On 10/9/26 20:04, Lorenzo Stoakes (ARM) wrote: > The policy file has no write method and is exposed read-only (S_IRUGO in > selinux_files[]), yet sel_open_policy() performs no open mode check, so a > CAP_DAC_OVERRIDE caller can open it O_RDWR. Reject FMODE_WRITE at open, as > kernfs does. > > The file can then never be mapped with FMODE_WRITE, so do_mmap() always > clears VM_MAYWRITE and VM_SHARED for MAP_SHARED mappings and the VM_SHARED > check in sel_mmap_policy() cannot be reached. Remove it. > > This also stops sel_mmap_policy() clearing VM_MAYWRITE on a mapping that is > neither a PFN map nor a mixed map, ahead of the core enforcing that only > such mappings may do so. > > Acked-by: Stephen Smalley <[email protected]> > Reviewed-by: Jann Horn <[email protected]> > Acked-by: Paul Moore <[email protected]> > Reviewed-by: Suren Baghdasaryan <[email protected]> > Signed-off-by: Lorenzo Stoakes (ARM) <[email protected]> > ---
Acked-by: David Hildenbrand (Arm) <[email protected]> -- Cheers, David
