BackPup/Linux
1
0 Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-10-07 05:31:08 -04:00
Code Issues Packages Projects Releases Wiki Activity

block: Check ADMIN before NICE for IOPRIO_CLASS_RT

Browse Source 
Booting to Android userspace on 5.14 or newer triggers the following
SELinux denial:

avc: denied { sys_nice } for comm="init" capability=23
     scontext=u:r:init:s0 tcontext=u:r:init:s0 tclass=capability
     permissive=0

Init is PID 0 running as root, so it already has CAP_SYS_ADMIN. For
better compatibility with older SEPolicy, check ADMIN before NICE.

Fixes: 9d3a39a5f1 ("block: grant IOPRIO_CLASS_RT to CAP_SYS_NICE")
Signed-off-by: Alistair Delva <[email protected]>
Cc: Khazhismel Kumykov <[email protected]>
Cc: Bart Van Assche <[email protected]>
Cc: Serge Hallyn <[email protected]>
Cc: Jens Axboe <[email protected]>
Cc: Greg Kroah-Hartman <[email protected]>
Cc: Paul Moore <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected] # v5.14+
Reviewed-by: Bart Van Assche <[email protected]>
Acked-by: Serge Hallyn <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jens Axboe <[email protected]>
This commit is contained in:
Alistair Delva authored and Jens Axboe committed 2021-11-15 14:28:59 -07:00
1 parent fa55b7dcdc
commit 94c4b4fd25
1 file changed
+8 -1
Download Patch File Download Diff File Expand all files Collapse all files
block/ioprio.c
+8 -1
View File
@@ -69,7 +69,14 @@ int ioprio_check_cap(int ioprio)
switch (class) {
case IOPRIO_CLASS_RT:
if (!capable(CAP_SYS_NICE) && !capable(CAP_SYS_ADMIN))
/*
* Originally this only checked for CAP_SYS_ADMIN,
* which was implicitly allowed for pid 0 by security
* modules such as SELinux. Make sure we check
* CAP_SYS_ADMIN first to avoid a denial/avc for
* possibly missing CAP_SYS_NICE permission.
*/
if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_NICE))
return -EPERM;
fallthrough;
/* rt has prio field too */