iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
44d37ad360
linux/security/selinux
History
Jeff Vander Stoep 44d37ad360 selinux: do not check open perm on ftruncate call 
Use the ATTR_FILE attribute to distinguish between truncate()
and ftruncate() system calls. The two other cases where
do_truncate is called with a filp (and therefore ATTR_FILE is set)
are for coredump files and for open(O_TRUNC). In both of those cases
the open permission has already been checked during file open and
therefore does not need to be repeated.

Commit 95dbf73931 ("SELinux: check OPEN on truncate calls")
fixed a major issue where domains were allowed to truncate files
without the open permission. However, it introduced a new bug where
a domain with the write permission can no longer ftruncate files
without the open permission, even when they receive an already open
file.

Signed-off-by: Jeff Vander Stoep <jeffv@google.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Paul Moore <pmoore@redhat.com>
2015-10-21 17:44:25 -04:00
..
include Merge branch 'next' of git://git.infradead.org/users/pcmoore/selinux into next 2015-08-15 13:29:57 +10:00
ss selinux: extended permissions for ioctls 2015-07-13 13:31:58 -04:00
.gitignore
avc.c Merge branch 'next' of git://git.infradead.org/users/pcmoore/selinux into next 2015-08-15 13:29:57 +10:00
exports.c selinux: sparse fix: include selinux.h in exports.c 2011-09-09 16:56:32 -07:00
hooks.c selinux: do not check open perm on ftruncate call 2015-10-21 17:44:25 -04:00
Kconfig selinux: change CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE default 2015-10-21 17:44:25 -04:00
Makefile selinux: change to new flag variable 2010-10-21 10:12:40 +11:00
netif.c Merge commit 'v3.17' into next 2014-11-19 21:32:12 +11:00
netlabel.c selinux: ensure that the cached NetLabel secattr matches the desired SID 2013-12-04 16:08:17 -05:00
netlink.c selinux: replace obsolete NLMSG_* with type safe nlmsg_* 2013-03-28 14:25:49 -04:00
netnode.c selinux: remove unused variabled in the netport, netnode, and netif caches 2014-08-07 20:55:30 -04:00
netport.c selinux: remove unused variabled in the netport, netnode, and netif caches 2014-08-07 20:55:30 -04:00
nlmsgtab.c selinux/nlmsg: add a build time check for rtnl/xfrm cmds 2015-04-13 13:09:44 -04:00
selinuxfs.c mm: mark most vm_operations_struct const 2015-09-10 13:29:01 -07:00
xfrm.c netfilter: Remove spurios included of netfilter.h 2015-06-18 21:14:32 +02:00