| Message ID | 20190829232935.7099-23-casey@schaufler-ca.com (mailing list archive) |
|---|---|
| State | Superseded |
| Headers | show |
| Series | LSM: Module stacking for AppArmor | expand |
On 8/29/19 7:29 PM, Casey Schaufler wrote: > Verify that the tasks on the ends of a binder transaction > use LSM display values that don't cause SELinux contexts > to be interpreted by another LSM or another LSM's context > to be interpreted by SELinux. No judgement is made in cases > that where SELinux contexts are not used in the binder > transaction. > > Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> > --- > include/linux/security.h | 1 + > security/selinux/hooks.c | 34 ++++++++++++++++++++++++++++++++++ > 2 files changed, 35 insertions(+) > > diff --git a/include/linux/security.h b/include/linux/security.h > index c16aea55be97..7fcc94ec8e04 100644 > --- a/include/linux/security.h > +++ b/include/linux/security.h > @@ -125,6 +125,7 @@ struct lsmblob { > u32 secid[LSMBLOB_ENTRIES]; > }; > > +#define LSMBLOB_FIRST 0 /* First valid LSM slot number */ > #define LSMBLOB_INVALID -1 /* Not a valid LSM slot number */ > #define LSMBLOB_NEEDED -2 /* Slot requested on initialization */ > #define LSMBLOB_NOT_NEEDED -3 /* Slot not requested */ > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 352be16a887d..2844f2ab7706 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -2009,6 +2009,28 @@ static inline u32 open_file_to_av(struct file *file) > return av; > } > > +/* > + * Verify that if the "display" LSM is SELinux for either task > + * that it is for both tasks. > + */ > +static inline bool compatible_task_displays(struct task_struct *here, > + struct task_struct *there) > +{ > + int h = lsm_task_display(here); > + int t = lsm_task_display(there); > + > + if (h == t) > + return true; > + > + /* unspecified is only ok if SELinux isn't going to be involved */ > + if (selinux_lsmid.slot == LSMBLOB_FIRST) > + return ((h == LSMBLOB_FIRST && t == LSMBLOB_INVALID) || > + (t == LSMBLOB_FIRST && h == LSMBLOB_INVALID)); > + > + /* it's ok only if neither display is SELinux */ > + return (h != selinux_lsmid.slot && t != selinux_lsmid.slot); > +} > + > /* Hook functions begin here. */ > > static int selinux_binder_set_context_mgr(struct task_struct *mgr) > @@ -2016,6 +2038,9 @@ static int selinux_binder_set_context_mgr(struct task_struct *mgr) > u32 mysid = current_sid(); > u32 mgrsid = task_sid(mgr); > > + if (!compatible_task_displays(current, mgr)) > + return -EINVAL; > + > return avc_has_perm(&selinux_state, > mysid, mgrsid, SECCLASS_BINDER, > BINDER__SET_CONTEXT_MGR, NULL); > @@ -2029,6 +2054,9 @@ static int selinux_binder_transaction(struct task_struct *from, > u32 tosid = task_sid(to); > int rc; > > + if (!compatible_task_displays(from, to)) > + return -EINVAL; > + > if (mysid != fromsid) { > rc = avc_has_perm(&selinux_state, > mysid, fromsid, SECCLASS_BINDER, > @@ -2048,6 +2076,9 @@ static int selinux_binder_transfer_binder(struct task_struct *from, > u32 fromsid = task_sid(from); > u32 tosid = task_sid(to); > > + if (!compatible_task_displays(from, to)) > + return -EINVAL; > + > return avc_has_perm(&selinux_state, > fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, > NULL); > @@ -2064,6 +2095,9 @@ static int selinux_binder_transfer_file(struct task_struct *from, > struct common_audit_data ad; > int rc; > > + if (!compatible_task_displays(from, to)) > + return -EINVAL; > + > ad.type = LSM_AUDIT_DATA_PATH; > ad.u.path = file->f_path; > > The only hook that approximates where/when you want to do this check is security_binder_transaction(), so you don't need to insert the check into the other hooks. Further, the check is only needed if the server has requested peer contexts, which is indicated by the flag bit target_node->txn_security_ctx, so if you amended the hook interface to also pass that flag value, then you could avoid the check except in that situation. As soon as any other LSM implements the binder hooks, it will also likely want an equivalent check, so sooner or later you'll probably want to take the logic to the framework and not just the security module.
diff --git a/include/linux/security.h b/include/linux/security.h index c16aea55be97..7fcc94ec8e04 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -125,6 +125,7 @@ struct lsmblob { u32 secid[LSMBLOB_ENTRIES]; }; +#define LSMBLOB_FIRST 0 /* First valid LSM slot number */ #define LSMBLOB_INVALID -1 /* Not a valid LSM slot number */ #define LSMBLOB_NEEDED -2 /* Slot requested on initialization */ #define LSMBLOB_NOT_NEEDED -3 /* Slot not requested */ diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 352be16a887d..2844f2ab7706 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -2009,6 +2009,28 @@ static inline u32 open_file_to_av(struct file *file) return av; } +/* + * Verify that if the "display" LSM is SELinux for either task + * that it is for both tasks. + */ +static inline bool compatible_task_displays(struct task_struct *here, + struct task_struct *there) +{ + int h = lsm_task_display(here); + int t = lsm_task_display(there); + + if (h == t) + return true; + + /* unspecified is only ok if SELinux isn't going to be involved */ + if (selinux_lsmid.slot == LSMBLOB_FIRST) + return ((h == LSMBLOB_FIRST && t == LSMBLOB_INVALID) || + (t == LSMBLOB_FIRST && h == LSMBLOB_INVALID)); + + /* it's ok only if neither display is SELinux */ + return (h != selinux_lsmid.slot && t != selinux_lsmid.slot); +} + /* Hook functions begin here. */ static int selinux_binder_set_context_mgr(struct task_struct *mgr) @@ -2016,6 +2038,9 @@ static int selinux_binder_set_context_mgr(struct task_struct *mgr) u32 mysid = current_sid(); u32 mgrsid = task_sid(mgr); + if (!compatible_task_displays(current, mgr)) + return -EINVAL; + return avc_has_perm(&selinux_state, mysid, mgrsid, SECCLASS_BINDER, BINDER__SET_CONTEXT_MGR, NULL); @@ -2029,6 +2054,9 @@ static int selinux_binder_transaction(struct task_struct *from, u32 tosid = task_sid(to); int rc; + if (!compatible_task_displays(from, to)) + return -EINVAL; + if (mysid != fromsid) { rc = avc_has_perm(&selinux_state, mysid, fromsid, SECCLASS_BINDER, @@ -2048,6 +2076,9 @@ static int selinux_binder_transfer_binder(struct task_struct *from, u32 fromsid = task_sid(from); u32 tosid = task_sid(to); + if (!compatible_task_displays(from, to)) + return -EINVAL; + return avc_has_perm(&selinux_state, fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, NULL); @@ -2064,6 +2095,9 @@ static int selinux_binder_transfer_file(struct task_struct *from, struct common_audit_data ad; int rc; + if (!compatible_task_displays(from, to)) + return -EINVAL; + ad.type = LSM_AUDIT_DATA_PATH; ad.u.path = file->f_path;
Verify that the tasks on the ends of a binder transaction use LSM display values that don't cause SELinux contexts to be interpreted by another LSM or another LSM's context to be interpreted by SELinux. No judgement is made in cases that where SELinux contexts are not used in the binder transaction. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- include/linux/security.h | 1 + security/selinux/hooks.c | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 35 insertions(+)