From patchwork Thu Nov 10 10:47:49 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Himanshu Shukla X-Patchwork-Id: 9420923 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id A5D3960484 for ; Thu, 10 Nov 2016 10:51:46 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9E36629637 for ; Thu, 10 Nov 2016 10:51:46 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 9324C29639; Thu, 10 Nov 2016 10:51:46 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id EFE8929637 for ; Thu, 10 Nov 2016 10:51:45 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754806AbcKJKvo (ORCPT ); Thu, 10 Nov 2016 05:51:44 -0500 Received: from mailout3.samsung.com ([203.254.224.33]:40558 "EHLO mailout3.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752771AbcKJKvm (ORCPT ); Thu, 10 Nov 2016 05:51:42 -0500 Received: from epcpsbgm1new.samsung.com (epcpsbgm1 [203.254.230.26]) by mailout3.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTP id <0OGF0081PA64EE50@mailout3.samsung.com> for linux-security-module@vger.kernel.org; Thu, 10 Nov 2016 19:51:40 +0900 (KST) X-AuditID: cbfee61a-f79916d0000062de-99-5824513c4ec8 Received: from epmmp2 ( [203.254.227.17]) by epcpsbgm1new.samsung.com (EPCPMTA) with SMTP id B5.83.25310.C3154285; Thu, 10 Nov 2016 19:51:40 +0900 (KST) Received: from localhost.localdomain ([107.108.92.210]) by mmp2.samsung.com (Oracle Communications Messaging Server 7.0.5.31.0 64bit (built May 5 2014)) with ESMTPA id <0OGF00B76A5Z0F00@mmp2.samsung.com>; Thu, 10 Nov 2016 19:51:40 +0900 (KST) From: Himanshu Shukla To: casey@schaufler-ca.com, linux-security-module@vger.kernel.org Cc: himanshu.sh@samsung.com Subject: [PATCH] SMACK: Do not apply star label in smack_setprocattr hook Date: Thu, 10 Nov 2016 16:17:49 +0530 Message-id: <1478774869-4738-1-git-send-email-himanshu.sh@samsung.com> X-Mailer: git-send-email 1.9.1 X-Brightmail-Tracker: H4sIAAAAAAAAA+NgFtrKLMWRmVeSWpSXmKPExsVy+t9jQV2bQJUIgz8vNCzubfvFZrH3SQur xYeeR2wOzB59W1Yxehzdv4jN4/MmuQDmKDebjNTElNQihdS85PyUzLx0W6XQEDddCyWFvMTc VFulCF3fkCAlhbLEnFIgz8gADTg4B7gHK+nbJbhlPGk+wV7wibPi8IM/rA2MLRxdjJwcEgIm Ej++LmeCsMUkLtxbzwZiCwnMYpQ4eiiwi5ELyP7JKPFw0gdGkASbgL5ES8cksCIRAUeJxlMg zRwczALSEl/n2oKEhQU8JTY8mMEKYrMIqErs+7AXbD6vgJvEoxedULvkJE4em8w6gZF7ASPD KkaJ1ILkguKk9FzDvNRyveLE3OLSvHS95PzcTYzgIHsmtYPx4C73Q4wCHIxKPLwdmsoRQqyJ ZcWVuYcYJTiYlUR4HfxVIoR4UxIrq1KL8uOLSnNSiw8xmgIdMJFZSjQ5HxgBeSXxhibmJubG BhbmlpYmRkrivI2zn4ULCaQnlqRmp6YWpBbB9DFxcEo1MKao3xUzN9jvuynubU1Gs2l/TC7r J9dpRxec2Tb7LsuXEw2T9vMw/WgIT888L6ve8iAs3DmyvuDvpW+WR+K7lz+7/G0n47NVszXq H85ZapOWPOv+O37mPZO4dnfKvhN8+PHPqi2+yY4c3A07vvoffuS6Zq81N9PDvWKvPlocr3CY HGEg33u+SEuJpTgj0VCLuag4EQAovytNSAIAAA== X-MTR: 20000000000000000@CPGS Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Smack prohibits processes from using the star ("*") and web ("@") labels. Checks have been added in other functions. In smack_setprocattr() hook, only check for web ("@") label has been added and restricted from applying web ("@") label. Check for star ("*") label should also be added in smack_setprocattr() hook. Return error should be "-EINVAL" not "-EPERM" as permission is there for setting label but not the label value as star ("*") or web ("@"). Signed-off-by: Himanshu Shukla Acked-by: Casey Schaufler --- security/smack/smack_lsm.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 1cb0602..a72ab3e 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -3661,10 +3661,11 @@ static int smack_setprocattr(struct task_struct *p, char *name, return PTR_ERR(skp); /* - * No process is ever allowed the web ("@") label. + * No process is ever allowed the web ("@") label + * and the star ("*") label. */ - if (skp == &smack_known_web) - return -EPERM; + if (skp == &smack_known_web || skp == &smack_known_star) + return -EINVAL; if (!smack_privileged(CAP_MAC_ADMIN)) { rc = -EPERM;