diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2015-07-11 17:38:10 (GMT) |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2015-07-11 17:38:10 (GMT) |
commit | 2278cb0bb3a177d3a3ef0bd332916180cb2f2121 (patch) | |
tree | 8c2ded2376de8aaa9640ca74c07653508064e097 | |
parent | 31b7a57c9eb3d90c87b6c2b855720ec709d2f6be (diff) | |
parent | 3dbbbe0eb6e949409d215f660cfad782aa541a4b (diff) | |
download | linux-2278cb0bb3a177d3a3ef0bd332916180cb2f2121.tar.xz |
Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
Pull selinux fixes from James Morris.
* 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
selinux: fix mprotect PROT_EXEC regression caused by mm change
selinux: don't waste ebitmap space when importing NetLabel categories
-rw-r--r-- | security/selinux/hooks.c | 3 | ||||
-rw-r--r-- | security/selinux/ss/ebitmap.c | 6 |
2 files changed, 8 insertions, 1 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 6231081..564079c 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3283,7 +3283,8 @@ static int file_map_prot_check(struct file *file, unsigned long prot, int shared int rc = 0; if (default_noexec && - (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) { + (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) || + (!shared && (prot & PROT_WRITE)))) { /* * We are making executable an anonymous mapping or a * private file mapping that will also be writable. diff --git a/security/selinux/ss/ebitmap.c b/security/selinux/ss/ebitmap.c index afe6a26..57644b1 100644 --- a/security/selinux/ss/ebitmap.c +++ b/security/selinux/ss/ebitmap.c @@ -153,6 +153,12 @@ int ebitmap_netlbl_import(struct ebitmap *ebmap, if (offset == (u32)-1) return 0; + /* don't waste ebitmap space if the netlabel bitmap is empty */ + if (bitmap == 0) { + offset += EBITMAP_UNIT_SIZE; + continue; + } + if (e_iter == NULL || offset >= e_iter->startbit + EBITMAP_SIZE) { e_prev = e_iter; |