Re: [PATCH v16 1/3] lsm, selinux: Add setup_report permission to binder
From: Paul Moore <paul@paul-moore.com>
Date: 2025-03-07 21:47:39
Also in:
linux-doc, lkml, selinux
On Mon, Mar 3, 2025 at 3:02 PM Li Li [off-list ref] wrote:
From: Thiébaud Weksteen <redacted> Introduce a new permission "setup_report" to the "binder" class. This persmission controls the ability to set up the binder generic netlink driver to report certain binder transactions. Signed-off-by: Thiébaud Weksteen <redacted> Signed-off-by: Li Li <redacted> --- include/linux/lsm_hook_defs.h | 1 + include/linux/security.h | 6 ++++++ security/security.c | 13 +++++++++++++ security/selinux/hooks.c | 7 +++++++ security/selinux/include/classmap.h | 3 ++- 5 files changed, 29 insertions(+), 1 deletion(-)
...
quoted hunk ↗ jump to hunk
diff --git a/security/security.c b/security/security.c index 8aa839232c73..382e3bbab215 100644 --- a/security/security.c +++ b/security/security.c@@ -1043,6 +1043,19 @@ int security_binder_transfer_file(const struct cred *from, return call_int_hook(binder_transfer_file, from, to, file); } +/** + * security_binder_setup_report() - Check if process allowed to set up binder reports.
Please keep the line length in the LSM and SELinux code to 80 characters or less.
quoted hunk ↗ jump to hunk
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 0d958f38ff9f..2fafa8feafdf 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c@@ -2092,6 +2092,12 @@ static int selinux_binder_transfer_file(const struct cred *from, &ad); } +static int selinux_binder_setup_report(const struct cred *to) +{ + return avc_has_perm(current_sid(), cred_sid(to), SECCLASS_BINDER, + BINDER__SETUP_REPORT, NULL); +}
There should also be an associated patch{set} against the
selinux-testsuite to add tests for the binder/setup_report permission
introduced here. My apologies if you've already posted one, but I'm
looking now and I don't see anything either on the lists or on GH.
* https://github.com/SELinuxProject/selinux-testsuite
--
paul-moore.com