[PATCH 2/2] selinux: fall back to ref-walk if audit is required

[Paul Moore]

On Fri, Nov 22, 2019 at 12:23 PM Stephen Smalley <sds at tycho.nsa.gov> wrote:
> commit bda0be7ad994 ("security: make inode_follow_link RCU-walk aware")
> passed down the rcu flag to the SELinux AVC, but failed to adjust the
> test in slow_avc_audit() to also return -ECHILD on LSM_AUDIT_DATA_DENTRY.
> Previously, we only returned -ECHILD if generating an audit record with
> LSM_AUDIT_DATA_INODE since this was only relevant from inode_permission.
> Move the handling of MAY_NOT_BLOCK to avc_audit() and its inlined
> equivalent in selinux_inode_permission() immediately after we determine
> that audit is required, and always fall back to ref-walk in this case.
>
> Fixes: bda0be7ad994 ("security: make inode_follow_link RCU-walk aware")
> Reported-by: Will Deacon <will at kernel.org>
> Suggested-by: Al Viro <viro at zeniv.linux.org.uk>
> Signed-off-by: Stephen Smalley <sds at tycho.nsa.gov>
> ---
>  security/selinux/avc.c         | 24 +++++-------------------
>  security/selinux/hooks.c       | 11 +++++++----
>  security/selinux/include/avc.h |  8 +++++---
>  3 files changed, 17 insertions(+), 26 deletions(-)

Also merged into selinux/next, thanks.

-- 
paul moore
www.paul-moore.com