diff options
| author | Hamza Mahfooz <hamzamahfooz@linux.microsoft.com> | 2025-01-27 10:57:18 -0500 |
|---|---|---|
| committer | Paul Moore <paul@paul-moore.com> | 2025-02-07 17:17:49 -0500 |
| commit | c6ad9fdbd44b78f51fa50138247694774ab99e97 (patch) | |
| tree | e28a1056a83be8177af5db7c75959d431267bd1c /io_uring/io_uring.c | |
| parent | b8a468e0b0604a10e72ab7f55af0f931aac1d477 (diff) | |
io_uring,lsm,selinux: add LSM hooks for io_uring_setup()
It is desirable to allow LSM to configure accessibility to io_uring
because it is a coarse yet very simple way to restrict access to it. So,
add an LSM for io_uring_allowed() to guard access to io_uring.
Cc: Paul Moore <paul@paul-moore.com>
Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
Acked-by: Jens Axboe <axboe@kernel.dk>
[PM: merge fuzz due to changes in preceding patches, subj tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'io_uring/io_uring.c')
| -rw-r--r-- | io_uring/io_uring.c | 5 |
1 files changed, 3 insertions, 2 deletions
diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c index 7e68a613f5dc..520547b6c69c 100644 --- a/io_uring/io_uring.c +++ b/io_uring/io_uring.c @@ -3800,7 +3800,7 @@ static inline int io_uring_allowed(void) return -EPERM; if (disabled == 0 || capable(CAP_SYS_ADMIN)) - return 0; + goto allowed_lsm; io_uring_group = make_kgid(&init_user_ns, sysctl_io_uring_group); if (!gid_valid(io_uring_group)) @@ -3809,7 +3809,8 @@ static inline int io_uring_allowed(void) if (!in_group_p(io_uring_group)) return -EPERM; - return 0; +allowed_lsm: + return security_uring_allowed(); } SYSCALL_DEFINE2(io_uring_setup, u32, entries, |