Stephen Smalley f3bef67992 selinux: fix bug in conditional rules handling ... commit fa1aa143ac ("selinux: extended permissions for ioctls") introduced a bug into the handling of conditional rules, skipping the processing entirely when the caller does not provide an extended permissions (xperms) structure. Access checks from userspace using /sys/fs/selinux/access do not include such a structure since that interface does not presently expose extended permission information. As a result, conditional rules were being ignored entirely on userspace access requests, producing denials when access was allowed by conditional rules in the policy. Fix the bug by only skipping computation of extended permissions in this situation, not the entire conditional rules processing. Reported-by: Laurent Bigonville <bigon@debian.org> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> [PM: fixed long lines in patch description] Cc: stable@vger.kernel.org # 4.3 Signed-off-by: Paul Moore <pmoore@redhat.com>		2015-11-24 13:44:32 -05:00
..
apparmor	Minor merge needed, due to function move.	2015-07-01 10:49:25 -07:00
integrity	integrity: prevent loading untrusted certificates on the IMA trusted keyring	2015-10-09 15:31:18 -04:00
keys	keys, trusted: seal/unseal with TPM 2.0 chips	2015-10-19 01:01:22 +02:00
selinux	selinux: fix bug in conditional rules handling	2015-11-24 13:44:32 -05:00
smack	Smack: limited capability for changing process label	2015-10-19 12:06:47 -07:00
tomoyo	LSM: Switch to lists of hooks	2015-05-12 15:00:41 +10:00
yama	Adding YAMA hooks also when YAMA is not stacked.	2015-08-04 01:36:18 +10:00
commoncap.c	capabilities: add a securebit to disable PR_CAP_AMBIENT_RAISE	2015-09-04 16:54:41 -07:00
device_cgroup.c	security/device_cgroup: Fix RCU_LOCKDEP_WARN() condition	2015-09-03 18:13:10 -07:00
inode.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2015-07-04 19:36:06 -07:00
Kconfig	Yama: remove needless CONFIG_SECURITY_YAMA_STACKED	2015-07-28 13:18:19 +10:00
lsm_audit.c	Merge branch 'next' of git://git.infradead.org/users/pcmoore/selinux into next	2015-08-15 13:29:57 +10:00
Makefile	LSM: Switch to lists of hooks	2015-05-12 15:00:41 +10:00
min_addr.c	mmap_min_addr check CAP_SYS_RAWIO only for write	2010-04-23 08:56:31 +10:00
security.c	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2015-09-08 12:41:25 -07:00