Ondrej Mosnacek 4348d3b502 perf/core: Fix unconditional security_locked_down() call ... commit 08ef1af4de5fe7de9c6d69f1e22e51b66e385d9b upstream. Currently, the lockdown state is queried unconditionally, even though its result is used only if the PERF_SAMPLE_REGS_INTR bit is set in attr.sample_type. While that doesn't matter in case of the Lockdown LSM, it causes trouble with the SELinux's lockdown hook implementation. SELinux implements the locked_down hook with a check whether the current task's type has the corresponding "lockdown" class permission ("integrity" or "confidentiality") allowed in the policy. This means that calling the hook when the access control decision would be ignored generates a bogus permission check and audit record. Fix this by checking sample_type first and only calling the hook when its result would be honored. Fixes: b0c8fdc7fd ("lockdown: Lock down perf when in confidentiality mode") Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Reviewed-by: Paul Moore <paul@paul-moore.com> Link: https://lkml.kernel.org/r/20210224215628.192519-1-omosnace@redhat.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-05-07 11:04:33 +02:00
..
bpf	bpf: Fix leakage of uninitialized bpf stack under speculation	2021-05-07 11:04:31 +02:00
cgroup	cgroup-v1: add disabled controller check in cgroup1_parse_param()	2021-02-17 11:02:25 +01:00
configs
debug	kgdb: fix to kill breakpoints on initmem after boot	2021-03-04 11:38:46 +01:00
dma	swiotlb: respect min_align_mask	2021-05-07 11:04:32 +02:00
entry	x86/entry: Move nmi entry/exit into common code	2021-03-17 17:06:36 +01:00
events	perf/core: Fix unconditional security_locked_down() call	2021-05-07 11:04:33 +02:00
gcov	gcov: re-fix clang-11+ support	2021-04-14 08:41:58 +02:00
irq	genirq: Disable interrupts for force threaded handlers	2021-03-25 09:04:18 +01:00
kcsan	kcsan: Rewrite kcsan_prandom_u32_max() without prandom_u32_state()	2021-03-04 11:37:37 +01:00
livepatch	kernel/: fix repeated words in comments	2020-10-16 11:11:19 -07:00
locking	locking/qrwlock: Fix ordering in queued_write_lock_slowpath()	2021-04-28 13:40:00 +02:00
power	PM: EM: postpone creating the debugfs dir till fs_initcall	2021-03-30 14:32:04 +02:00
printk	printk: fix deadlock when kernel panic	2021-03-04 11:38:41 +01:00
rcu	rcu/nocb: Perform deferred wake up before last idle's need_resched() check	2021-03-04 11:38:35 +01:00
sched	sched/membarrier: fix missing local execution of ipi_sync_rq_state()	2021-03-17 17:06:35 +01:00
time	kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()	2021-03-25 09:04:16 +01:00
trace	ftrace: Check if pages were allocated before calling free_pages()	2021-04-16 11:43:20 +02:00
.gitignore
acct.c	kernel: acct.c: fix some kernel-doc nits	2020-10-16 11:11:19 -07:00
async.c
audit_fsnotify.c	fsnotify: generalize handle_inode_event()	2020-12-30 11:54:18 +01:00
audit_tree.c	fsnotify: generalize handle_inode_event()	2020-12-30 11:54:18 +01:00
audit_watch.c	fsnotify: generalize handle_inode_event()	2020-12-30 11:54:18 +01:00
audit.c
audit.h
auditfilter.c
auditsc.c
backtracetest.c
bounds.c
capability.c	LSM: Signal to SafeSetID when setting group IDs	2020-10-13 09:17:34 -07:00
compat.c
configs.c
context_tracking.c
cpu_pm.c
cpu.c	kernel/cpu: add arch override for clear_tasks_mm_cpumask() mm handling	2020-11-27 00:10:39 +11:00
crash_core.c
crash_dump.c
cred.c
delayacct.c
dma.c
exec_domain.c
exit.c	kernel/io_uring: cancel io_uring before task works	2021-01-30 13:55:18 +01:00
extable.c
fail_function.c	fail_function: Remove a redundant mutex unlock	2020-11-19 11:58:16 -08:00
fork.c	mm/fork: clear PASID for new mm	2021-03-30 14:31:52 +02:00
freezer.c	Revert "kernel: freezer should treat PF_IO_WORKER like PF_KTHREAD for freezing"	2021-04-07 15:00:14 +02:00
futex.c	kernel, fs: Introduce and use set_restart_fn() and arch_set_restart_data()	2021-03-25 09:04:16 +01:00
gen_kheaders.sh
groups.c	LSM: Signal to SafeSetID when setting group IDs	2020-10-13 09:17:34 -07:00
hung_task.c	kernel/hung_task.c: make type annotations consistent	2020-11-02 12:14:19 -08:00
iomem.c
irq_work.c
jump_label.c	static_call: Fix static_call_update() sanity check	2021-03-25 09:04:18 +01:00
kallsyms.c	treewide: Convert macro and uses of __section(foo) to __section("foo")	2020-10-25 14:51:49 -07:00
kcmp.c	exec: Transform exec_update_mutex into a rw_semaphore	2021-01-09 13:46:24 +01:00
Kconfig.freezer
Kconfig.hz
Kconfig.locks
Kconfig.preempt
kcov.c
kexec_core.c	kernel: kexec: remove the lock operation of system_transition_mutex	2021-02-03 23:28:37 +01:00
kexec_elf.c
kexec_file.c	ima: Free IMA measurement buffer after kexec syscall	2021-03-04 11:37:50 +01:00
kexec_internal.h
kexec.c	LSM: Introduce kernel_post_load_data() hook	2020-10-05 13:37:03 +02:00
kheaders.c
kmod.c
kprobes.c	kprobes: Fix to delay the kprobes jump optimization	2021-03-04 11:38:35 +01:00
ksysfs.c
kthread.c	kthread: Extract KTHREAD_IS_PER_CPU	2021-02-07 15:37:17 +01:00
latencytop.c
Makefile	kcmp: Support selection of SYS_kcmp without CHECKPOINT_RESTORE	2021-03-04 11:38:41 +01:00
module_signature.c	module: harden ELF info handling	2021-03-25 09:04:11 +01:00
module_signing.c	module: harden ELF info handling	2021-03-25 09:04:11 +01:00
module-internal.h
module.c	module: harden ELF info handling	2021-03-25 09:04:11 +01:00
notifier.c
nsproxy.c
padata.c
panic.c	panic: don't dump stack twice on warn	2020-11-14 11:26:04 -08:00
params.c	params: Replace zero-length array with flexible-array member	2020-10-29 17:22:59 -05:00
pid_namespace.c	kernel/: fix repeated words in comments	2020-10-16 11:11:19 -07:00
pid.c	exec: Transform exec_update_mutex into a rw_semaphore	2021-01-09 13:46:24 +01:00
profile.c
ptrace.c	ptrace: Set PF_SUPERPRIV when checking capability	2020-11-17 12:53:22 -08:00
range.c	kernel.h: split out min()/max() et al. helpers	2020-10-16 11:11:19 -07:00
reboot.c	reboot: fix overflow parsing reboot cpu number	2020-11-14 11:26:03 -08:00
regset.c
relay.c	kernel/relay.c: drop unneeded initialization	2020-10-16 11:11:22 -07:00
resource.c	kernel/resource: make iomem_resource implicit in release_mem_region_adjustable()	2020-10-16 11:11:18 -07:00
rseq.c
scftorture.c
scs.c
seccomp.c	seccomp: Add missing return in non-void function	2021-03-04 11:38:32 +01:00
signal.c	ptrace: fix task_join_group_stop() for the case when current is traced	2020-11-02 12:14:19 -08:00
smp.c	smp: Process pending softirqs in flush_smp_call_function_from_idle()	2021-03-04 11:37:51 +01:00
smpboot.c	kthread: Extract KTHREAD_IS_PER_CPU	2021-02-07 15:37:17 +01:00
smpboot.h
softirq.c
stackleak.c
stacktrace.c
static_call.c	static_call: Align static_call_is_init() patching condition	2021-04-07 15:00:06 +02:00
stop_machine.c	stop_machine, rcu: Mark functions as notrace	2020-10-26 12:12:27 +01:00
sys_ni.c	mm/madvise: introduce process_madvise() syscall: an external memory hinting API	2020-10-18 09:27:10 -07:00
sys.c	kernel/sys.c: fix prototype of prctl_get_tid_address()	2020-10-25 11:44:16 -07:00
sysctl-test.c
sysctl.c	sysctl.c: fix underflow value setting risk in vm_table	2021-03-17 17:06:25 +01:00
task_work.c	task_work: cleanup notification modes	2020-10-17 15:05:30 -06:00
taskstats.c	taskstats: move specifying netlink policy back to ops	2020-10-02 19:11:12 -07:00
test_kprobes.c
torture.c
tracepoint.c	tracepoint: Do not fail unregistering a probe due to memory failure	2021-03-04 11:38:03 +01:00
tsacct.c
ucount.c
uid16.c
uid16.h
umh.c	usermodehelper: reset umask to default before executing user process	2020-10-06 10:31:52 -07:00
up.c
user_namespace.c	capabilities: require CAP_SETFCAP to map uid 0	2021-05-07 11:04:31 +02:00
user-return-notifier.c
user.c
usermode_driver.c	bpf: Fix umd memory leak in copy_process()	2021-03-30 14:32:03 +02:00
utsname_sysctl.c
utsname.c
watch_queue.c
watchdog_hld.c
watchdog.c	kernel/watchdog: fix watchdog_allowed_mask not used warning	2020-11-14 11:26:03 -08:00
workqueue_internal.h
workqueue.c	workqueue: Move the position of debug_work_activate() in __queue_work()	2021-04-14 08:42:10 +02:00