Stephen Smalley 892e8cac99 selinux: fix mprotect PROT_EXEC regression caused by mm change ... commit 66fc130394 ("mm: shmem_zero_setup skip security check and lockdep conflict with XFS") caused a regression for SELinux by disabling any SELinux checking of mprotect PROT_EXEC on shared anonymous mappings. However, even before that regression, the checking on such mprotect PROT_EXEC calls was inconsistent with the checking on a mmap PROT_EXEC call for a shared anonymous mapping. On a mmap, the security hook is passed a NULL file and knows it is dealing with an anonymous mapping and therefore applies an execmem check and no file checks. On a mprotect, the security hook is passed a vma with a non-NULL vm_file (as this was set from the internally-created shmem file during mmap) and therefore applies the file-based execute check and no execmem check. Since the aforementioned commit now marks the shmem zero inode with the S_PRIVATE flag, the file checks are disabled and we have no checking at all on mprotect PROT_EXEC. Add a test to the mprotect hook logic for such private inodes, and apply an execmem check in that case. This makes the mmap and mprotect checking consistent for shared anonymous mappings, as well as for /dev/zero and ashmem. Cc: <stable@vger.kernel.org> # 4.1.x Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <pmoore@redhat.com>		2015-07-10 16:45:29 -04:00
..
include	selinux: Remove unused permission definitions	2015-06-04 16:22:17 -04:00
ss	selinux: don't waste ebitmap space when importing NetLabel categories	2015-07-09 14:20:36 -04:00
.gitignore	SELinux: add .gitignore files for dynamic classes	2009-10-24 09:42:27 +08:00
Kconfig	selinux: Deprecate and schedule the removal of the the compat_net functionality	2008-12-31 12:54:11 -05:00
Makefile	selinux: change to new flag variable	2010-10-21 10:12:40 +11:00
avc.c	selinux: remove unnecessary pointer reassignment	2015-04-06 20:04:54 -04:00
exports.c	selinux: sparse fix: include selinux.h in exports.c	2011-09-09 16:56:32 -07:00
hooks.c	selinux: fix mprotect PROT_EXEC regression caused by mm change	2015-07-10 16:45:29 -04:00
netif.c	Merge commit 'v3.17' into next	2014-11-19 21:32:12 +11:00
netlabel.c	selinux: ensure that the cached NetLabel secattr matches the desired SID	2013-12-04 16:08:17 -05:00
netlink.c	selinux: replace obsolete NLMSG_* with type safe nlmsg_*	2013-03-28 14:25:49 -04:00
netnode.c	selinux: remove unused variabled in the netport, netnode, and netif caches	2014-08-07 20:55:30 -04:00
netport.c	selinux: remove unused variabled in the netport, netnode, and netif caches	2014-08-07 20:55:30 -04:00
nlmsgtab.c	selinux/nlmsg: add a build time check for rtnl/xfrm cmds	2015-04-13 13:09:44 -04:00
selinuxfs.c	VFS: security/: d_inode() annotations	2015-04-15 15:06:57 -04:00
xfrm.c	selinux: add gfp argument to security_xfrm_policy_alloc and fix callers	2014-03-10 08:30:02 +01:00