From 0794c66d49885a2f615618ce4940434b5b067d84 Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Mon, 17 Mar 2008 08:55:18 -0400 Subject: selinux: handle files opened with flags 3 by checking ioctl permission Handle files opened with flags 3 by checking ioctl permission. Default to returning FILE__IOCTL from file_to_av() if the f_mode has neither FMODE_READ nor FMODE_WRITE, and thus check ioctl permission on exec or transfer, thereby validating such descriptors early as with normal r/w descriptors and catching leaks of them prior to attempted usage. Signed-off-by: Stephen Smalley Acked-by: Eric Paris Signed-off-by: James Morris --- security/selinux/hooks.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'security/selinux/hooks.c') diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 41a049f50f58..c2fef7b12dc7 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1630,6 +1630,12 @@ static inline u32 file_to_av(struct file *file) else av |= FILE__WRITE; } + if (!av) { + /* + * Special file opened with flags 3 for ioctl-only use. + */ + av = FILE__IOCTL; + } return av; } -- cgit v1.2.2