Merge tag 'lsm-pr-20260519' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm

e312f536 · Linus Torvalds <[email protected]> · 2026-05-19 15:31:35 -05:00

Pull lsm fix from Paul Moore:
 "A single LSM patch to add a missing credential mutex lock to the
  lsm_set_self_attr(2) syscall so it behaves similar to the associated
  procfs API and avoids issues with ptrace"

* tag 'lsm-pr-20260519' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
  lsm: hold cred_guard_mutex for lsm_set_self_attr()

Commit: e312f536f647156ac55e2f12d021cf887af274aa
Parents: 27fa8262 · 4a9b1654

Merge commit. Changes below are compared with the first parent: 27fa8262.

Changes

1 files changed · +8 −1

File	Status	Add	Del	Content
security/lsm_syscalls.c	modified	+8	−1	View file

security/lsm_syscalls.c

View file

diff --git a/security/lsm_syscalls.c b/security/lsm_syscalls.c
index 5648b1f..08a0176 100644
--- a/security/lsm_syscalls.c
+++ b/security/lsm_syscalls.c
@@ -57,7 +57,14 @@ u64 lsm_name_to_attr(const char *name)
 SYSCALL_DEFINE4(lsm_set_self_attr, unsigned int, attr, struct lsm_ctx __user *,
 		ctx, u32, size, u32, flags)
 {
-	return security_setselfattr(attr, ctx, size, flags);
+	int rc;
+
+	rc = mutex_lock_interruptible(&current->signal->cred_guard_mutex);
+	if (rc < 0)
+		return rc;
+	rc = security_setselfattr(attr, ctx, size, flags);
+	mutex_unlock(&current->signal->cred_guard_mutex);
+	return rc;
 }
 
 /**