From patchwork Tue Nov 17 16:39:10 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Seth Forshee X-Patchwork-Id: 7640081 Return-Path: X-Original-To: patchwork-selinux@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id 9F9969F392 for ; Tue, 17 Nov 2015 17:25:29 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id E277A20503 for ; Tue, 17 Nov 2015 17:25:28 +0000 (UTC) Received: from emvm-gh1-uea08.nsa.gov (emvm-gh1-uea08.nsa.gov [63.239.67.9]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id B132C204EC for ; Tue, 17 Nov 2015 17:25:27 +0000 (UTC) X-TM-IMSS-Message-ID: <325846f60005559e@nsa.gov> Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by nsa.gov ([63.239.67.9]) with ESMTP (TREND IMSS SMTP Service 7.1) id 325846f60005559e ; Tue, 17 Nov 2015 12:22:40 -0500 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id tAHHMOrl010272; Tue, 17 Nov 2015 12:22:27 -0500 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id tAHGeLxH018627 for ; Tue, 17 Nov 2015 11:40:21 -0500 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id tAHGeCpo005521 for ; Tue, 17 Nov 2015 11:40:21 -0500 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1AvBQCOVktW/7LfVdFeGQEBAQEPAQEBAYMLgUK8R4QNhg8CgVBMAQEBAQEBhUABAQEDEhUZAQE3AQ9RNAEFARwGARIiiAwFngiBMT4xileFVAEFi08BAQEBAQEBAwIBGgYKhDqCEI43h0QFhk08h3yPBocyM5E4NoEXY4IEDR2BdVMBhQkBAQE X-IPAS-Result: A1AvBQCOVktW/7LfVdFeGQEBAQEPAQEBAYMLgUK8R4QNhg8CgVBMAQEBAQEBhUABAQEDEhUZAQE3AQ9RNAEFARwGARIiiAwFngiBMT4xileFVAEFi08BAQEBAQEBAwIBGgYKhDqCEI43h0QFhk08h3yPBocyM5E4NoEXY4IEDR2BdVMBhQkBAQE X-IronPort-AV: E=Sophos;i="5.20,308,1444708800"; d="scan'208";a="4940875" Received: from emvm-gh1-uea08.nsa.gov ([63.239.67.9]) by goalie.tycho.ncsc.mil with ESMTP; 17 Nov 2015 11:40:15 -0500 X-TM-IMSS-Message-ID: <323163a9000547c6@nsa.gov> Received: from mail-io0-f178.google.com (mail-io0-f178.google.com [209.85.223.178]) by nsa.gov ([63.239.67.9]) with ESMTP (TREND IMSS SMTP Service 7.1; TLSv1/SSLv3 AES128-SHA (128/128)) id 323163a9000547c6 ; Tue, 17 Nov 2015 11:40:12 -0500 Received: by ioir85 with SMTP id r85so24353516ioi.1 for ; Tue, 17 Nov 2015 08:40:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical_com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=Amu3/+eFuRXQvhlOFh5FdtHR2vhFSXVVUy1dumlNPkE=; b=vzL1hGeIT/+VOSluA4aP7XouPsYLkMM3Tw9a7ag6zmrgLqbIDAVCVGhhfEZi8BQYy/ kWjidFS0IZTZobrswPN9IBakUCj7HSy7HQB0/kYBf2o5PNTEXT1pMUHcCcywgxLJMcVk 8tWsjwjLfzMy+NoviCcVdGnlMwagJY461OwZp/osuUFdWMzNCU+Kb49EJ1aaRUATDGqS ldh05fBxaBkDzZ3HqyU/FdZVRH5IGzvUVT//1ppqhulpwhiAUoJiFK8l/MsMJ0WfS3fm RqAADTcssUsVUy+Sp60rvPemP12sqVDw2uO1kMSwrom1M25hZkC527nNg+t8I6x3khwu NXGg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=Amu3/+eFuRXQvhlOFh5FdtHR2vhFSXVVUy1dumlNPkE=; b=JqnGr7Y1nE4lYVmGrunQaZy/lTv2mPmHxkruWie9WxMKot9hrVWIepQX87obhz4or5 z4eeuyDWK8lfxFsGiL99rEG0AhVavlcI97LkdPPynI6o6M6NmSMmUg4/xZUCQnTu3KOz pATVID7FfTrr+KulgmGzMZVOCyE9q3HBBEBIkbyiYtwBr7nFyVGHhy4dKSIdXHvI8xm9 0fO8FCVXpN1BFNFEne2D5Q0VFQHN7koX+kMbBvTrTBwjiUVisWBUiWbGpPe7DTewz7c6 zA7nDjuxJo8tvdGdQ3VFFQ0QByZ65vQMP5JSguzceP12CQT4I9qLSQuAR499nTAAz+6u FDbg== X-Gm-Message-State: ALoCoQkslOWgEE8pIEa6JXf8T946Og9bDVRd/Rj8r/eNk//kHygGOPXs8fJlgJflCCo/BrhRDB8W X-Received: by 10.107.19.12 with SMTP id b12mr44773124ioj.11.1447778413468; Tue, 17 Nov 2015 08:40:13 -0800 (PST) Received: from localhost (199-87-125-144.dyn.kc.surewest.net. [199.87.125.144]) by smtp.gmail.com with ESMTPSA id n9sm8336255ige.16.2015.11.17.08.40.12 (version=TLSv1.2 cipher=RC4-SHA bits=128/128); Tue, 17 Nov 2015 08:40:12 -0800 (PST) From: Seth Forshee To: "Eric W. Biederman" , Casey Schaufler Subject: [PATCH v3 7/7] Smack: Handle labels consistently in untrusted mounts Date: Tue, 17 Nov 2015 10:39:10 -0600 Message-Id: <1447778351-118699-8-git-send-email-seth.forshee@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1447778351-118699-1-git-send-email-seth.forshee@canonical.com> References: <1447778351-118699-1-git-send-email-seth.forshee@canonical.com> X-TM-AS-MML: disable X-Mailman-Approved-At: Tue, 17 Nov 2015 12:08:01 -0500 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: Serge Hallyn , James Morris , linux-security-module@vger.kernel.org, dm-devel@redhat.com, linux-kernel@vger.kernel.org, linux-raid@vger.kernel.org, Seth Forshee , linux-bcache@vger.kernel.org, linux-mtd@lists.infradead.org, Alexander Viro , selinux@tycho.nsa.gov, linux-fsdevel@vger.kernel.org, Andy Lutomirski MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Spam-Status: No, score=-7.4 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled differently in untrusted mounts. This is confusing and potentically problematic. Change this to handle them all the same way that SMACK64 is currently handled; that is, read the label from disk and check it at use time. For SMACK64 and SMACK64MMAP access is denied if the label does not match smk_root. To be consistent with suid, a SMACK64EXEC label which does not match smk_root will still allow execution of the file but will not run with the label supplied in the xattr. Signed-off-by: Seth Forshee Acked-by: Casey Schaufler --- security/smack/smack_lsm.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 621200f86b56..9b7ff781df9a 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -891,6 +891,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) struct inode *inode = file_inode(bprm->file); struct task_smack *bsp = bprm->cred->security; struct inode_smack *isp; + struct superblock_smack *sbsp; int rc; if (bprm->cred_prepared) @@ -900,6 +901,11 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task) return 0; + sbsp = inode->i_sb->s_security; + if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) && + isp->smk_task != sbsp->smk_root) + return 0; + if (bprm->unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) { struct task_struct *tracer; rc = 0; @@ -1703,6 +1709,7 @@ static int smack_mmap_file(struct file *file, struct task_smack *tsp; struct smack_known *okp; struct inode_smack *isp; + struct superblock_smack *sbsp; int may; int mmay; int tmay; @@ -1714,6 +1721,10 @@ static int smack_mmap_file(struct file *file, isp = file_inode(file)->i_security; if (isp->smk_mmap == NULL) return 0; + sbsp = file_inode(file)->i_sb->s_security; + if (sbsp->smk_flags & SMK_SB_UNTRUSTED && + isp->smk_mmap != sbsp->smk_root) + return -EACCES; mkp = isp->smk_mmap; tsp = current_security(); @@ -3492,16 +3503,14 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) if (rc >= 0) transflag = SMK_INODE_TRANSMUTE; } - if (!(sbsp->smk_flags & SMK_SB_UNTRUSTED)) { - /* - * Don't let the exec or mmap label be "*" or "@". - */ - skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); - if (IS_ERR(skp) || skp == &smack_known_star || - skp == &smack_known_web) - skp = NULL; - isp->smk_task = skp; - } + /* + * Don't let the exec or mmap label be "*" or "@". + */ + skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); + if (IS_ERR(skp) || skp == &smack_known_star || + skp == &smack_known_web) + skp = NULL; + isp->smk_task = skp; skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp); if (IS_ERR(skp) || skp == &smack_known_star ||