From patchwork Tue Feb 6 13:59:08 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tetsuo Handa X-Patchwork-Id: 13547341 X-Patchwork-Delegate: paul@paul-moore.com Received: from www262.sakura.ne.jp (www262.sakura.ne.jp [202.181.97.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C6D94131E34; Tue, 6 Feb 2024 14:00:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.181.97.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707228028; cv=none; b=GnR1Qg0LkOS4Bl6eK6xe9XXWLmKXAwkLRq2q/07HHaSnf9NF98oeMZMHKGorWWBXvF7bdcb/iQ4+/s0/Yhe8jVkCyV8odfKBQmlIRaqEzv8XkJbqLsMboxJbvZRAn4rPZMA7KkcUm1ZhKDn2JXoOu/b8xau5qdF/QaqcCVJJacw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707228028; c=relaxed/simple; bh=pI+XqziRRNlFDN2kQrkoXJViSst38JT5dHIw2NxfTK0=; h=Message-ID:Date:MIME-Version:Subject:From:To:Cc:References: In-Reply-To:Content-Type; b=jKX/qf3vALWojS4iapQx4qJwPfY0eZw6l0eS0aGMcYDJvTjqIzP1By2h2NnU+Cm8xPDkRQSXqllshEVZKZ5DBt6wIgzbZJAV8l4H7VJQvG7qpd/qOsEHWazeVggQHaQu/zwi6MP4MczhEVmuuJCekwe+wBMmQ2nHyEAVKZ5d6Mo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=I-love.SAKURA.ne.jp; spf=pass smtp.mailfrom=I-love.SAKURA.ne.jp; arc=none smtp.client-ip=202.181.97.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=I-love.SAKURA.ne.jp Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=I-love.SAKURA.ne.jp Received: from fsav413.sakura.ne.jp (fsav413.sakura.ne.jp [133.242.250.112]) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTP id 416E0NKR019243; Tue, 6 Feb 2024 23:00:23 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Received: from www262.sakura.ne.jp (202.181.97.72) by fsav413.sakura.ne.jp (F-Secure/fsigk_smtp/550/fsav413.sakura.ne.jp); Tue, 06 Feb 2024 23:00:23 +0900 (JST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/fsav413.sakura.ne.jp) Received: from [192.168.1.6] (M106072142033.v4.enabler.ne.jp [106.72.142.33]) (authenticated bits=0) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTPSA id 416DwfKO018763 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NO); Tue, 6 Feb 2024 22:59:07 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Message-ID: <894cc57c-d298-4b60-a67d-42c1a92d0b92@I-love.SAKURA.ne.jp> Date: Tue, 6 Feb 2024 22:59:08 +0900 Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: [PATCH v3 1/3] LSM: add security_execve_abort() hook Content-Language: en-US From: Tetsuo Handa To: Linus Torvalds Cc: linux-security-module , linux-fsdevel References: <72da7003-a115-4162-b235-53cd3da8a90e@I-love.SAKURA.ne.jp> In-Reply-To: <72da7003-a115-4162-b235-53cd3da8a90e@I-love.SAKURA.ne.jp> A regression caused by commit 978ffcbf00d8 ("execve: open the executable file before doing anything else") has been fixed by commit 4759ff71f23e ("exec: Check __FMODE_EXEC instead of in_execve for LSMs") and commit 3eab830189d9 ("uselib: remove use of __FMODE_EXEC"). While fixing this regression, Linus commented that we want to remove current->in_execve flag. The current->in_execve flag was introduced by commit f9ce1f1cda8b ("Add in_execve flag into task_struct.") when TOMOYO LSM was merged, and the reason was explained in commit f7433243770c ("LSM adapter functions."). In short, TOMOYO's design is not compatible with COW credential model introduced in Linux 2.6.29, and the current->in_execve flag was added for emulating security_bprm_free() hook which has been removed by introduction of COW credential model. security_task_alloc()/security_task_free() hooks have been removed by commit f1752eec6145 ("CRED: Detach the credentials from task_struct"), and these hooks have been revived by commit 1a2a4d06e1e9 ("security: create task_free security callback") and commit e4e55b47ed9a ("LSM: Revive security_task_alloc() hook and per "struct task_struct" security blob."). But security_bprm_free() hook did not revive until now. Now that Linus wants TOMOYO to stop carrying state across two independent execve() calls, and TOMOYO can stop carrying state if a hook for restoring previous state upon failed execve() call were provided, this patch revives the hook. Since security_bprm_committing_creds() and security_bprm_committed_creds() hooks are called when an execve() request succeeded, we don't need to call security_bprm_free() hook when an execve() request succeeded. Therefore, this patch adds security_execve_abort() hook which is called only when an execve() request failed after successful prepare_bprm_creds() call. Signed-off-by: Tetsuo Handa Acked-by: Serge E. Hallyn --- fs/exec.c | 1 + include/linux/lsm_hook_defs.h | 1 + include/linux/security.h | 5 +++++ security/security.c | 11 +++++++++++ 4 files changed, 18 insertions(+) diff --git a/fs/exec.c b/fs/exec.c index af4fbb61cd53..d6d35a06fd08 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1521,6 +1521,7 @@ static void free_bprm(struct linux_binprm *bprm) if (bprm->cred) { mutex_unlock(¤t->signal->cred_guard_mutex); abort_creds(bprm->cred); + security_execve_abort(); } do_close_execat(bprm->file); if (bprm->executable) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 76458b6d53da..fd100ab71a33 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -54,6 +54,7 @@ LSM_HOOK(int, 0, bprm_creds_from_file, struct linux_binprm *bprm, const struct f LSM_HOOK(int, 0, bprm_check_security, struct linux_binprm *bprm) LSM_HOOK(void, LSM_RET_VOID, bprm_committing_creds, const struct linux_binprm *bprm) LSM_HOOK(void, LSM_RET_VOID, bprm_committed_creds, const struct linux_binprm *bprm) +LSM_HOOK(void, LSM_RET_VOID, execve_abort, void) LSM_HOOK(int, 0, fs_context_submount, struct fs_context *fc, struct super_block *reference) LSM_HOOK(int, 0, fs_context_dup, struct fs_context *fc, struct fs_context *src_sc) diff --git a/include/linux/security.h b/include/linux/security.h index d0eb20f90b26..31532b30c4f0 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -299,6 +299,7 @@ int security_bprm_creds_from_file(struct linux_binprm *bprm, const struct file * int security_bprm_check(struct linux_binprm *bprm); void security_bprm_committing_creds(const struct linux_binprm *bprm); void security_bprm_committed_creds(const struct linux_binprm *bprm); +void security_execve_abort(void); int security_fs_context_submount(struct fs_context *fc, struct super_block *reference); int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc); int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param); @@ -648,6 +649,10 @@ static inline void security_bprm_committed_creds(const struct linux_binprm *bprm { } +static inline void security_execve_abort(void) +{ +} + static inline int security_fs_context_submount(struct fs_context *fc, struct super_block *reference) { diff --git a/security/security.c b/security/security.c index 3aaad75c9ce8..10adc4d3c5e0 100644 --- a/security/security.c +++ b/security/security.c @@ -1223,6 +1223,17 @@ void security_bprm_committed_creds(const struct linux_binprm *bprm) call_void_hook(bprm_committed_creds, bprm); } +/** + * security_execve_abort() - Notify that exec() has failed + * + * This hook is for undoing changes which cannot be discarded by + * abort_creds(). + */ +void security_execve_abort(void) +{ + call_void_hook(execve_abort); +} + /** * security_fs_context_submount() - Initialise fc->security * @fc: new filesystem context From patchwork Tue Feb 6 13:59:31 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tetsuo Handa X-Patchwork-Id: 13547340 X-Patchwork-Delegate: paul@paul-moore.com Received: from www262.sakura.ne.jp (www262.sakura.ne.jp [202.181.97.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8E8B1131721; Tue, 6 Feb 2024 13:59:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.181.97.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707227976; cv=none; b=Hn47xMu9nenpFdPI5noEQhF1bS4I9r2JkZEJbsm5CFu3jDMFxSVhZGYeqCey24Ta9r/9JYQl17ng92LYjbzgdyCJ7jS0EG1L9aY6aHxtAftGDK3SEb9KDGHLsHXhkPio+YXf5n/f1AMCua/aeyji5LLhCPHPRd1xyNEHU/31N9U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707227976; c=relaxed/simple; bh=/tfr0DcQzkypATH7SClMO+VuGfSS1tj0Xv863TTrGkI=; h=Message-ID:Date:MIME-Version:Subject:From:To:Cc:References: In-Reply-To:Content-Type; b=EqdmnZArgCrG6gmQmx+jDIflnnHAWvNTFMn+teSkgbmJPrIhLCZ/1D80vpP+O/NLR0wJ6miajqbuy3oNm7UBH34G0Swc2Gx8L3B4FCy/Kzvt77ouMIVTz6+yuAbNbN/TECiGicTrlktHIOPkULeGrcMB1z7J6AlmkxYwyneNIMo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=I-love.SAKURA.ne.jp; spf=pass smtp.mailfrom=I-love.SAKURA.ne.jp; arc=none smtp.client-ip=202.181.97.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=I-love.SAKURA.ne.jp Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=I-love.SAKURA.ne.jp Received: from fsav313.sakura.ne.jp (fsav313.sakura.ne.jp [153.120.85.144]) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTP id 416DxU3O018974; Tue, 6 Feb 2024 22:59:31 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Received: from www262.sakura.ne.jp (202.181.97.72) by fsav313.sakura.ne.jp (F-Secure/fsigk_smtp/550/fsav313.sakura.ne.jp); Tue, 06 Feb 2024 22:59:30 +0900 (JST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/fsav313.sakura.ne.jp) Received: from [192.168.1.6] (M106072142033.v4.enabler.ne.jp [106.72.142.33]) (authenticated bits=0) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTPSA id 416DwfKP018763 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NO); Tue, 6 Feb 2024 22:59:30 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Message-ID: <5a78cc55-9203-47b4-985d-d5991c9e7fe6@I-love.SAKURA.ne.jp> Date: Tue, 6 Feb 2024 22:59:31 +0900 Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: [PATCH v3 2/3] tomoyo: replace current->in_execve flag with security_execve_abort() hook Content-Language: en-US From: Tetsuo Handa To: Linus Torvalds Cc: linux-security-module , linux-fsdevel References: <72da7003-a115-4162-b235-53cd3da8a90e@I-love.SAKURA.ne.jp> In-Reply-To: <72da7003-a115-4162-b235-53cd3da8a90e@I-love.SAKURA.ne.jp> TOMOYO was using current->in_execve flag in order to restore previous state when previous execve() request failed. Since security_execve_abort() hook was added, switch to use it. Signed-off-by: Tetsuo Handa Acked-by: Serge E. Hallyn --- security/tomoyo/tomoyo.c | 22 +++++----------------- 1 file changed, 5 insertions(+), 17 deletions(-) diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c index 04a92c3d65d4..a11dba3a9753 100644 --- a/security/tomoyo/tomoyo.c +++ b/security/tomoyo/tomoyo.c @@ -18,34 +18,22 @@ struct tomoyo_domain_info *tomoyo_domain(void) { struct tomoyo_task *s = tomoyo_task(current); - if (s->old_domain_info && !current->in_execve) { - atomic_dec(&s->old_domain_info->users); - s->old_domain_info = NULL; - } return s->domain_info; } /** - * tomoyo_cred_prepare - Target for security_prepare_creds(). - * - * @new: Pointer to "struct cred". - * @old: Pointer to "struct cred". - * @gfp: Memory allocation flags. - * - * Returns 0. + * tomoyo_execve_abort - Target for security_execve_abort(). */ -static int tomoyo_cred_prepare(struct cred *new, const struct cred *old, - gfp_t gfp) +static void tomoyo_execve_abort(void) { - /* Restore old_domain_info saved by previous execve() request. */ + /* Restore old_domain_info saved by execve() request. */ struct tomoyo_task *s = tomoyo_task(current); - if (s->old_domain_info && !current->in_execve) { + if (s->old_domain_info) { atomic_dec(&s->domain_info->users); s->domain_info = s->old_domain_info; s->old_domain_info = NULL; } - return 0; } /** @@ -554,8 +542,8 @@ static const struct lsm_id tomoyo_lsmid = { * registering TOMOYO. */ static struct security_hook_list tomoyo_hooks[] __ro_after_init = { - LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare), LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds), + LSM_HOOK_INIT(execve_abort, tomoyo_execve_abort), LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc), LSM_HOOK_INIT(task_free, tomoyo_task_free), #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER From patchwork Tue Feb 6 13:59:57 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tetsuo Handa X-Patchwork-Id: 13547342 X-Patchwork-Delegate: paul@paul-moore.com Received: from www262.sakura.ne.jp (www262.sakura.ne.jp [202.181.97.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D91B3131754; Tue, 6 Feb 2024 14:01:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.181.97.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707228076; cv=none; b=RJwbFUscWhkjDOWZc9/385JRgjv07b03fkvGjRvQbwiZefXeAUdJzs35JFRbWV4sErUlSAPL1q66Ol98mAGLvFebDLOKhK9r6j5wSN+ITt30HtAAr0YJd+a0C0fbyiASEO8dKKkz5W1/BGexZXlL9MCz5DP2DLixLlfH69AnOPc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1707228076; c=relaxed/simple; bh=Nbxk054PI3VscSXZTq7j5mcMj6TYP/G6hIvTG+1Zj1I=; h=Message-ID:Date:MIME-Version:Subject:From:To:Cc:References: In-Reply-To:Content-Type; b=IhtWMJjnwJSrfOdLU37HoA6dimn0nNHEN/TVpOI7KSHq6UjbC5GVAHQkG9NBNcchA54xzLAe1fsNLlI6NPhhvw50f8Qa86hVfzepILugvhJrdtXujnkWir97j87GxwKeHoi26NIbfARoxYdHA5SjgPaQIJuZ5+/UkQYo0DzJIfM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=I-love.SAKURA.ne.jp; spf=pass smtp.mailfrom=I-love.SAKURA.ne.jp; arc=none smtp.client-ip=202.181.97.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=I-love.SAKURA.ne.jp Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=I-love.SAKURA.ne.jp Received: from fsav117.sakura.ne.jp (fsav117.sakura.ne.jp [27.133.134.244]) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTP id 416E1Bkl019432; Tue, 6 Feb 2024 23:01:11 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Received: from www262.sakura.ne.jp (202.181.97.72) by fsav117.sakura.ne.jp (F-Secure/fsigk_smtp/550/fsav117.sakura.ne.jp); Tue, 06 Feb 2024 23:01:11 +0900 (JST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/fsav117.sakura.ne.jp) Received: from [192.168.1.6] (M106072142033.v4.enabler.ne.jp [106.72.142.33]) (authenticated bits=0) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTPSA id 416DwfKQ018763 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NO); Tue, 6 Feb 2024 22:59:56 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Message-ID: <6ec07f34-c597-4872-813b-639334fcd2cf@I-love.SAKURA.ne.jp> Date: Tue, 6 Feb 2024 22:59:57 +0900 Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: [PATCH v3 3/3] fs/exec: remove current->in_execve flag Content-Language: en-US From: Tetsuo Handa To: Linus Torvalds Cc: linux-security-module , linux-fsdevel References: <72da7003-a115-4162-b235-53cd3da8a90e@I-love.SAKURA.ne.jp> In-Reply-To: <72da7003-a115-4162-b235-53cd3da8a90e@I-love.SAKURA.ne.jp> Addition of security_execve_abort() hook made it possible to remove this flag. Signed-off-by: Tetsuo Handa Acked-by: Serge E. Hallyn --- fs/exec.c | 3 --- include/linux/sched.h | 3 --- 2 files changed, 6 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index d6d35a06fd08..c197573b2940 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1865,7 +1865,6 @@ static int bprm_execve(struct linux_binprm *bprm) * where setuid-ness is evaluated. */ check_unsafe_exec(bprm); - current->in_execve = 1; sched_mm_cid_before_execve(current); sched_exec(); @@ -1882,7 +1881,6 @@ static int bprm_execve(struct linux_binprm *bprm) sched_mm_cid_after_execve(current); /* execve succeeded */ current->fs->in_exec = 0; - current->in_execve = 0; rseq_execve(current); user_events_execve(current); acct_update_integrals(current); @@ -1901,7 +1899,6 @@ static int bprm_execve(struct linux_binprm *bprm) sched_mm_cid_after_execve(current); current->fs->in_exec = 0; - current->in_execve = 0; return retval; } diff --git a/include/linux/sched.h b/include/linux/sched.h index ffe8f618ab86..66ada87249b1 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -919,9 +919,6 @@ struct task_struct { #ifdef CONFIG_RT_MUTEXES unsigned sched_rt_mutex:1; #endif - - /* Bit to tell TOMOYO we're in execve(): */ - unsigned in_execve:1; unsigned in_iowait:1; #ifndef TIF_RESTORE_SIGMASK unsigned restore_sigmask:1;