Commit ea49d10e authored by Stephen Smalley's avatar Stephen Smalley Committed by Paul Moore

selinux: normalize input to /sys/fs/selinux/enforce

At present, one can write any signed integer value to
/sys/fs/selinux/enforce and it will be stored,
e.g. echo -1 > /sys/fs/selinux/enforce or echo 2 >
/sys/fs/selinux/enforce. This makes no real difference
to the kernel, since it only ever cares if it is zero or non-zero,
but some userspace code compares it with 1 to decide if SELinux
is enforcing, and this could confuse it. Only a process that is
already root and is allowed the setenforce permission in SELinux
policy can write to /sys/fs/selinux/enforce, so this is not considered
to be a security issue, but it should be fixed.
Signed-off-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 13457d07
...@@ -163,6 +163,8 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf, ...@@ -163,6 +163,8 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
if (sscanf(page, "%d", &new_value) != 1) if (sscanf(page, "%d", &new_value) != 1)
goto out; goto out;
new_value = !!new_value;
if (new_value != selinux_enforcing) { if (new_value != selinux_enforcing) {
length = task_has_security(current, SECURITY__SETENFORCE); length = task_has_security(current, SECURITY__SETENFORCE);
if (length) if (length)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment