From patchwork Tue Apr 26 19:36:22 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Seth Forshee X-Patchwork-Id: 8943461 Return-Path: X-Original-To: patchwork-linux-fsdevel@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 281089F1D3 for ; Tue, 26 Apr 2016 19:37:12 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 24E922013D for ; Tue, 26 Apr 2016 19:37:11 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A6695201EF for ; Tue, 26 Apr 2016 19:37:09 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752745AbcDZThG (ORCPT ); Tue, 26 Apr 2016 15:37:06 -0400 Received: from mail-ig0-f176.google.com ([209.85.213.176]:35319 "EHLO mail-ig0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752643AbcDZThA (ORCPT ); Tue, 26 Apr 2016 15:37:00 -0400 Received: by mail-ig0-f176.google.com with SMTP id bi2so107337649igb.0 for ; Tue, 26 Apr 2016 12:37:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=aeG73OW9Xy1CAYW4s8YPsK1DWTEX4M6k8ROnPiImiQM=; b=dJVxu8CvR2IOnLiMj+nVhBBC3n8eJq/E/4Y+nwv8uyMy2EYW4Hs1l1Fw4IqD9NtpV/ ARLRjLtZ6VjapiRvzdMChXO0glLFF6hR5Z6weArYdRmZSaG18ZKObaCBVKwxSf6RPmIu 4iH+xXI0RDmJSWFko93KB2GD3dpkCmn0oUKjAPYQKO3BtcsY62/Y0a4rbKSMppqOSRIj mabfPjmUdAGnqEkTvIlZ3/yyPBCEgEmrBNE2cknP40OefG9Eu1kuvcw5OrhrxFR+fQK2 N6b533hcp8qAZDyMDMS8ytioZnfDxvvqhPT5M/xsmiIfW6jO1e58XFNczXqc2f77yD+g Im2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=aeG73OW9Xy1CAYW4s8YPsK1DWTEX4M6k8ROnPiImiQM=; b=ltcBepRjqCFnFg/K37yODT/LQLhqyVKPqx/fJ8ABByKEDJf+jrrJ7dvxev9qYjzrr2 f9adQPzIeVmQL8iZQEmYaWjuo4HVowuvHgOrKtB5YkhtPkwNcmIQX7zmJng733VbtnFt FK+L1Vs7RZUUpN95TcFX2t5CLIl2J4T21+ZzC595ZxoIx0e8TKDosqxBVtYkfootDK0V /gPpbcMAKkRELmF5lUqaA+12Orx7nxvo8m2XkGgDEnH6cnLxUh7dmlJPCuYzHkAJWFlw VP4kprVNdLr6lTrx8OZ3wC+kMUsRrHMlkYJPJBXiwJ6DEq3Yp74M4/OvsHPGJ5UP8hDn c10w== X-Gm-Message-State: AOPr4FXh8zw59KiZ6VKOKFBR0KM73GVyyj/hsx50XqUxi7iG1e9FnvAzEpvgXdlkReIv3KaR X-Received: by 10.50.90.193 with SMTP id by1mr6096716igb.53.1461699419567; Tue, 26 Apr 2016 12:36:59 -0700 (PDT) Received: from localhost ([2605:a601:aab:f920:39a1:5bcf:aa:5b00]) by smtp.gmail.com with ESMTPSA id uh3sm2375581igb.3.2016.04.26.12.36.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 26 Apr 2016 12:36:58 -0700 (PDT) From: Seth Forshee To: "Eric W. Biederman" , Casey Schaufler Cc: Alexander Viro , Serge Hallyn , Richard Weinberger , Austin S Hemmelgarn , Miklos Szeredi , Pavel Tikhomirov , linux-kernel@vger.kernel.org, linux-bcache@vger.kernel.org, dm-devel@redhat.com, linux-raid@vger.kernel.org, linux-mtd@lists.infradead.org, linux-fsdevel@vger.kernel.org, fuse-devel@lists.sourceforge.net, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, cgroups@vger.kernel.org, Seth Forshee , James Morris , "Serge E. Hallyn" Subject: [PATCH v4 09/21] Smack: Handle labels consistently in untrusted mounts Date: Tue, 26 Apr 2016 14:36:22 -0500 Message-Id: <1461699396-33000-10-git-send-email-seth.forshee@canonical.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1461699396-33000-1-git-send-email-seth.forshee@canonical.com> References: <1461699396-33000-1-git-send-email-seth.forshee@canonical.com> Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org X-Spam-Status: No, score=-7.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled differently in untrusted mounts. This is confusing and potentically problematic. Change this to handle them all the same way that SMACK64 is currently handled; that is, read the label from disk and check it at use time. For SMACK64 and SMACK64MMAP access is denied if the label does not match smk_root. To be consistent with suid, a SMACK64EXEC label which does not match smk_root will still allow execution of the file but will not run with the label supplied in the xattr. Signed-off-by: Seth Forshee Acked-by: Casey Schaufler --- security/smack/smack_lsm.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index aa17198cd5f2..ca564590cc1b 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -919,6 +919,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) struct inode *inode = file_inode(bprm->file); struct task_smack *bsp = bprm->cred->security; struct inode_smack *isp; + struct superblock_smack *sbsp; int rc; if (bprm->cred_prepared) @@ -928,6 +929,11 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task) return 0; + sbsp = inode->i_sb->s_security; + if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) && + isp->smk_task != sbsp->smk_root) + return 0; + if (bprm->unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) { struct task_struct *tracer; rc = 0; @@ -1725,6 +1731,7 @@ static int smack_mmap_file(struct file *file, struct task_smack *tsp; struct smack_known *okp; struct inode_smack *isp; + struct superblock_smack *sbsp; int may; int mmay; int tmay; @@ -1736,6 +1743,10 @@ static int smack_mmap_file(struct file *file, isp = file_inode(file)->i_security; if (isp->smk_mmap == NULL) return 0; + sbsp = file_inode(file)->i_sb->s_security; + if (sbsp->smk_flags & SMK_SB_UNTRUSTED && + isp->smk_mmap != sbsp->smk_root) + return -EACCES; mkp = isp->smk_mmap; tsp = current_security(); @@ -3546,16 +3557,14 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) if (rc >= 0) transflag = SMK_INODE_TRANSMUTE; } - if (!(sbsp->smk_flags & SMK_SB_UNTRUSTED)) { - /* - * Don't let the exec or mmap label be "*" or "@". - */ - skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); - if (IS_ERR(skp) || skp == &smack_known_star || - skp == &smack_known_web) - skp = NULL; - isp->smk_task = skp; - } + /* + * Don't let the exec or mmap label be "*" or "@". + */ + skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); + if (IS_ERR(skp) || skp == &smack_known_star || + skp == &smack_known_web) + skp = NULL; + isp->smk_task = skp; skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp); if (IS_ERR(skp) || skp == &smack_known_star ||