From patchwork Mon Jan 4 18:03:54 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Seth Forshee X-Patchwork-Id: 7950321 Return-Path: X-Original-To: patchwork-selinux@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork1.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork1.web.kernel.org (Postfix) with ESMTP id ABA389F6CD for ; Mon, 4 Jan 2016 18:51:51 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id BCABD20306 for ; Mon, 4 Jan 2016 18:51:50 +0000 (UTC) Received: from emvm-gh1-uea09.nsa.gov (emvm-gh1-uea09.nsa.gov [63.239.67.10]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 78BB220304 for ; Mon, 4 Jan 2016 18:51:49 +0000 (UTC) X-TM-IMSS-Message-ID: <51873e05000228b7@nsa.gov> Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by nsa.gov ([10.208.42.194]) with ESMTP (TREND IMSS SMTP Service 7.1) id 51873e05000228b7 ; Mon, 4 Jan 2016 13:52:17 -0500 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u04ImfdO018212; Mon, 4 Jan 2016 13:48:45 -0500 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u04I4jC0225798 for ; Mon, 4 Jan 2016 13:04:45 -0500 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u04I4gpK013588 for ; Mon, 4 Jan 2016 13:04:45 -0500 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1CSAAAys4pWm6nVVdFeGQEBAQEPAQEBAYRJiFm1YQcYhXcCgWgBAQEBAQESAQEBAQEGCwsJIYRjAQEBAxIVGQEBNwEPUTQBBQEcBgESIogNok6BMT4xileFVAEFjB4BAQEBAQEBAwIBGgYKhDuCEYw4DEGBNo41iFaPLYc9MYUxjG41gReCaA0VB4F8UwGFDwEBAQ X-IPAS-Result: A1CSAAAys4pWm6nVVdFeGQEBAQEPAQEBAYRJiFm1YQcYhXcCgWgBAQEBAQESAQEBAQEGCwsJIYRjAQEBAxIVGQEBNwEPUTQBBQEcBgESIogNok6BMT4xileFVAEFjB4BAQEBAQEBAwIBGgYKhDuCEYw4DEGBNo41iFaPLYc9MYUxjG41gReCaA0VB4F8UwGFDwEBAQ X-IronPort-AV: E=Sophos;i="5.20,521,1444708800"; d="scan'208";a="5070763" Received: from emvm-gh1-uea08.nsa.gov ([10.208.42.193]) by goalie.tycho.ncsc.mil with ESMTP; 04 Jan 2016 13:04:44 -0500 X-TM-IMSS-Message-ID: <75b6c146001034aa@nsa.gov> Received: from mail-ig0-f169.google.com (mail-ig0-f169.google.com [209.85.213.169]) by nsa.gov ([10.208.42.193]) with ESMTP (TREND IMSS SMTP Service 7.1; TLSv1/SSLv3 AES128-SHA (128/128)) id 75b6c146001034aa ; Mon, 4 Jan 2016 13:04:19 -0500 Received: by mail-ig0-f169.google.com with SMTP id to4so248924466igc.0 for ; Mon, 04 Jan 2016 10:04:43 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=EXmU2+2DTve62/+iz7SIASih+w3d845l2rPuxd90NW4=; b=2K3B+J5uAT0EOjM1D/ssRqkotMux+IYp1TWStvtkemvhmK4L377ES34HxufxtnP+cQ FQfuvmYtNVj3t3pi6oNLsV05HdLWrajYFHZq61B+mCPSfziqGQuhzxQvqyyd9nKpOF4w xfGPk6/W7gw5MwIOvXgAbqvawuXkFLwIXTh2DgrB7BkAThkFDb7xmQUD+ijF6IP0mLzf Qxe8n6Y0hpg0GPpVMQ1RSf7sJ6cIAiR32yt1M5hfJQj/VIkUCBkyjzhtxuRafOFmTB6a PSOYMHypRBDHhPoBmmJ5U1n3wozMlEZL1OAE8nOilNlOM7/q7R82tiynG+KRmzt23ana UkVg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=EXmU2+2DTve62/+iz7SIASih+w3d845l2rPuxd90NW4=; b=eAD7JwJFbU4rdS/h2RaZ2uebajKeWhNrFMyCpSlmzuKCeLI7lQEansXSfLtHm48G/z DCPU+tDErwIK0r6skPJGxhEG35dsY509mbGFeBZFfJV6BpkYaZkwMBrFrmI0zgHb+0rb 5b/wx3Q8g7VXwGpngobZu3wyfAzrV6ZwK+ofshB9rWjfKS12qfpD6oEeM4lIBTC0db5A gLSCYis9MRrvcCLcnD4iCHpGM53wER8TGYRcFr8y9hhucxYmLHpCnaL5wcuOiMEZWP3s rxv2rWV88EsoH9cvB/qeZXDBzOi8yPkYdg5ui5kUoEDRp08+7aGQBd32Z9mjE7nZMs21 j9TQ== X-Gm-Message-State: ALoCoQkJGUeuv7sczz3MS5iJBDrlAGCQ1dZv+8O5flBU8IlA39V0FJ/1Rc9Ytejgu8lcEzcyV1EAV+g9pw1cdiNs8x8Nu0JirA== X-Received: by 10.50.141.161 with SMTP id rp1mr81797697igb.28.1451930683414; Mon, 04 Jan 2016 10:04:43 -0800 (PST) Received: from localhost ([66.64.121.229]) by smtp.gmail.com with ESMTPSA id w191sm17460187iod.30.2016.01.04.10.04.42 (version=TLS1_2 cipher=AES128-SHA bits=128/128); Mon, 04 Jan 2016 10:04:42 -0800 (PST) From: Seth Forshee To: "Eric W. Biederman" , Miklos Szeredi Subject: [PATCH RESEND v2 15/18] fuse: Add support for pid namespaces Date: Mon, 4 Jan 2016 12:03:54 -0600 Message-Id: <1451930639-94331-16-git-send-email-seth.forshee@canonical.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1451930639-94331-1-git-send-email-seth.forshee@canonical.com> References: <1451930639-94331-1-git-send-email-seth.forshee@canonical.com> X-TM-AS-MML: disable X-Mailman-Approved-At: Mon, 04 Jan 2016 13:14:22 -0500 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: Serge Hallyn , Seth Forshee , Miklos Szeredi , dm-devel@redhat.com, linux-security-module@vger.kernel.org, Richard Weinberger , linux-bcache@vger.kernel.org, linux-kernel@vger.kernel.org, linux-raid@vger.kernel.org, fuse-devel@lists.sourceforge.net, Austin S Hemmelgarn , linux-mtd@lists.infradead.org, Alexander Viro , selinux@tycho.nsa.gov, linux-fsdevel@vger.kernel.org MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Spam-Status: No, score=-6.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,RP_MATCHES_RCVD,T_DKIM_INVALID,UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP If the userspace process servicing fuse requests is running in a pid namespace then pids passed via the fuse fd need to be translated relative to that namespace. Capture the pid namespace in use when the filesystem is mounted and use this for pid translation. Since no use case currently exists for changing namespaces all translations are done relative to the pid namespace in use when /dev/fuse is opened. Mounting or /dev/fuse IO from another namespace will return errors. Requests from processes whose pid cannot be translated into the target namespace are not permitted, except for requests allocated via fuse_get_req_nofail_nopages. For no-fail requests in.h.pid will be 0 if the pid translation fails. File locking changes based on previous work done by Eric Biederman. Signed-off-by: Seth Forshee Signed-off-by: Miklos Szeredi Acked-by: Miklos Szeredi --- fs/fuse/dev.c | 19 +++++++++++++++---- fs/fuse/file.c | 22 +++++++++++++++++----- fs/fuse/fuse_i.h | 4 ++++ fs/fuse/inode.c | 3 +++ 4 files changed, 39 insertions(+), 9 deletions(-) diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c index ebb5e37455a0..a4f6f30d6d86 100644 --- a/fs/fuse/dev.c +++ b/fs/fuse/dev.c @@ -19,6 +19,7 @@ #include #include #include +#include MODULE_ALIAS_MISCDEV(FUSE_MINOR); MODULE_ALIAS("devname:fuse"); @@ -124,11 +125,11 @@ static void __fuse_put_request(struct fuse_req *req) atomic_dec(&req->count); } -static void fuse_req_init_context(struct fuse_req *req) +static void fuse_req_init_context(struct fuse_conn *fc, struct fuse_req *req) { req->in.h.uid = from_kuid_munged(&init_user_ns, current_fsuid()); req->in.h.gid = from_kgid_munged(&init_user_ns, current_fsgid()); - req->in.h.pid = current->pid; + req->in.h.pid = pid_nr_ns(task_pid(current), fc->pid_ns); } void fuse_set_initialized(struct fuse_conn *fc) @@ -181,10 +182,14 @@ static struct fuse_req *__fuse_get_req(struct fuse_conn *fc, unsigned npages, goto out; } - fuse_req_init_context(req); + fuse_req_init_context(fc, req); __set_bit(FR_WAITING, &req->flags); if (for_background) __set_bit(FR_BACKGROUND, &req->flags); + if (req->in.h.pid == 0) { + fuse_put_request(fc, req); + return ERR_PTR(-EOVERFLOW); + } return req; @@ -274,7 +279,7 @@ struct fuse_req *fuse_get_req_nofail_nopages(struct fuse_conn *fc, if (!req) req = get_reserved_req(fc, file); - fuse_req_init_context(req); + fuse_req_init_context(fc, req); __set_bit(FR_WAITING, &req->flags); __clear_bit(FR_BACKGROUND, &req->flags); return req; @@ -1243,6 +1248,9 @@ static ssize_t fuse_dev_do_read(struct fuse_dev *fud, struct file *file, struct fuse_in *in; unsigned reqsize; + if (task_active_pid_ns(current) != fc->pid_ns) + return -EIO; + restart: spin_lock(&fiq->waitq.lock); err = -EAGAIN; @@ -1872,6 +1880,9 @@ static ssize_t fuse_dev_do_write(struct fuse_dev *fud, struct fuse_req *req; struct fuse_out_header oh; + if (task_active_pid_ns(current) != fc->pid_ns) + return -EIO; + if (nbytes < sizeof(struct fuse_out_header)) return -EINVAL; diff --git a/fs/fuse/file.c b/fs/fuse/file.c index e0faf8f2c868..a6c7484c94ee 100644 --- a/fs/fuse/file.c +++ b/fs/fuse/file.c @@ -2061,7 +2061,8 @@ static int fuse_direct_mmap(struct file *file, struct vm_area_struct *vma) return generic_file_mmap(file, vma); } -static int convert_fuse_file_lock(const struct fuse_file_lock *ffl, +static int convert_fuse_file_lock(struct fuse_conn *fc, + const struct fuse_file_lock *ffl, struct file_lock *fl) { switch (ffl->type) { @@ -2076,7 +2077,14 @@ static int convert_fuse_file_lock(const struct fuse_file_lock *ffl, fl->fl_start = ffl->start; fl->fl_end = ffl->end; - fl->fl_pid = ffl->pid; + + /* + * Convert pid into the caller's pid namespace. If the pid + * does not map into the namespace fl_pid will get set to 0. + */ + rcu_read_lock(); + fl->fl_pid = pid_vnr(find_pid_ns(ffl->pid, fc->pid_ns)); + rcu_read_unlock(); break; default: @@ -2125,7 +2133,7 @@ static int fuse_getlk(struct file *file, struct file_lock *fl) args.out.args[0].value = &outarg; err = fuse_simple_request(fc, &args); if (!err) - err = convert_fuse_file_lock(&outarg.lk, fl); + err = convert_fuse_file_lock(fc, &outarg.lk, fl); return err; } @@ -2137,7 +2145,8 @@ static int fuse_setlk(struct file *file, struct file_lock *fl, int flock) FUSE_ARGS(args); struct fuse_lk_in inarg; int opcode = (fl->fl_flags & FL_SLEEP) ? FUSE_SETLKW : FUSE_SETLK; - pid_t pid = fl->fl_type != F_UNLCK ? current->tgid : 0; + struct pid *pid = fl->fl_type != F_UNLCK ? task_tgid(current) : NULL; + pid_t pid_nr = pid_nr_ns(pid, fc->pid_ns); int err; if (fl->fl_lmops && fl->fl_lmops->lm_grant) { @@ -2149,7 +2158,10 @@ static int fuse_setlk(struct file *file, struct file_lock *fl, int flock) if (fl->fl_flags & FL_CLOSE) return 0; - fuse_lk_fill(&args, file, fl, opcode, pid, flock, &inarg); + if (pid && pid_nr == 0) + return -EOVERFLOW; + + fuse_lk_fill(&args, file, fl, opcode, pid_nr, flock, &inarg); err = fuse_simple_request(fc, &args); /* locking is restartable */ diff --git a/fs/fuse/fuse_i.h b/fs/fuse/fuse_i.h index 405113101db8..143b595197b6 100644 --- a/fs/fuse/fuse_i.h +++ b/fs/fuse/fuse_i.h @@ -22,6 +22,7 @@ #include #include #include +#include /** Max number of pages that can be used in a single read request */ #define FUSE_MAX_PAGES_PER_REQ 32 @@ -456,6 +457,9 @@ struct fuse_conn { /** The group id for this mount */ kgid_t group_id; + /** The pid namespace for this mount */ + struct pid_namespace *pid_ns; + /** The fuse mount flags for this mount */ unsigned flags; diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c index 2913db2a5b99..2f31874ea9db 100644 --- a/fs/fuse/inode.c +++ b/fs/fuse/inode.c @@ -20,6 +20,7 @@ #include #include #include +#include MODULE_AUTHOR("Miklos Szeredi "); MODULE_DESCRIPTION("Filesystem in Userspace"); @@ -609,6 +610,7 @@ void fuse_conn_init(struct fuse_conn *fc) fc->connected = 1; fc->attr_version = 1; get_random_bytes(&fc->scramble_key, sizeof(fc->scramble_key)); + fc->pid_ns = get_pid_ns(task_active_pid_ns(current)); } EXPORT_SYMBOL_GPL(fuse_conn_init); @@ -617,6 +619,7 @@ void fuse_conn_put(struct fuse_conn *fc) if (atomic_dec_and_test(&fc->count)) { if (fc->destroy_req) fuse_request_free(fc->destroy_req); + put_pid_ns(fc->pid_ns); fc->release(fc); } }