torvalds/linux
torvalds/linux
2
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
Code

selinux: change security_compute_sid to return the ssid or tsid on match

Browse Source 
If the end result of a security_compute_sid() computation matches the
ssid or tsid, return that SID rather than looking it up again. This
avoids the problem of multiple initial SIDs that map to the same
context.

Cc: stable@vger.kernel.org
Reported-by: Guido Trentalancia <guido@trentalancia.com>
Fixes: ae254858ce ("selinux: introduce an initial SID for early boot processes")
Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com>
Tested-by: Guido Trentalancia <guido@trentalancia.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Stephen Smalley 2025-06-10 15:48:27 -04:00 committed by Paul Moore
parent 86c8db86af
commit fde46f60f6
1 changed files with 11 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
security/selinux/ss/services.c
View File

@ -1909,11 +1909,17 @@ retry:
goto out_unlock; goto out_unlock;
} }
/* Obtain the sid for the context. */ /* Obtain the sid for the context. */
rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid); if (context_equal(scontext, &newcontext))
if (rc == -ESTALE) { *out_sid = ssid;
rcu_read_unlock(); else if (context_equal(tcontext, &newcontext))
context_destroy(&newcontext); *out_sid = tsid;
goto retry; else {
rc = sidtab_context_to_sid(sidtab, &newcontext, out_sid);
if (rc == -ESTALE) {
rcu_read_unlock();
context_destroy(&newcontext);
goto retry;
}
} }
out_unlock: out_unlock:
rcu_read_unlock(); rcu_read_unlock();