LKML Archive on lore.kernel.org
 help / color / Atom feed
* [PATCH] selinux: Fix all those pesky denials breaking my computer
@ 2020-04-01 18:09 Sultan Alsawaf
  2020-04-01 18:11 ` Paul Moore
  0 siblings, 1 reply; 2+ messages in thread
From: Sultan Alsawaf @ 2020-04-01 18:09 UTC (permalink / raw)
  Cc: Sultan Alsawaf, Paul Moore, Stephen Smalley, Eric Paris, selinux,
	linux-kernel

From: Sultan Alsawaf <sultan@kerneltoast.com>

I'm sure many of you have found yourself in a position where you've
tried to increase the security of your system by enabling SELinux, only
to discover that nothing worked anymore because of those darned 'denial'
messages. It's clearly an overlooked bug in SELinux!

With a bit of investigation, I discovered that the avc_denied() function
would erroneously return a non-zero value when I saw those denial
messages. After slapping in a `return 0;` at the top of that function,
all was well and my machine with SELinux enforcing was working again!

Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
---
 security/selinux/avc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/security/selinux/avc.c b/security/selinux/avc.c
index d18cb32a242a..b29f19471871 100644
--- a/security/selinux/avc.c
+++ b/security/selinux/avc.c
@@ -1010,6 +1010,7 @@ static noinline int avc_denied(struct selinux_state *state,
 			       u8 driver, u8 xperm, unsigned int flags,
 			       struct av_decision *avd)
 {
+	return 0;
 	if (flags & AVC_STRICT)
 		return -EACCES;
 
-- 
2.26.0


^ permalink raw reply	[flat|nested] 2+ messages in thread

* Re: [PATCH] selinux: Fix all those pesky denials breaking my computer
  2020-04-01 18:09 [PATCH] selinux: Fix all those pesky denials breaking my computer Sultan Alsawaf
@ 2020-04-01 18:11 ` Paul Moore
  0 siblings, 0 replies; 2+ messages in thread
From: Paul Moore @ 2020-04-01 18:11 UTC (permalink / raw)
  To: Sultan Alsawaf; +Cc: Stephen Smalley, Eric Paris, selinux, linux-kernel

On Wed, Apr 1, 2020 at 2:09 PM Sultan Alsawaf <sultan@kerneltoast.com> wrote:
> From: Sultan Alsawaf <sultan@kerneltoast.com>
>
> I'm sure many of you have found yourself in a position where you've
> tried to increase the security of your system by enabling SELinux, only
> to discover that nothing worked anymore because of those darned 'denial'
> messages. It's clearly an overlooked bug in SELinux!
>
> With a bit of investigation, I discovered that the avc_denied() function
> would erroneously return a non-zero value when I saw those denial
> messages. After slapping in a `return 0;` at the top of that function,
> all was well and my machine with SELinux enforcing was working again!
>
> Signed-off-by: Sultan Alsawaf <sultan@kerneltoast.com>
> ---
>  security/selinux/avc.c | 1 +
>  1 file changed, 1 insertion(+)

This is clearly an April Fools joke, but still.  No.

> diff --git a/security/selinux/avc.c b/security/selinux/avc.c
> index d18cb32a242a..b29f19471871 100644
> --- a/security/selinux/avc.c
> +++ b/security/selinux/avc.c
> @@ -1010,6 +1010,7 @@ static noinline int avc_denied(struct selinux_state *state,
>                                u8 driver, u8 xperm, unsigned int flags,
>                                struct av_decision *avd)
>  {
> +       return 0;
>         if (flags & AVC_STRICT)
>                 return -EACCES;
>
> --
> 2.26.0

-- 
paul moore
www.paul-moore.com

^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-04-01 18:09 [PATCH] selinux: Fix all those pesky denials breaking my computer Sultan Alsawaf
2020-04-01 18:11 ` Paul Moore

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git
	git clone --mirror https://lore.kernel.org/lkml/9 lkml/git/9.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git