Re: [PATCH v2] selinux: fix incorrect execmem checks on overlayfs

On Jul 14, 2026 Ondrej Mosnacek <[email protected]> wrote:
> 
> The commit fixing the overlayfs mmap() and mprotect() access checks
> failed to skip the execmem check in __file_map_prot_check() for the case
> where the "mounter check" is being performed. This check should be
> performed only against the credentials of the task that is calling
> mmap()/mprotect(), since it doesn't pertain to the file itself, but
> rather just gates the ability of the calling task to get an executable
> memory mapping in general.
> 
> The purpose of the "mounter check" is to guard against using an
> overlayfs mount to gain file access that would otherwise be denied to
> the mounter. For execmem this is not relevant, as there is no further
> file access granted based on it (notice that the file's context is not
> used as the target in the check), so checking it also against the
> mounter credentials would be incorrect.
> 
> Fix this by passing a boolean to [__]file_map_prot_check() and
> selinux_mmap_file_common() that indicates if we are doing the "mounter
> check" and skiping the execmem check in that case. Since this boolean
> also indicates if we use current_cred() or the mounter cred as the
> subject, also remove the "cred" argument from these functions and
> determine it based on the boolean and the file struct.
> 
> Fixes: 82544d36b172 ("selinux: fix overlayfs mmap() and mprotect() access checks")
> Signed-off-by: Ondrej Mosnacek <[email protected]>
> Reviewed-by: Stephen Smalley <[email protected]>
> ---
> v2: only access file->f_cred after checking file is not NULL
> 
>  security/selinux/hooks.c | 42 +++++++++++++++++++++++-----------------
>  1 file changed, 24 insertions(+), 18 deletions(-)

Thanks for the update, this looks good to me.  I'm going to merge it into
selinux/stable-7.2 now and send it up to Linus later assuming all goes
well.

--
paul-moore.com