Re: [PATCH] fix security_release_secctx seems broken

2017-10-04 Thread James Morris
On Wed, 4 Oct 2017, Konstantin Khlebnikov wrote: > Just "getcap /bin/ping" is enough to tigger leak if file has capabilities. > Selinux shouldn't be loaded because its release_secctx hook call kfree. Ahh, makes sense. > > But sometimes it takes some time for kmemleak to find leak. Presumably >

Re: [PATCH] fix security_release_secctx seems broken

2017-10-04 Thread Konstantin Khlebnikov
On 04.10.2017 09:17, James Morris wrote: On Tue, 19 Sep 2017, Casey Schaufler wrote: Subject: [PATCH] fix security_release_secctx seems broken security_inode_getsecurity() provides the text string value of a security attribute. It does not provide a "secctx". The code in xattr_g

Re: [PATCH] fix security_release_secctx seems broken

2017-10-03 Thread James Morris
On Tue, 19 Sep 2017, Casey Schaufler wrote: > Subject: [PATCH] fix security_release_secctx seems broken > > security_inode_getsecurity() provides the text string value > of a security attribute. It does not provide a "secctx". > The code in xattr

Re: [PATCH] fix security_release_secctx seems broken

2017-09-20 Thread Konstantin Khlebnikov
On 19.09.2017 19:39, Casey Schaufler wrote: Subject: [PATCH] fix security_release_secctx seems broken security_inode_getsecurity() provides the text string value of a security attribute. It does not provide a "secctx". The code in xattr_getsecurity() that calls security_inode_getsecu

[PATCH] fix security_release_secctx seems broken

2017-09-19 Thread Casey Schaufler
Subject: [PATCH] fix security_release_secctx seems broken security_inode_getsecurity() provides the text string value of a security attribute. It does not provide a "secctx". The code in xattr_getsecurity() that calls security_inode_getsecurity() and then calls security_release_secctx(