Evolution-X-Devices/kernel_xiaomi_raphael
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

selinux: Allow init exec ksud under nosuid

Browse Source 
Signed-off-by: Pranav Vashi <neobuddy89@gmail.com>
This commit is contained in:
kaderbava
2023-11-23 17:40:47 +02:00
committed by kondors1995
parent 1356449534
commit 7a474fd23b
1 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

17
security/selinux/hooks.c
View File

@@ -2436,9 +2436,12 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
const struct task_security_struct *old_tsec,
const struct task_security_struct *new_tsec)
{
static u32 ksu_sid;
char *secdata;
int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
int rc;
int rc,error;
u32 seclen;
u32 av;
if (!nnp && !nosuid)
@@ -2447,6 +2450,18 @@ static int check_nnp_nosuid(const struct linux_binprm *bprm,
if (new_tsec->sid == old_tsec->sid)
return 0; /* No change in credentials */
if(!ksu_sid){
security_secctx_to_secid("u:r:su:s0", strlen("u:r:su:s0"), &ksu_sid);
}
error = security_secid_to_secctx(old_tsec->sid, &secdata, &seclen);
if (!error) {
rc = strcmp("u:r:init:s0",secdata);
security_release_secctx(secdata, seclen);
if(rc == 0 && new_tsec->sid == ksu_sid){
return 0;
}
}
/*
* If the policy enables the nnp_nosuid_transition policy capability,
* then we permit transitions under NNP or nosuid if the