From patchwork Mon Dec 7 21:21:15 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Seth Forshee X-Patchwork-Id: 7792891 Return-Path: X-Original-To: patchwork-selinux@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 68583BEEE1 for ; Mon, 7 Dec 2015 23:15:05 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id A3D8C20585 for ; Mon, 7 Dec 2015 23:15:04 +0000 (UTC) Received: from emvm-gh1-uea08.nsa.gov (emvm-gh1-uea08.nsa.gov [63.239.67.9]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 790C120576 for ; Mon, 7 Dec 2015 23:15:03 +0000 (UTC) X-TM-IMSS-Message-ID: <3eb30f3500029a55@nsa.gov> Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by nsa.gov ([10.208.42.193]) with ESMTP (TREND IMSS SMTP Service 7.1) id 3eb30f3500029a55 ; Mon, 7 Dec 2015 18:13:11 -0500 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id tB7ND2a1011227; Mon, 7 Dec 2015 18:13:05 -0500 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id tB7LPsCl263185 for ; Mon, 7 Dec 2015 16:25:54 -0500 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id tB7LOD6v001465 for ; Mon, 7 Dec 2015 16:25:54 -0500 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1CeBABD9WVW/6rfVdFeGQEBAQEPAQEBAYRLuxeEFoYOAoITAQEBAQEBhUABAQEDEhUZAQE3AQ9RNAEFARwGARIiiA2iR4ExPjGKV4VUAQWLdQEBAQEBAQEDAgEaBgqEOoIQjjiHTwWGUD2IBY8XhzYzkVw2gRdjggQNHYF1UwGFbgEBAQ X-IPAS-Result: A1CeBABD9WVW/6rfVdFeGQEBAQEPAQEBAYRLuxeEFoYOAoITAQEBAQEBhUABAQEDEhUZAQE3AQ9RNAEFARwGARIiiA2iR4ExPjGKV4VUAQWLdQEBAQEBAQEDAgEaBgqEOoIQjjiHTwWGUD2IBY8XhzYzkVw2gRdjggQNHYF1UwGFbgEBAQ X-IronPort-AV: E=Sophos;i="5.20,396,1444708800"; d="scan'208";a="5004901" Received: from emvm-gh1-uea08.nsa.gov ([10.208.42.193]) by goalie.tycho.ncsc.mil with ESMTP; 07 Dec 2015 16:23:26 -0500 X-TM-IMSS-Message-ID: <3e4e88770002801c@nsa.gov> Received: from mail-io0-f170.google.com (mail-io0-f170.google.com [209.85.223.170]) by nsa.gov ([10.208.42.193]) with ESMTP (TREND IMSS SMTP Service 7.1; TLSv1/SSLv3 AES128-SHA (128/128)) id 3e4e88770002801c ; Mon, 7 Dec 2015 16:23:23 -0500 Received: by iofh3 with SMTP id h3so3961414iof.3 for ; Mon, 07 Dec 2015 13:23:25 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=frunC1mLI8jp4dUjS6IRw492nG5EQ5tIehtDLhukJjE=; b=DZHDNJQB4WaoBBeO8gsmgJqzXILNvi60xUtI7LvyMNJtlf8Kk0mRdBkSemFkVvEZES NkvyF8C4NReWbNXPfIMgcP3Idhguktohe/LcNkfpx3GyAqZzCf/fJm/DlGarDNze4cTk pDHoIEFHFy58wVuCR4TAhwSt2waXem6saplTG6dZXp3n29zuxNS7y5Xkps3CYSr3vfur PQ19A2wnf8fNeeOftrxDG27G8gtTvG5Yml56D3p7C5GEKOLaWLRXRBl6Cd7m1Zaek35n CN3bjIzElilPuzy/7PWUm6U+GMTobYK+IbNrmNCAmfnPukiav+/lFy9nzd9PXSE+UEUs mUFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=frunC1mLI8jp4dUjS6IRw492nG5EQ5tIehtDLhukJjE=; b=MUerKkV+AeMwmvuEWntZbTXmezNoK2kJ4g9+/lkaR0+aN/KPw/XU+rT8JOKuc96Q0Y mg8aiBAzQsEhebjZ/XRF4HjOfULKhYgpWqJP7Q5w/RVJMj3mWsAOB+cbQL47F7PWyQc5 iPb9Ksa2PyhjOeZWdYEPocMS6WvnqGJMhyWGrzyJAt/zY1htlCxI7n782QSPWB6e9In7 QMHAhBmd9sLsd38I2TvDbUs3b94X89LTeGOJdeBsd0WfpNnKAQjHzoHTmG4byJi72wgZ OoFXi6yVSLUsg+lnpqnETaUoKiiALekIwU6yj8XjPdNzPuHDqWDAgqFkOE/I6VDfsDrC KaXw== X-Gm-Message-State: ALoCoQlhtlu29eiJrlwf43H4nWmdW5V2Nlv1BfJfj0hYdkaOxS86+aRAjFVO3BTPl0Uj90pnsfF4VGnd94bh/CidDm8/9bTxyQ== X-Received: by 10.107.166.82 with SMTP id p79mr474690ioe.187.1449523404998; Mon, 07 Dec 2015 13:23:24 -0800 (PST) Received: from localhost (199-87-125-144.dyn.kc.surewest.net. [199.87.125.144]) by smtp.gmail.com with ESMTPSA id 79sm216473ioh.19.2015.12.07.13.23.24 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Mon, 07 Dec 2015 13:23:24 -0800 (PST) From: Seth Forshee To: "Eric W. Biederman" , Casey Schaufler Subject: [PATCH v2 06/18] Smack: Handle labels consistently in untrusted mounts Date: Mon, 7 Dec 2015 15:21:15 -0600 Message-Id: <1449523289-144238-7-git-send-email-seth.forshee@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1449523289-144238-1-git-send-email-seth.forshee@canonical.com> References: <1449523289-144238-1-git-send-email-seth.forshee@canonical.com> X-TM-AS-MML: disable X-Mailman-Approved-At: Mon, 07 Dec 2015 16:44:28 -0500 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: Serge Hallyn , Seth Forshee , James Morris , dm-devel@redhat.com, Miklos Szeredi , Richard Weinberger , linux-security-module@vger.kernel.org, linux-bcache@vger.kernel.org, linux-kernel@vger.kernel.org, linux-raid@vger.kernel.org, fuse-devel@lists.sourceforge.net, Austin S Hemmelgarn , linux-mtd@lists.infradead.org, Alexander Viro , selinux@tycho.nsa.gov, linux-fsdevel@vger.kernel.org MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID,T_RP_MATCHES_RCVD,UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled differently in untrusted mounts. This is confusing and potentically problematic. Change this to handle them all the same way that SMACK64 is currently handled; that is, read the label from disk and check it at use time. For SMACK64 and SMACK64MMAP access is denied if the label does not match smk_root. To be consistent with suid, a SMACK64EXEC label which does not match smk_root will still allow execution of the file but will not run with the label supplied in the xattr. Signed-off-by: Seth Forshee Acked-by: Casey Schaufler --- security/smack/smack_lsm.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 16cac04214e2..0e555f64ded0 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -921,6 +921,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) struct inode *inode = file_inode(bprm->file); struct task_smack *bsp = bprm->cred->security; struct inode_smack *isp; + struct superblock_smack *sbsp; int rc; if (bprm->cred_prepared) @@ -930,6 +931,11 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task) return 0; + sbsp = inode->i_sb->s_security; + if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) && + isp->smk_task != sbsp->smk_root) + return 0; + if (bprm->unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) { struct task_struct *tracer; rc = 0; @@ -1733,6 +1739,7 @@ static int smack_mmap_file(struct file *file, struct task_smack *tsp; struct smack_known *okp; struct inode_smack *isp; + struct superblock_smack *sbsp; int may; int mmay; int tmay; @@ -1744,6 +1751,10 @@ static int smack_mmap_file(struct file *file, isp = file_inode(file)->i_security; if (isp->smk_mmap == NULL) return 0; + sbsp = file_inode(file)->i_sb->s_security; + if (sbsp->smk_flags & SMK_SB_UNTRUSTED && + isp->smk_mmap != sbsp->smk_root) + return -EACCES; mkp = isp->smk_mmap; tsp = current_security(); @@ -3532,16 +3543,14 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) if (rc >= 0) transflag = SMK_INODE_TRANSMUTE; } - if (!(sbsp->smk_flags & SMK_SB_UNTRUSTED)) { - /* - * Don't let the exec or mmap label be "*" or "@". - */ - skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); - if (IS_ERR(skp) || skp == &smack_known_star || - skp == &smack_known_web) - skp = NULL; - isp->smk_task = skp; - } + /* + * Don't let the exec or mmap label be "*" or "@". + */ + skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); + if (IS_ERR(skp) || skp == &smack_known_star || + skp == &smack_known_web) + skp = NULL; + isp->smk_task = skp; skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp); if (IS_ERR(skp) || skp == &smack_known_star ||