From patchwork Wed Dec 2 15:40:06 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Seth Forshee X-Patchwork-Id: 7748521 Return-Path: X-Original-To: patchwork-selinux@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id D1C8C9F387 for ; Wed, 2 Dec 2015 16:28:37 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 1EA25205DF for ; Wed, 2 Dec 2015 16:28:35 +0000 (UTC) Received: from emvm-gh1-uea08.nsa.gov (emvm-gh1-uea08.nsa.gov [63.239.67.9]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 8ECD420503 for ; Wed, 2 Dec 2015 16:28:33 +0000 (UTC) X-TM-IMSS-Message-ID: <237f589500017a4b@nsa.gov> Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by nsa.gov ([10.208.42.193]) with ESMTP (TREND IMSS SMTP Service 7.1) id 237f589500017a4b ; Wed, 2 Dec 2015 11:26:58 -0500 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id tB2GQgMR011022; Wed, 2 Dec 2015 11:26:45 -0500 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id tB2FgJVd185568 for ; Wed, 2 Dec 2015 10:42:19 -0500 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id tB2Fg5ov006458 for ; Wed, 2 Dec 2015 10:42:19 -0500 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1CeBAA0EF9W/7bVVdFeGQEBAQEPAQEBAYRMu3CEFoYOAoIYAQEBAQEBhUABAQEDEhUZAQE3AQ9RNAEFARwGARIiiA2hFYExPjGKV4VUAQWMIwEBAQEBAQEDAgEaBgqEOoIQjjaHTQWGTj2IBI8WhzYzkVk2gRdjggQNHYF1UwGFbgEBAQ X-IPAS-Result: A1CeBAA0EF9W/7bVVdFeGQEBAQEPAQEBAYRMu3CEFoYOAoIYAQEBAQEBhUABAQEDEhUZAQE3AQ9RNAEFARwGARIiiA2hFYExPjGKV4VUAQWMIwEBAQEBAQEDAgEaBgqEOoIQjjaHTQWGTj2IBI8WhzYzkVk2gRdjggQNHYF1UwGFbgEBAQ X-IronPort-AV: E=Sophos;i="5.20,373,1444708800"; d="scan'208";a="4986116" Received: from emvm-gh1-uea08.nsa.gov ([10.208.42.193]) by goalie.tycho.ncsc.mil with ESMTP; 02 Dec 2015 10:42:14 -0500 X-TM-IMSS-Message-ID: <2356813900015eb3@nsa.gov> Received: from mail-ig0-f182.google.com (mail-ig0-f182.google.com [209.85.213.182]) by nsa.gov ([10.208.42.193]) with ESMTP (TREND IMSS SMTP Service 7.1; TLSv1/SSLv3 AES128-SHA (128/128)) id 2356813900015eb3 ; Wed, 2 Dec 2015 10:42:21 -0500 Received: by igvg19 with SMTP id g19so120487553igv.1 for ; Wed, 02 Dec 2015 07:42:11 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=frunC1mLI8jp4dUjS6IRw492nG5EQ5tIehtDLhukJjE=; b=DFQDDJoJxt9re7riH/271zukjGQPLzA4kyyyhCHw+hDByfjM50cY8UC+0th6yhO3eK plPdlXaimzn4zx6un388eB8h+3A/zO00oMfOjtiPpoBH+tZj8f22WGkkL9UQya3+KJAU sFjl7CEAemUDZ/LfWvVVdBScYfkrIPtLwUo3fGllM448zL9IgkXAug3UAl3facMSTP9r 7lnI2vrD05W3fpR7joiCqKYFX+Jn7OMzrzbF0ClD2ltcfWe1srb/3zl3HWpmR4kOSSP8 nX6bARu/cjQmJXwepArWIWDd2fFoVyAAbf9AYxagJ9fJR+ecLAxztmJNObn/X6vOZcn9 FBwQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=frunC1mLI8jp4dUjS6IRw492nG5EQ5tIehtDLhukJjE=; b=VXhQBzaYsPi9htVpqk9yaNdH5spj5GMhQ+DvV6xi+Wq/jf11xADc6iM2AD0OW0CC0Y GxWvMXK84MbpY8c++qNo/xiiGMucELabnxt/eIGUpKilLS06P2XNHq7NCvzM3i3aTEgA Q0G8g13n80GXuc4+NQQLsnyJVtibSnI/FctPxLvOci4GrFk7X1CLuVHUzWaUbv9B4kd+ g1lj8ntld8F69XQDoo/ax5u4Akub/1GKuGUDcE0abX1lMX50/yMKtAD8mBeRaCy8L66S fn5u813GNkBwHuuBSg1YMvcrZ/bRH6poCFKfppaG1vQecluL1MrpGwa5eUhrjizVgLI6 Zrcw== X-Gm-Message-State: ALoCoQn7CpKPXGPqUi4dBTyam2yIgGb/6meetREvhAABdoerghzGaZ2/XN8h25VWfaMHvJYl20FO X-Received: by 10.50.142.40 with SMTP id rt8mr4706142igb.0.1449070931765; Wed, 02 Dec 2015 07:42:11 -0800 (PST) Received: from localhost (199-87-125-144.dyn.kc.surewest.net. [199.87.125.144]) by smtp.gmail.com with ESMTPSA id q17sm11587785igr.3.2015.12.02.07.42.11 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Wed, 02 Dec 2015 07:42:11 -0800 (PST) From: Seth Forshee To: "Eric W. Biederman" , Casey Schaufler Subject: [PATCH 06/19] Smack: Handle labels consistently in untrusted mounts Date: Wed, 2 Dec 2015 09:40:06 -0600 Message-Id: <1449070821-73820-7-git-send-email-seth.forshee@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1449070821-73820-1-git-send-email-seth.forshee@canonical.com> References: <1449070821-73820-1-git-send-email-seth.forshee@canonical.com> X-TM-AS-MML: disable X-Mailman-Approved-At: Wed, 02 Dec 2015 11:15:49 -0500 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: Serge Hallyn , Seth Forshee , James Morris , dm-devel@redhat.com, Miklos Szeredi , Richard Weinberger , linux-security-module@vger.kernel.org, linux-bcache@vger.kernel.org, linux-kernel@vger.kernel.org, linux-raid@vger.kernel.org, fuse-devel@lists.sourceforge.net, Austin S Hemmelgarn , linux-mtd@lists.infradead.org, Alexander Viro , selinux@tycho.nsa.gov, linux-fsdevel@vger.kernel.org MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID,T_RP_MATCHES_RCVD,UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled differently in untrusted mounts. This is confusing and potentically problematic. Change this to handle them all the same way that SMACK64 is currently handled; that is, read the label from disk and check it at use time. For SMACK64 and SMACK64MMAP access is denied if the label does not match smk_root. To be consistent with suid, a SMACK64EXEC label which does not match smk_root will still allow execution of the file but will not run with the label supplied in the xattr. Signed-off-by: Seth Forshee Acked-by: Casey Schaufler --- security/smack/smack_lsm.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 16cac04214e2..0e555f64ded0 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -921,6 +921,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) struct inode *inode = file_inode(bprm->file); struct task_smack *bsp = bprm->cred->security; struct inode_smack *isp; + struct superblock_smack *sbsp; int rc; if (bprm->cred_prepared) @@ -930,6 +931,11 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task) return 0; + sbsp = inode->i_sb->s_security; + if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) && + isp->smk_task != sbsp->smk_root) + return 0; + if (bprm->unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) { struct task_struct *tracer; rc = 0; @@ -1733,6 +1739,7 @@ static int smack_mmap_file(struct file *file, struct task_smack *tsp; struct smack_known *okp; struct inode_smack *isp; + struct superblock_smack *sbsp; int may; int mmay; int tmay; @@ -1744,6 +1751,10 @@ static int smack_mmap_file(struct file *file, isp = file_inode(file)->i_security; if (isp->smk_mmap == NULL) return 0; + sbsp = file_inode(file)->i_sb->s_security; + if (sbsp->smk_flags & SMK_SB_UNTRUSTED && + isp->smk_mmap != sbsp->smk_root) + return -EACCES; mkp = isp->smk_mmap; tsp = current_security(); @@ -3532,16 +3543,14 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) if (rc >= 0) transflag = SMK_INODE_TRANSMUTE; } - if (!(sbsp->smk_flags & SMK_SB_UNTRUSTED)) { - /* - * Don't let the exec or mmap label be "*" or "@". - */ - skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); - if (IS_ERR(skp) || skp == &smack_known_star || - skp == &smack_known_web) - skp = NULL; - isp->smk_task = skp; - } + /* + * Don't let the exec or mmap label be "*" or "@". + */ + skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); + if (IS_ERR(skp) || skp == &smack_known_star || + skp == &smack_known_web) + skp = NULL; + isp->smk_task = skp; skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp); if (IS_ERR(skp) || skp == &smack_known_star ||