From: James Morris <jmorris@namei.org>
To: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Al Viro <viro@ZenIV.linux.org.uk>, Thomas Meyer <thomas@m3y3r.de>,
"Rafael J. Wysocki" <rjw@sisk.pl>,
Alexander Beregalov <a.beregalov@gmail.com>,
Stephen Rothwell <sfr@canb.auug.org.au>,
linux-next@vger.kernel.org, LKML <linux-kernel@vger.kernel.org>,
Ingo Molnar <mingo@elte.hu>,
Kernel Testers List <kernel-testers@vger.kernel.org>,
Eric Paris <eparis@parisplace.org>,
linux-security-module@vger.kernel.org
Subject: Re: BUG at security/selinux/avc.c:883 (was: Re: linux-next: Tree for July 17: early crash on x86-64)
Date: Tue, 29 Jul 2008 07:38:17 +1000 (EST) [thread overview]
Message-ID: <Xine.LNX.4.64.0807290736440.30242@us.intercode.com.au> (raw)
In-Reply-To: <1217266358.20373.54.camel@moss-spartans.epoch.ncsc.mil>
On Mon, 28 Jul 2008, Stephen Smalley wrote:
> SELinux needs MAY_APPEND to be passed down to the security hook.
> Otherwise, we get permission denials when only append permission is
> granted by policy even if the opening process specified O_APPEND.
> Shows up as a regression in the ltp selinux testsuite, fixed by
> this patch.
>
> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Applied to
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#hotfixes
Al, holler if you want to push this through your tree.
---
fs/namei.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/fs/namei.c b/fs/namei.c
index a7b0a0b..b91e973 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -274,7 +274,7 @@ int inode_permission(struct inode *inode, int mask)
return retval;
return security_inode_permission(inode,
- mask & (MAY_READ|MAY_WRITE|MAY_EXEC));
+ mask & (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND));
}
/**
- James
--
James Morris
<jmorris@namei.org>
next prev parent reply other threads:[~2008-07-28 21:39 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2008-07-17 15:28 linux-next: Tree for July 17 Stephen Rothwell
2008-07-17 22:21 ` linux-next: Tree for July 17 (sysctl/syscall) Randy Dunlap
2008-07-17 22:34 ` linux-next: Tree for July 17 (net_namespace) Randy Dunlap
2008-07-17 23:06 ` linux-next: Tree for July 17: early crash on x86-64 Rafael J. Wysocki
2008-07-18 13:52 ` Alexander Beregalov
2008-07-19 3:52 ` Al Viro
2008-07-19 18:42 ` Rafael J. Wysocki
2008-07-19 19:54 ` James Morris
2008-07-20 9:42 ` BUG at security/selinux/avc.c:883 (was: Re: linux-next: Tree for July 17: early crash on x86-64) Thomas Meyer
2008-07-20 12:15 ` Al Viro
2008-07-28 17:32 ` Stephen Smalley
2008-07-28 21:38 ` James Morris [this message]
2008-07-29 0:33 ` Al Viro
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=Xine.LNX.4.64.0807290736440.30242@us.intercode.com.au \
--to=jmorris@namei.org \
--cc=a.beregalov@gmail.com \
--cc=eparis@parisplace.org \
--cc=kernel-testers@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-next@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=mingo@elte.hu \
--cc=rjw@sisk.pl \
--cc=sds@tycho.nsa.gov \
--cc=sfr@canb.auug.org.au \
--cc=thomas@m3y3r.de \
--cc=viro@ZenIV.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox