Konstantin Andreev 6b1e45e135 smack: fix bug: unprivileged task can create labels ...

[ Upstream commit c147e13ea7 ]

If an unprivileged task is allowed to relabel itself
(/smack/relabel-self is not empty),
it can freely create new labels by writing their
names into own /proc/PID/attr/smack/current

This occurs because do_setattr() imports
the provided label in advance,
before checking "relabel-self" list.

This change ensures that the "relabel-self" list
is checked before importing the label.

Fixes: 38416e5393 ("Smack: limited capability for changing process label")
Signed-off-by: Konstantin Andreev <andreev@swemel.ru>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

2026-01-19 13:09:22 +01:00

..

Kconfig

…

Makefile

…

smack_access.c

…

smack_lsm.c

smack: fix bug: unprivileged task can create labels

2026-01-19 13:09:22 +01:00

smack_netfilter.c

…

smack.h

…

smackfs.c

smack: recognize ipv4 CIPSO w/o categories

2025-06-04 14:38:02 +02:00