From 2e1479d95d02b43660fe03ab2c595ec9751a6f97 Mon Sep 17 00:00:00 2001 From: Adrian Bunk Date: Mon, 17 Mar 2008 22:29:23 +0200 Subject: make selinux_parse_opts_str() static This patch makes the needlessly global selinux_parse_opts_str() static. Signed-off-by: Adrian Bunk Acked-by: Eric Paris Signed-off-by: James Morris --- security/selinux/hooks.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'security/selinux') diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 4bf4807f2d4..41a049f50f5 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -800,7 +800,8 @@ static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb, mutex_unlock(&newsbsec->lock); } -int selinux_parse_opts_str(char *options, struct security_mnt_opts *opts) +static int selinux_parse_opts_str(char *options, + struct security_mnt_opts *opts) { char *p; char *context = NULL, *defcontext = NULL; -- cgit v1.2.3 From 0794c66d49885a2f615618ce4940434b5b067d84 Mon Sep 17 00:00:00 2001 From: Stephen Smalley Date: Mon, 17 Mar 2008 08:55:18 -0400 Subject: selinux: handle files opened with flags 3 by checking ioctl permission Handle files opened with flags 3 by checking ioctl permission. Default to returning FILE__IOCTL from file_to_av() if the f_mode has neither FMODE_READ nor FMODE_WRITE, and thus check ioctl permission on exec or transfer, thereby validating such descriptors early as with normal r/w descriptors and catching leaks of them prior to attempted usage. Signed-off-by: Stephen Smalley Acked-by: Eric Paris Signed-off-by: James Morris --- security/selinux/hooks.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'security/selinux') diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 41a049f50f5..c2fef7b12dc 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1630,6 +1630,12 @@ static inline u32 file_to_av(struct file *file) else av |= FILE__WRITE; } + if (!av) { + /* + * Special file opened with flags 3 for ioctl-only use. + */ + av = FILE__IOCTL; + } return av; } -- cgit v1.2.3