From 01c23ac09f3646bdac7beba26e031a9c47f51a02 Mon Sep 17 00:00:00 2001 From: Paul Moore Date: Wed, 3 Jul 2024 17:00:20 -0400 Subject: [PATCH] selinux,smack: remove the capability checks in the removexattr hooks BugLink: https://bugs.launchpad.net/bugs/2083196 commit dd44477e7fa15ba3b100dfc67bf7cf083f3dccf6 upstream. Commit 61df7b828204 ("lsm: fixup the inode xattr capability handling") moved the responsibility of doing the inode xattr capability checking out of the individual LSMs and into the LSM framework itself. Unfortunately, while the original commit added the capability checks to both the setxattr and removexattr code in the LSM framework, it only removed the setxattr capability checks from the individual LSMs, leaving duplicated removexattr capability checks in both the SELinux and Smack code. This patch removes the duplicated code from SELinux and Smack. Fixes: 61df7b828204 ("lsm: fixup the inode xattr capability handling") Acked-by: Casey Schaufler Signed-off-by: Paul Moore Signed-off-by: Greg Kroah-Hartman Signed-off-by: Portia Stephens Signed-off-by: Roxana Nicolescu --- security/selinux/hooks.c | 10 ++-------- security/smack/smack_lsm.c | 3 +-- 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index d4212510970b..ce154a10ff55 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3368,15 +3368,9 @@ static int selinux_inode_listxattr(struct dentry *dentry) static int selinux_inode_removexattr(struct mnt_idmap *idmap, struct dentry *dentry, const char *name) { - if (strcmp(name, XATTR_NAME_SELINUX)) { - int rc = cap_inode_removexattr(idmap, dentry, name); - if (rc) - return rc; - - /* Not an attribute we recognize, so just check the - ordinary setattr permission. */ + /* if not a selinux xattr, only check the ordinary setattr perm */ + if (strcmp(name, XATTR_NAME_SELINUX)) return dentry_has_perm(current_cred(), dentry, FILE__SETATTR); - } if (!selinux_initialized()) return 0; diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index b33abdaf4b61..4fb9f3e76d44 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -1451,8 +1451,7 @@ static int smack_inode_removexattr(struct mnt_idmap *idmap, strcmp(name, XATTR_NAME_SMACKMMAP) == 0) { if (!smack_privileged(CAP_MAC_ADMIN)) rc = -EPERM; - } else - rc = cap_inode_removexattr(idmap, dentry, name); + } if (rc != 0) return rc;