On Fri, Nov 12, 2021 at 05:11:38PM +0100, Greg KH wrote:
On Wed, Nov 10, 2021 at 02:59:10PM -0800, Todd Kjos wrote:
commit 52f88693378a58094c538662ba652aff0253c4fe upstream.
Since binder was integrated with selinux, it has passed 'struct task_struct' associated with the binder_proc to represent the source and target of transactions. The conversion of task to SID was then done in the hook implementations. It turns out that there are race conditions which can result in an incorrect security context being used.
Fix by using the 'struct cred' saved during binder_open and pass it to the selinux subsystem.
Cc: stable@vger.kernel.org # 5.14 (need backport for earlier stables) Fixes: 79af73079d75 ("Add security hooks to binder and implement the hooks for SELinux.") Suggested-by: Jann Horn jannh@google.com Signed-off-by: Todd Kjos tkjos@google.com Acked-by: Casey Schaufler casey@schaufler-ca.com Signed-off-by: Paul Moore paul@paul-moore.com Change-Id: Id7157515d2b08f11683aeb8ad9b8f1da075d34e7
drivers/android/binder.c | 18 +++++++++--------- include/linux/lsm_hooks.h | 32 ++++++++++++++++---------------- include/linux/security.h | 28 ++++++++++++++-------------- security/security.c | 14 +++++++------- security/selinux/hooks.c | 31 +++++++++++++------------------ 5 files changed, 59 insertions(+), 64 deletions(-)
This doesn't apply at all. I've applied patch 1/2 here, but can you redo this one and submit it again?
Ugh, nope, my fault, sorry, this worked just fine.
It's been a long day...
greg k-h