diff options
| author | Konstantin Andreev <andreev@swemel.ru> | 2025-06-17 00:32:16 +0300 |
|---|---|---|
| committer | Casey Schaufler <casey@schaufler-ca.com> | 2025-06-24 16:30:24 -0700 |
| commit | c147e13ea7fe9f118f8c9ba5e96cbd644b00d6b3 (patch) | |
| tree | 7aa1a47693dda41f17209284a5bd56ab6def1152 /tools/docs/lib/parse_data_structs.py | |
| parent | 78fc6a94be252b27bb73e4926eed70b5e302a8e0 (diff) | |
smack: fix bug: unprivileged task can create labels
If an unprivileged task is allowed to relabel itself
(/smack/relabel-self is not empty),
it can freely create new labels by writing their
names into own /proc/PID/attr/smack/current
This occurs because do_setattr() imports
the provided label in advance,
before checking "relabel-self" list.
This change ensures that the "relabel-self" list
is checked before importing the label.
Fixes: 38416e53936e ("Smack: limited capability for changing process label")
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Diffstat (limited to 'tools/docs/lib/parse_data_structs.py')
0 files changed, 0 insertions, 0 deletions