[RFC 1/1] Use ioctl selinux callback io_uring commands that implement the ioctl op convention

From: Joel Granados <j.granados@samsung.com>
To: <joshi.k@samsung.com>, <ddiss@suse.de>, <mcgrof@kernel.org>,
	<paul@paul-moore.com>
Cc: <linux-security-module@vger.kernel.org>,
	<io-uring@vger.kernel.org>,
	"Joel Granados" <j.granados@samsung.com>
Subject: [RFC 1/1] Use ioctl selinux callback io_uring commands that implement the ioctl op convention
Date: Wed, 16 Nov 2022 13:50:51 +0100	[thread overview]
Message-ID: <20221116125051.3338926-2-j.granados@samsung.com> (raw)
In-Reply-To: <20221116125051.3338926-1-j.granados@samsung.com>

Signed-off-by: Joel Granados <j.granados@samsung.com>
---
 security/selinux/hooks.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index f553c370397e..a3f37ae5a980 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -21,6 +21,7 @@
  *  Copyright (C) 2016 Mellanox Technologies
  */
 
+#include "linux/nvme_ioctl.h"
 #include <linux/init.h>
 #include <linux/kd.h>
 #include <linux/kernel.h>
@@ -7005,12 +7006,22 @@ static int selinux_uring_cmd(struct io_uring_cmd *ioucmd)
 	struct inode *inode = file_inode(file);
 	struct inode_security_struct *isec = selinux_inode(inode);
 	struct common_audit_data ad;
+	const struct cred *cred = current_cred();
 
 	ad.type = LSM_AUDIT_DATA_FILE;
 	ad.u.file = file;
 
-	return avc_has_perm(&selinux_state, current_sid(), isec->sid,
-			    SECCLASS_IO_URING, IO_URING__CMD, &ad);
+	switch (ioucmd->cmd_op) {
+	case NVME_URING_CMD_IO:
+	case NVME_URING_CMD_IO_VEC:
+	case NVME_URING_CMD_ADMIN:
+	case NVME_URING_CMD_ADMIN_VEC:
+		return ioctl_has_perm(cred, file, FILE__IOCTL, (u16) ioucmd->cmd_op);
+	default:
+		return avc_has_perm(&selinux_state, current_sid(), isec->sid,
+				    SECCLASS_IO_URING, IO_URING__CMD, &ad);
+	}
+
 }
 #endif /* CONFIG_IO_URING */
 
-- 
2.30.2

