| Message ID | 20231122141559.4228-6-laoar.shao@gmail.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | mm, security, bpf: Fine-grained control over memory policy adjustments with lsm bpf | expand |
| Context | Check | Description |
|---|---|---|
| netdev/tree_selection | success | Not a local patch |
| bpf/vmtest-bpf-next-PR | fail | PR summary |
| bpf/vmtest-bpf-next-VM_Test-1 | success | Logs for ShellCheck |
| bpf/vmtest-bpf-next-VM_Test-3 | fail | Logs for aarch64-gcc / build / build for aarch64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-4 | success | Logs for aarch64-gcc / test |
| bpf/vmtest-bpf-next-VM_Test-5 | success | Logs for aarch64-gcc / veristat |
| bpf/vmtest-bpf-next-VM_Test-0 | success | Logs for Lint |
| bpf/vmtest-bpf-next-VM_Test-2 | success | Logs for Validate matrix.py |
| bpf/vmtest-bpf-next-VM_Test-15 | success | Logs for x86_64-llvm-16 / veristat |
| bpf/vmtest-bpf-next-VM_Test-6 | fail | Logs for s390x-gcc / build / build for s390x with gcc |
| bpf/vmtest-bpf-next-VM_Test-10 | fail | Logs for x86_64-gcc / build / build for x86_64 with gcc |
| bpf/vmtest-bpf-next-VM_Test-9 | success | Logs for set-matrix |
| bpf/vmtest-bpf-next-VM_Test-7 | success | Logs for s390x-gcc / test |
| bpf/vmtest-bpf-next-VM_Test-12 | success | Logs for x86_64-gcc / veristat |
| bpf/vmtest-bpf-next-VM_Test-14 | success | Logs for x86_64-llvm-16 / test |
| bpf/vmtest-bpf-next-VM_Test-13 | fail | Logs for x86_64-llvm-16 / build / build for x86_64 with llvm-16 |
| bpf/vmtest-bpf-next-VM_Test-11 | success | Logs for x86_64-gcc / test |
| bpf/vmtest-bpf-next-VM_Test-8 | success | Logs for s390x-gcc / veristat |
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index feda711c6b7b..1528d4dcfa03 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4238,6 +4238,13 @@ static int selinux_userns_create(const struct cred *cred) USER_NAMESPACE__CREATE, NULL); } +static int selinux_set_mempolicy(unsigned long mode, unsigned short mode_flags, + nodemask_t *nmask, unsigned int flags) +{ + return avc_has_perm(current_sid(), task_sid_obj(current), SECCLASS_PROCESS, + PROCESS__SETMEMPOLICY, NULL); +} + /* Returns error only if unable to parse addresses */ static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct common_audit_data *ad, u8 *proto) @@ -7072,6 +7079,7 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = { LSM_HOOK_INIT(task_kill, selinux_task_kill), LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode), LSM_HOOK_INIT(userns_create, selinux_userns_create), + LSM_HOOK_INIT(set_mempolicy, selinux_set_mempolicy), LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission), LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid), diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index a3c380775d41..c280d92a409f 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -51,7 +51,7 @@ const struct security_class_mapping secclass_map[] = { "getattr", "setexec", "setfscreate", "noatsecure", "siginh", "setrlimit", "rlimitinh", "dyntransition", "setcurrent", "execmem", "execstack", "execheap", "setkeycreate", - "setsockcreate", "getrlimit", NULL } }, + "setsockcreate", "getrlimit", "setmempolicy", NULL } }, { "process2", { "nnp_transition", "nosuid_transition", NULL } }, { "system",
Add a SELinux access control for the newly introduced set_mempolicy lsm hook. A new permission "setmempolicy" is defined under the "process" class for it. Signed-off-by: Yafang Shao <laoar.shao@gmail.com> --- security/selinux/hooks.c | 8 ++++++++ security/selinux/include/classmap.h | 2 +- 2 files changed, 9 insertions(+), 1 deletion(-)