[GIT PULL] SELinux fixes for v5.7 (#2)
torvalds at linux-foundation.org
Thu Apr 30 23:43:12 UTC 2020
On Thu, Apr 30, 2020 at 2:24 PM Paul Moore <paul at paul-moore.com> wrote:
> Two more SELinux patches to fix problems in the v5.7-rcX releases.
> Wei Yongjun's patch fixes a return code in an error path, and my patch
> fixes a problem where we were not correctly applying access controls
> to all of the netlink messages in the netlink_send LSM hook.
Side note: could we plan on (not for 5.7, but future) moving the "for
each message" part of that patch into the generic security layer (ie
security_netlink_send()), so that if/when other security subsystems
start doing that netlink thing, they won't have to duplicate that
Obviously the "for each message" thing should only be done if there is
any security hook at all..
Right now selinux is the only one that does this, so there's no
duplication of effort, but it seems a mistake to do this at the
low-level security level.
Or is there some fundamental reason why a security hook would want to
look at a single skb rather than the individual messages?
More information about the Linux-security-module-archive