Commit 900f83cf authored by Thiébaud Weksteen's avatar Thiébaud Weksteen Committed by Paul Moore
Browse files

selinux: ignore unknown extended permissions 



When evaluating extended permissions, ignore unknown permissions instead
of calling BUG(). This commit ensures that future permissions can be
added without interfering with older kernels.

Cc: stable@vger.kernel.org
Fixes: fa1aa143 ("selinux: extended permissions for ioctls")
Signed-off-by: default avatarThiébaud Weksteen <tweek@google.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 40384c84

security/selinux/ss/services.c

+6 −2
Original line number Diff line number Diff line
@@ -979,7 +979,10 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, 
			return;

		break;

	default:

		BUG();

		pr_warn_once(

			"SELinux: unknown extended permission (%u) will be ignored\n",

			node->datum.u.xperms->specified);

		return;

	}



	if (node->key.specified == AVTAB_XPERMS_ALLOWED) {
@@ -998,7 +1001,8 @@ void services_compute_xperms_decision(struct extended_perms_decision *xpermd, 
					    &node->datum.u.xperms->perms,

					    xpermd->dontaudit);

	} else {

		BUG();

		pr_warn_once("SELinux: unknown specified key (%u)\n",

			     node->key.specified);

	}

}