search

SELinuxProject / selinux-kernel

GitHub mirror of the SELinux kernel repository
https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux.git
Other
148 stars 56 forks source link

BUG: False positives on CAP_WAKE_ALARM #28

Closed stephensmalley closed 7 years ago

stephensmalley commented 7 years ago

The kernel checks CAP_WAKE_ALARM before testing whether it is truly needed (i.e. for CLOCK_REALTIME_ALARM and CLOCK_BOOTTIME_ALARM) in timerfd_create() and do_timerfd_settime(). This generates avc denials of wake_alarm permission when it is not truly required, which in turn will lead to either unnecessarily permissive policy (allowing it) or pervasive dontaudits. Should flip the order of the tests in those conditionals so we only perform capable(CAP_WAKE_ALARM) when needed. That's more efficient too in the common case.

stephensmalley commented 7 years ago

Addressed via https://www.mail-archive.com/selinux@tycho.nsa.gov/msg03962.html

cgzones commented 7 years ago

v4.11-rc2: https://github.com/torvalds/linux/commit/25b68a8f0ab13a98de02650208ec927796659898