Hi,

During a brief code review of selinux-lsm I noticed that in the function hooks.c:selinux_task_reparent_to_init() there is:

tsec = current->security;

I assume this code was copied from selinux_task_kmod_set_label(), but shouldn't it be 'tsec = p->security;' and act on p instead of current in this case ?

I didn't verify exploitability yet, but it may be possible to gain SECINITSID_INIT as a normal process this way, using a syscall that creates a kernel thread. (opening a loop blockdev comes to mind but I didn't verify it).

btw, can anyone explain how this dereferencing of current never caused a problem when selinux_task_reparent_to_init is called from somewhere taskless like usb hotplug ?

        Yoav Weiss

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.