[lkml]   [2020]   [Feb]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 5.5 108/120] selinux: fix regression introduced by move_mount(2) syscall
From: Stephen Smalley <>

commit 98aa00345de54b8340dc2ddcd87f446d33387b5e upstream.

commit 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around")
introduced a new move_mount(2) system call and a corresponding new LSM
security_move_mount hook but did not implement this hook for any existing
LSM. This creates a regression for SELinux with respect to consistent
checking of mounts; the existing selinux_mount hook checks mounton
permission to the mount point path. Provide a SELinux hook
implementation for move_mount that applies this same check for
consistency. In the future we may wish to add a new move_mount
filesystem permission and check as well, but this addresses
the immediate regression.

Fixes: 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around")
Signed-off-by: Stephen Smalley <>
Reviewed-by: Ondrej Mosnacek <>
Signed-off-by: Paul Moore <>
Signed-off-by: Greg Kroah-Hartman <>

security/selinux/hooks.c | 10 ++++++++++
1 file changed, 10 insertions(+)

--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2762,6 +2762,14 @@ static int selinux_mount(const char *dev
return path_has_perm(cred, path, FILE__MOUNTON);

+static int selinux_move_mount(const struct path *from_path,
+ const struct path *to_path)
+ const struct cred *cred = current_cred();
+ return path_has_perm(cred, to_path, FILE__MOUNTON);
static int selinux_umount(struct vfsmount *mnt, int flags)
const struct cred *cred = current_cred();
@@ -6904,6 +6912,8 @@ static struct security_hook_list selinux
LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),

+ LSM_HOOK_INIT(move_mount, selinux_move_mount),
LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),

 \ /
  Last update: 2020-02-13 16:39    [W:0.367 / U:23.208 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site