From: Christian Brauner Date: Mon, 1 Feb 2021 19:15:16 +0000 (+0100) Subject: lsm: harden read_file_at() X-Git-Tag: lxc-5.0.0~308^2~2 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=6fc8a0dd822843fc96738f2b3c1c59e1c77fcd50;p=thirdparty%2Flxc.git lsm: harden read_file_at() Signed-off-by: Christian Brauner --- diff --git a/src/lxc/lsm/apparmor.c b/src/lxc/lsm/apparmor.c index 369f7939d..fef503613 100644 --- a/src/lxc/lsm/apparmor.c +++ b/src/lxc/lsm/apparmor.c @@ -447,7 +447,7 @@ static char *apparmor_process_label_get_at(struct lsm_ops *ops, int fd_pid) __do_free char *label = NULL; size_t len; - label = read_file_at(fd_pid, "attr/current", PROTECT_OPEN, 0); + label = read_file_at(fd_pid, "attr/current", PROTECT_OPEN, PROTECT_LOOKUP_BENEATH); if (!label) return log_error_errno(NULL, errno, "Failed to get AppArmor context"); diff --git a/src/lxc/lsm/selinux.c b/src/lxc/lsm/selinux.c index 5ed99fb3e..e20a835fe 100644 --- a/src/lxc/lsm/selinux.c +++ b/src/lxc/lsm/selinux.c @@ -57,7 +57,7 @@ static char *selinux_process_label_get_at(struct lsm_ops *ops, int fd_pid) __do_free char *label = NULL; size_t len; - label = read_file_at(fd_pid, "attr/current", PROTECT_OPEN, 0); + label = read_file_at(fd_pid, "attr/current", PROTECT_OPEN, PROTECT_LOOKUP_BENEATH); if (!label) return log_error_errno(NULL, errno, "Failed to get SELinux context");