Disallow writes to /sys/fs/selinux/user in non-init SELinux namespaces. Signed-off-by: Stephen Smalley --- security/selinux/selinuxfs.c | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index b1ce3a98a241..f847767e5e15 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -1371,10 +1371,20 @@ static ssize_t sel_write_user(struct file *file, char *buf, size_t size) int rc; u32 i, len, nsids; - pr_warn_ratelimited("SELinux: %s (%d) wrote to /sys/fs/selinux/user!" - " This will not be supported in the future; please update your" - " userspace.\n", current->comm, current->pid); - ssleep(5); + if (state == init_selinux_state) { + pr_warn_ratelimited("SELinux: %s (%d) wrote to" + " /sys/fs/selinux/user! This will not be" + " supported in the future; please update your" + " userspace.\n", current->comm, current->pid); + ssleep(5); + } else { + pr_warn_ratelimited("SELinux: %s (%d) tried to write to" + " /sys/fs/selinux/user! This is not supported" + " in non-init SELinux namespaces; please" + " update your userspace.\n", current->comm, + current->pid); + return -EPERM; + } /* * Only check against the current namespace because -- 2.50.1