From patchwork Fri Apr 1 22:40:39 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeffrey Vander Stoep X-Patchwork-Id: 8743771 Return-Path: X-Original-To: patchwork-selinux@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id D3C65C0553 for ; Mon, 4 Apr 2016 19:21:47 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 1999E201CD for ; Mon, 4 Apr 2016 19:21:47 +0000 (UTC) Received: from emvm-gh1-uea08.nsa.gov (emvm-gh1-uea08.nsa.gov [8.44.101.8]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 203FE201C8 for ; Mon, 4 Apr 2016 19:21:46 +0000 (UTC) X-TM-IMSS-Message-ID: <05bcca9e00072f41@nsa.gov> Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by nsa.gov ([10.208.42.193]) with ESMTP (TREND IMSS SMTP Service 7.1) id 05bcca9e00072f41 ; Mon, 4 Apr 2016 14:59:56 -0400 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u34J0scI024444; Mon, 4 Apr 2016 15:00:55 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u32KOh3T263528 for ; Sat, 2 Apr 2016 16:24:43 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u32KOh4P016637 for ; Sat, 2 Apr 2016 16:24:43 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1DBAAD7KQBXcq/AVdFcHYRquRKDMQVSBxeFdoF2AQEBAQEBEwEKCwwIH4R1ARUVGQEBNwGBFAEFATUiiAWlXYExPjGKT4UoAQSMWQEBAQEGAhgGCoQNggmIV4J6C0CCQ45GiUCELYlbAokqhWECjV0vgQ6CWQ0ZgWocMIZpgT0BAQE X-IPAS-Result: A1DBAAD7KQBXcq/AVdFcHYRquRKDMQVSBxeFdoF2AQEBAQEBEwEKCwwIH4R1ARUVGQEBNwGBFAEFATUiiAWlXYExPjGKT4UoAQSMWQEBAQEGAhgGCoQNggmIV4J6C0CCQ45GiUCELYlbAokqhWECjV0vgQ6CWQ0ZgWocMIZpgT0BAQE X-IronPort-AV: E=Sophos;i="5.24,433,1454994000"; d="scan'208";a="5345751" Received: from emvm-gh1-uea09.nsa.gov ([10.208.42.194]) by goalie.tycho.ncsc.mil with ESMTP; 02 Apr 2016 16:24:43 -0400 X-TM-IMSS-Message-ID: <479b45030005e931@nsa.gov> Received: from mail-pf0-f175.google.com (mail-pf0-f175.google.com [209.85.192.175]) by nsa.gov ([10.208.42.194]) with ESMTP (TREND IMSS SMTP Service 7.1; TLSv1/SSLv3 AES128-SHA (128/128)) id 479b45030005e931 ; Sat, 2 Apr 2016 16:23:51 -0400 Received: by mail-pf0-f175.google.com with SMTP id e128so93581170pfe.3 for ; Sat, 02 Apr 2016 13:24:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=4UcdT/SAEp24hziTo4M0P17kTk51VqU3ZnkB0uhOkpM=; b=YNvwYVqmPXkPmIKdEAjn2Er4pzdQgWI40n7Bp2XBzBZDEmZNNIBiBXm43KCfDjc9em FcB7y+OVrrCu7LUYtSVtHuCTAKpuluA4g4mCw5KpJ1GLeihltKpowOABDTfO+UcRbRLR g+hcjnE4TJ8yNcY8zH2F0DOXPXNK5AbVW7S2V3EW8EQjWlc6nTR0H+LfSfXzHe501xaT XIlRV8vgav5m9wYogSGwOtE8zfxEstAxn5N9sQXkGy3f6I5oj46ooYEBKOtOo1jEaAwJ xLJ9a44kCgw4QvnhcbVzOHHX6bxXy4DVPqt5OsIP38tky/jOZwSa/bkssAXWUhquvS8u Ryzg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=4UcdT/SAEp24hziTo4M0P17kTk51VqU3ZnkB0uhOkpM=; b=J/Z8blh1KFnGNUobjf3/iUD23nVGWENRXtJlYf5oHupMCzZz5PP/hjA6G9QXvCS+tb jCaeEXtJmcAU1NdKG4rvRLFpIsNdCXRxV0jlggjTc2LhHPe7IaGNnaeCB6mAVCmapvTD GDRP4dL9Y1uD0F2QkMz9UJfuO7KAf1hSB2LrClbGiCEZC2bX0AnzUzR+dsSnrI217U90 guozSeuGGhaCTw+8f+msERjycavY2sgL2S8BC93qXmgbyHZfnCqgAbfBOIZ9LQapDOa9 e0irAIxVWt4o23M6NCZ3Ge4JKrSrQJClR4EUj8oFVZIwxe0VuxNKrjZl9676U5crq/hj lgVA== X-Gm-Message-State: AD7BkJJTCXQwNhsrgyiJqDki7YH+h3yIBbvETALQCdmVtbE/hci+LoM0yMNYFoHQ9VrXYyX1 X-Received: by 10.98.32.136 with SMTP id m8mr2014343pfj.11.1459550442881; Fri, 01 Apr 2016 15:40:42 -0700 (PDT) Received: from jeffv-linux.mtv.corp.google.com ([172.22.112.85]) by smtp.gmail.com with ESMTPSA id ko9sm24329335pab.37.2016.04.01.15.40.41 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Fri, 01 Apr 2016 15:40:42 -0700 (PDT) From: Jeff Vander Stoep To: selinux@tycho.nsa.gov Subject: [PATCH] selinux: restrict kernel module loading Date: Fri, 1 Apr 2016 15:40:39 -0700 Message-Id: <1459550439-29408-1-git-send-email-jeffv@google.com> X-Mailer: git-send-email 2.8.0.rc3.226.g39d4020 X-TM-AS-MML: disable X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: sds@tycho.nsa.gov MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Utilize existing kernel_read_file hook on kernel module load. Add module_load permission to the system class. Enforces restrictions on kernel module origin when calling the finit_module syscall. The hook checks that source type has permission module_load for the target type. Example for finit_module: allow foo bar_file:system module_load; Similarly restrictions are enforced on kernel module loading when calling the init_module syscall. The hook checks that source type has permission module_load for the kernel target type. Example for init_module: allow foo kernel:system module_load; Signed-off-by: Jeff Vander Stoep --- security/selinux/hooks.c | 52 +++++++++++++++++++++++++++++++++++++ security/selinux/include/classmap.h | 2 +- 2 files changed, 53 insertions(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 3fa3ca5..5bc4875 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3719,6 +3719,57 @@ static int selinux_kernel_module_request(char *kmod_name) SYSTEM__MODULE_REQUEST, &ad); } +static int selinux_kernel_module_from_file(struct file *file) +{ + struct common_audit_data ad; + struct inode_security_struct *isec; + struct file_security_struct *fsec; + struct inode *inode; + u32 sid = current_sid(); + int rc; + + /* init_module */ + if (file == NULL) { + rc = avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM, + SYSTEM__MODULE_LOAD, NULL); + goto out; + } + + /* finit_module */ + ad.type = LSM_AUDIT_DATA_PATH; + ad.u.path = file->f_path; + + inode = file_inode(file); + isec = inode->i_security; + fsec = file->f_security; + + if (sid != fsec->sid) { + rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad); + if (rc) + goto out; + } + + rc = avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM, + SYSTEM__MODULE_LOAD, &ad); +out: + return rc; +} + +static selinux_kernel_read_file(struct file *file, enum kernel_read_file_id id) +{ + int rc = 0; + + switch (id) { + case READING_MODULE: + rc = selinux_kernel_module_from_file(file); + break; + default: + break; + } + + return rc; +} + static int selinux_task_setpgid(struct task_struct *p, pid_t pgid) { return current_has_perm(p, PROCESS__SETPGID); @@ -6022,6 +6073,7 @@ static struct security_hook_list selinux_hooks[] = { LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as), LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as), LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request), + LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file), LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid), LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid), LSM_HOOK_INIT(task_getsid, selinux_task_getsid), diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index ef83c4b..8fbd138 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -32,7 +32,7 @@ struct security_class_mapping secclass_map[] = { "setsockcreate", NULL } }, { "system", { "ipc_info", "syslog_read", "syslog_mod", - "syslog_console", "module_request", NULL } }, + "syslog_console", "module_request", "module_load", NULL } }, { "capability", { "chown", "dac_override", "dac_read_search", "fowner", "fsetid", "kill", "setgid", "setuid", "setpcap",