Re: [PATCH v2 12/40] selinux: reject writable opens of policy file, drop mmap shared/write check
From: Paul Moore <paul@paul-moore.com>
Date: 2026-09-14 19:57:42
Also in:
bpf, dri-devel, fuse-devel, kvm, kvm-riscv, kvmarm, linux-arch, linux-doc, linux-fbdev, linux-fsdevel, linux-mm, linux-perf-users, linux-rdma, linux-riscv, linux-s390, linux-scsi, linux-sound, linux-usb, linuxppc-dev, lkml, selinux, sparclinux
On Mon, Sep 14, 2026 at 11:05 AM Lorenzo Stoakes (ARM) [off-list ref] wrote:
The policy file has no write method and is exposed read-only (S_IRUGO in selinux_files[]), yet sel_open_policy() performs no open mode check, so a CAP_DAC_OVERRIDE caller can open it O_RDWR. Reject FMODE_WRITE at open, as kernfs does. The file can then never be mapped with FMODE_WRITE, so do_mmap() always clears VM_MAYWRITE and VM_SHARED for MAP_SHARED mappings and the VM_SHARED check in sel_mmap_policy() cannot be reached. Remove it. This also stops sel_mmap_policy() clearing VM_MAYWRITE on a mapping that is neither a PFN map nor a mixed map, ahead of the core enforcing that only such mappings may do so. Acked-by: Stephen Smalley <stephen.smalley.work@gmail.com> Reviewed-by: Jann Horn <jannh@google.com> Signed-off-by: Lorenzo Stoakes (ARM) <ljs@kernel.org> --- security/selinux/selinuxfs.c | 11 +++-------- 1 file changed, 3 insertions(+), 8 deletions(-)
Acked-by: Paul Moore <paul@paul-moore.com> -- paul-moore.com