1 files changed, 34 insertions, 2 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index dc15f16a357c..c3ee902306d8 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2792,8 +2792,25 @@ static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
 
         rc = security_context_to_sid(value, size, &newsid);
         if (rc == -EINVAL) {
-                if (!capable(CAP_MAC_ADMIN))
+                if (!capable(CAP_MAC_ADMIN)) {
+                        struct audit_buffer *ab;
+                        size_t audit_size;
+                        const char *str;
+
+                        /* We strip a nul only if it is at the end, otherwise the
+                         * context contains a nul and we should audit that */
+                        str = value;
+                        if (str[size - 1] == '\0')
+                                audit_size = size - 1;
+                        else
+                                audit_size = size;
+                        ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
+                        audit_log_format(ab, "op=setxattr invalid_context=");
+                        audit_log_n_untrustedstring(ab, value, audit_size);
+                        audit_log_end(ab);
+
                         return rc;
+                }
                 rc = security_context_to_sid_force(value, size, &newsid);
         }
         if (rc)
@@ -5335,8 +5352,23 @@ static int selinux_setprocattr(struct task_struct *p,
                 }
                 error = security_context_to_sid(value, size, &sid);
                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
-                        if (!capable(CAP_MAC_ADMIN))
+                        if (!capable(CAP_MAC_ADMIN)) {
+                                struct audit_buffer *ab;
+                                size_t audit_size;
+
+                                /* We strip a nul only if it is at the end, otherwise the
+                                 * context contains a nul and we should audit that */
+                                if (str[size - 1] == '\0')
+                                        audit_size = size - 1;
+                                else
+                                        audit_size = size;
+                                ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
+                                audit_log_format(ab, "op=fscreate invalid_context=");
+                                audit_log_n_untrustedstring(ab, value, audit_size);
+                                audit_log_end(ab);
+
                                 return error;
+                        }
                         error = security_context_to_sid_force(value, size,
                                                               &sid);
                 }