[PATCH v3 40/42] selinux: disallow writes to /sys/fs/selinux/user in non-init namespaces
From: Stephen Smalley <stephen.smalley.work@gmail.com>
Date: 2025-05-20 12:01:56
Also in:
selinux
Subsystem:
selinux security module, the rest · Maintainers:
Paul Moore, Stephen Smalley, Linus Torvalds
Disallow writes to /sys/fs/selinux/user in non-init SELinux namespaces. Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com> --- security/selinux/selinuxfs.c | 16 +++++++++++++--- 1 file changed, 13 insertions(+), 3 deletions(-)
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index 8dde8f865dda..d165379271f9 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c@@ -1371,9 +1371,19 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size) int rc; u32 i, len, nsids; - pr_warn_ratelimited("SELinux: %s (%d) wrote to /sys/fs/selinux/user!" - " This will not be supported in the future; please update your" - " userspace.\n", current->comm, current->pid); + if (state == init_selinux_state) { + pr_warn_ratelimited("SELinux: %s (%d) wrote to" + " /sys/fs/selinux/user! This will not be" + " supported in the future; please update your" + " userspace.\n", current->comm, current->pid); + } else { + pr_warn_ratelimited("SELinux: %s (%d) tried to write to" + " /sys/fs/selinux/user! This is not supported" + " in non-init SELinux namespaces; please" + " update your userspace.\n", current->comm, + current->pid); + return -EPERM; + } /* * Only check against the current namespace because
--
2.49.0