Re: [PATCH 11/39] selinux: reject writable opens of policy file, drop mmap shared/write check

[Lorenzo Stoakes (ARM)]

On Tue, Sep 08, 2026 at 10:22:20PM +0200, Jann Horn wrote:
> On Tue, Sep 8, 2026 at 10:07 PM Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx> wrote:
> > The policy file has no write method and is exposed read-only (S_IRUGO in
> > selinux_files[]), yet sel_open_policy() performs no open mode check, so a
> > CAP_DAC_OVERRIDE caller can open it O_RDWR. Reject FMODE_WRITE at open, as
> > kernfs does.
> >
> > The file can then never be mapped with FMODE_WRITE, so do_mmap() always
> > clears VM_MAYWRITE and VM_SHARED for MAP_SHARED mappings and the VM_SHARED
> > check in sel_mmap_policy() cannot be reached. Remove it.
>
> You should also be able to remove the sel_mmap_policy_ops.page_mkwrite
> handler, which is only for shared-writable faults, right?

Yeah I think you're right, though I wonder if it's a bit out of scope for this
change as it's focused on removing a VMA_MAYWRITE_BIT clearance for a
non-kernel-owned VMA.

So maybe one for a follow up?

>
> > This also stops sel_mmap_policy() clearing VM_MAYWRITE on a mapping that is
> > neither a PFN map nor a mixed map, ahead of the core enforcing that only
> > such mappings may do so.
> >
> > Signed-off-by: Lorenzo Stoakes (ARM) <ljs@xxxxxxxxxx>
>
> Reviewed-by: Jann Horn <jannh@xxxxxxxxxx>

Thanks!

--
Cheers, Lorenzo