From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E419D47F51; Mon, 22 Apr 2024 23:54:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713830072; cv=none; b=h9A1QudGRAQG5IBwHbOU4ZBEyXsI1gzlq4Bj2eEeGaNAke4r+/iKLGH+rPx7LF4FqE7RmSTOfdPRcIVTu+/+AvMRrEJ50ruOYp+qWteyy5Bavsr0/Zty5F49vdMWvAp2bk9WGfzLDzJiHSA+ONS2v3MRZSPeKnqZRdhUFNNmlDQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1713830072; c=relaxed/simple; bh=KlMbEl0NNUiSxTwSRNqwjjsGlwj+BgTY5HNovbG8Vo0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=D0zMZ2nRBv52PTb+ysb6Ak98fuyXcemAEmiFfipYZHcNLvNsnGDQ+Rnu7/FgDUP9ZhluCz1oiTwXQ+ntwlrewutnKn0i2GsxZaUkHpRtO0egiY4Eub7kuX8pjdoFBL3Z84DqKK8TfPBF44J5y1wt7gJ/+LTvLLcn6eEDKlEGfe0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=lCXYPCdJ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="lCXYPCdJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DBAF6C3277B; Mon, 22 Apr 2024 23:54:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1713830071; bh=KlMbEl0NNUiSxTwSRNqwjjsGlwj+BgTY5HNovbG8Vo0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=lCXYPCdJD1CEdgtszxDR3vgpJBDalYVsCbDBVVtdM/7gbc/vjFDoy5WnPvBoMnJlx 8NQrSol5lXBShwQ/JyVvKm43Srp2LME8rkHDRR2QZnk86IPOih5oG7WCmlS5LvLxtc kRvYDzUHK6NuDiOC+eu71jX3CyHxdoV6ZajAnq7GknY2/y1RbBvW0YTok4xVvPRihD tpnystuygoPNjr8Jf01Ql2oPSv9+ZAPfAroRn7O05/2UMFxbZWEuHfawRSHy+0vIVO JfHcZ9x0Svj5M0TGUkMioU9fpN39SBxNthkjwUQ9Ft5M9kadLK41nUWE6lTaOwk/P7 kKoZEHOGFAkew== From: Sasha Levin To: linux-kernel@vger.kernel.org, stable@vger.kernel.org Cc: Maurizio Lombardi , Mike Christie , "Martin K . Petersen" , Sasha Levin , linux-scsi@vger.kernel.org, target-devel@vger.kernel.org Subject: [PATCH AUTOSEL 6.8 14/43] scsi: target: Fix SELinux error when systemd-modules loads the target module Date: Mon, 22 Apr 2024 19:14:00 -0400 Message-ID: <20240422231521.1592991-14-sashal@kernel.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20240422231521.1592991-1-sashal@kernel.org> References: <20240422231521.1592991-1-sashal@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-stable: review X-Patchwork-Hint: Ignore X-stable-base: Linux 6.8.7 Content-Transfer-Encoding: 8bit From: Maurizio Lombardi [ Upstream commit 97a54ef596c3fd24ec2b227ba8aaf2cf5415e779 ] If the systemd-modules service loads the target module, the credentials of that userspace process will be used to validate the access to the target db directory. SELinux will prevent it, reporting an error like the following: kernel: audit: type=1400 audit(1676301082.205:4): avc: denied { read } for pid=1020 comm="systemd-modules" name="target" dev="dm-3" ino=4657583 scontext=system_u:system_r:systemd_modules_load_t:s0 tcontext=system_u:object_r:targetd_etc_rw_t:s0 tclass=dir permissive=0 Fix the error by using the kernel credentials to access the db directory Signed-off-by: Maurizio Lombardi Link: https://lore.kernel.org/r/20240215143944.847184-2-mlombard@redhat.com Reviewed-by: Mike Christie Signed-off-by: Martin K. Petersen Signed-off-by: Sasha Levin --- drivers/target/target_core_configfs.c | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c index c1fbcdd161826..c40217f44b1bc 100644 --- a/drivers/target/target_core_configfs.c +++ b/drivers/target/target_core_configfs.c @@ -3672,6 +3672,8 @@ static int __init target_core_init_configfs(void) { struct configfs_subsystem *subsys = &target_core_fabrics; struct t10_alua_lu_gp *lu_gp; + struct cred *kern_cred; + const struct cred *old_cred; int ret; pr_debug("TARGET_CORE[0]: Loading Generic Kernel Storage" @@ -3748,11 +3750,21 @@ static int __init target_core_init_configfs(void) if (ret < 0) goto out; + /* We use the kernel credentials to access the target directory */ + kern_cred = prepare_kernel_cred(&init_task); + if (!kern_cred) { + ret = -ENOMEM; + goto out; + } + old_cred = override_creds(kern_cred); target_init_dbroot(); + revert_creds(old_cred); + put_cred(kern_cred); return 0; out: + target_xcopy_release_pt(); configfs_unregister_subsystem(subsys); core_dev_release_virtual_lun0(); rd_module_exit(); -- 2.43.0