Skip to content

Commit

Permalink
selinux: handle files opened with flags 3 by checking ioctl permission
Browse files Browse the repository at this point in the history
Handle files opened with flags 3 by checking ioctl permission.

Default to returning FILE__IOCTL from file_to_av() if the f_mode has neither
FMODE_READ nor FMODE_WRITE, and thus check ioctl permission on exec or
transfer, thereby validating such descriptors early as with normal r/w
descriptors and catching leaks of them prior to attempted usage.

Signed-off-by:  Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>
  • Loading branch information
Stephen Smalley authored and James Morris committed Apr 2, 2008
1 parent 0e81a8a commit 0794c66
Showing 1 changed file with 6 additions and 0 deletions.
6 changes: 6 additions & 0 deletions security/selinux/hooks.c
Original file line number Diff line number Diff line change
Expand Up @@ -1630,6 +1630,12 @@ static inline u32 file_to_av(struct file *file)
else
av |= FILE__WRITE;
}
if (!av) {
/*
* Special file opened with flags 3 for ioctl-only use.
*/
av = FILE__IOCTL;
}

return av;
}
Expand Down

0 comments on commit 0794c66

Please sign in to comment.