[PATCH v5 42/42] selinux: disallow writes to /sys/fs/selinux/user in non-init namespaces
From: Stephen Smalley <stephen.smalley.work@gmail.com>
Date: 2025-06-17 14:06:57
Also in:
selinux
Subsystem:
selinux security module, the rest · Maintainers:
Paul Moore, Stephen Smalley, Linus Torvalds
Disallow writes to /sys/fs/selinux/user in non-init SELinux namespaces. Signed-off-by: Stephen Smalley <stephen.smalley.work@gmail.com> --- security/selinux/selinuxfs.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-)
diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
index c7825db4e06f..7450ab7c92d0 100644
--- a/security/selinux/selinuxfs.c
+++ b/security/selinux/selinuxfs.c@@ -1371,10 +1371,20 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size) int rc; u32 i, len, nsids; - pr_warn_ratelimited("SELinux: %s (%d) wrote to /sys/fs/selinux/user!" - " This will not be supported in the future; please update your" - " userspace.\n", current->comm, current->pid); - ssleep(5); + if (state == init_selinux_state) { + pr_warn_ratelimited("SELinux: %s (%d) wrote to" + " /sys/fs/selinux/user! This will not be" + " supported in the future; please update your" + " userspace.\n", current->comm, current->pid); + ssleep(5); + } else { + pr_warn_ratelimited("SELinux: %s (%d) tried to write to" + " /sys/fs/selinux/user! This is not supported" + " in non-init SELinux namespaces; please" + " update your userspace.\n", current->comm, + current->pid); + return -EPERM; + } /* * Only check against the current namespace because
--
2.49.0