - V2 Al Viro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20150316044319.23648.82820.stgit@notabene.brown \
--to=neilb@suse.de \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).