From patchwork Sun Apr 3 21:57:00 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jeffrey Vander Stoep X-Patchwork-Id: 8743761 Return-Path: X-Original-To: patchwork-selinux@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id E2F2DC0554 for ; Mon, 4 Apr 2016 19:20:41 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 1FEC220272 for ; Mon, 4 Apr 2016 19:20:41 +0000 (UTC) Received: from emvm-gh1-uea09.nsa.gov (smtp.nsa.gov [8.44.101.9]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id AE9A22025A for ; Mon, 4 Apr 2016 19:20:39 +0000 (UTC) X-TM-IMSS-Message-ID: <519b43fe0006d288@nsa.gov> Received: from tarius.tycho.ncsc.mil ([144.51.242.1]) by nsa.gov ([10.208.42.194]) with ESMTP (TREND IMSS SMTP Service 7.1) id 519b43fe0006d288 ; Mon, 4 Apr 2016 15:00:04 -0400 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u34J0uXd024539; Mon, 4 Apr 2016 15:00:56 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u33LvXqK290391 for ; Sun, 3 Apr 2016 17:57:33 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u33LvXIQ021853 for ; Sun, 3 Apr 2016 17:57:33 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1C3AACDkQFXci/cVdFdHYRquRGDMQVSBxeFdoFwAQEBAQEBEwEKCxQfhHUBFRUZAQE3AYEUAQUBNSKIBZwFgTE+MYpPhSgBBIxLAQEBAQYCGAYKhA2CCYhXgnoLQIJDjkaJQIQtiVsCiSqFY41dL4EOglkNGYFqHDCGTYE9AQEB X-IPAS-Result: A1C3AACDkQFXci/cVdFdHYRquRGDMQVSBxeFdoFwAQEBAQEBEwEKCxQfhHUBFRUZAQE3AYEUAQUBNSKIBZwFgTE+MYpPhSgBBIxLAQEBAQYCGAYKhA2CCYhXgnoLQIJDjkaJQIQtiVsCiSqFY41dL4EOglkNGYFqHDCGTYE9AQEB X-IronPort-AV: E=Sophos;i="5.24,438,1454994000"; d="scan'208";a="5346713" Received: from emvm-gh1-uea09.nsa.gov ([10.208.42.194]) by goalie.tycho.ncsc.mil with ESMTP; 03 Apr 2016 17:57:32 -0400 X-TM-IMSS-Message-ID: <4d169428000614b0@nsa.gov> Received: from mail-pa0-f47.google.com (mail-pa0-f47.google.com [209.85.220.47]) by nsa.gov ([10.208.42.194]) with ESMTP (TREND IMSS SMTP Service 7.1; TLSv1/SSLv3 AES128-SHA (128/128)) id 4d169428000614b0 ; Sun, 3 Apr 2016 17:56:39 -0400 Received: by mail-pa0-f47.google.com with SMTP id tt10so129946512pab.3 for ; Sun, 03 Apr 2016 14:57:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20120113; h=from:to:cc:subject:date:message-id; bh=KrCpvw/BlbIqnf1XebN/avrC9BihhCqRJwGHmTVCnsg=; b=V+zGkdbbjtajANAKichsEnhTWzh6TDz0P2Cw7JIRsd2j90QlHIfgHWCTeVVwt4VCWL aBO7pRiicI8Tu4mb0du3NcARjlvCIiTgWtl8lUySyHfz+fjmaxR+MgjvYi6mfZEPnTI8 XxdB7hpgiZfHnXxdoLlMEXW1fhXFp7W301gWTfObuSJly6WVrTSl6vqUKqSNGdqv67Tn Zr+gY1jJP9G1sQTzBzoshEpwLNsYiXOkkHUJHekFVOqZZTQJIZHx6tr3ibTn3RHUCgVQ gm5vYRdxT+rL/NseHhChJhr68ZyFdUjcdUxQYWp9qtHsKdjT19UbikDffs2ydcwoIlDY vbAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=KrCpvw/BlbIqnf1XebN/avrC9BihhCqRJwGHmTVCnsg=; b=DxtgRWK6FnunGdDniU1hQPhiwHrKpM8cM8aRXwkMYX2Xgn6RvjNfHltPPuHPF8Y1Ep RA2XO2rXmcKg1duqpkCMVskXNM640yC0AgTqxm9lYzD1YY+Ic32qLGvhJCEcYUK/2LRe UKw8dzXDFvYpxfCV90m5rUcUDESfSGKqfH0uncbP0PeGH6ywAgnXtOuOJ9SeS0xm9qfQ YELu0+CDV28LAaAtUif/lAsv53TIj3ZZlhgBBQfmViW+tJOLdRgYC4jtLacjYtL3pccZ 9GJslEWanozvpm3dUN0LrANwomut+/H2C94KiqzqlD59WITsjztRJEM+50YVHjms+/Rc V+og== X-Gm-Message-State: AD7BkJJlPBPEkFbtW2hWXij5B+DRCiYavf8s/1DTVXsqWtjWiYSYS5/946DEqSiCfURzpIu9 X-Received: by 10.66.66.198 with SMTP id h6mr47621864pat.112.1459720651091; Sun, 03 Apr 2016 14:57:31 -0700 (PDT) Received: from jeffv-linux.mtv.corp.google.com ([172.22.112.85]) by smtp.gmail.com with ESMTPSA id 17sm34372426pfp.96.2016.04.03.14.57.29 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Sun, 03 Apr 2016 14:57:29 -0700 (PDT) From: Jeff Vander Stoep To: selinux@tycho.nsa.gov Subject: [PATCH v2] selinux: restrict kernel module loading Date: Sun, 3 Apr 2016 14:57:00 -0700 Message-Id: <1459720620-7987-1-git-send-email-jeffv@google.com> X-Mailer: git-send-email 2.8.0.rc3.226.g39d4020 X-TM-AS-MML: disable X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: sds@tycho.nsa.gov MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Utilize existing kernel_read_file hook on kernel module load. Add module_load permission to the system class. Enforces restrictions on kernel module origin when calling the finit_module syscall. The hook checks that source type has permission module_load for the target type. Example for finit_module: allow foo bar_file:system module_load; Similarly restrictions are enforced on kernel module loading when calling the init_module syscall. The hook checks that source type has permission module_load with itself as the target object because the kernel module is sourced from the calling process. Example for init_module: allow foo foo:system module_load; Signed-off-by: Jeff Vander Stoep --- v2: The target type for init_module changed from SECINITSID_KERNEL to the same type as the source. security/selinux/hooks.c | 52 +++++++++++++++++++++++++++++++++++++ security/selinux/include/classmap.h | 2 +- 2 files changed, 53 insertions(+), 1 deletion(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 3fa3ca5..f870c4d 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3719,6 +3719,57 @@ static int selinux_kernel_module_request(char *kmod_name) SYSTEM__MODULE_REQUEST, &ad); } +static int selinux_kernel_module_from_file(struct file *file) +{ + struct common_audit_data ad; + struct inode_security_struct *isec; + struct file_security_struct *fsec; + struct inode *inode; + u32 sid = current_sid(); + int rc; + + /* init_module */ + if (file == NULL) { + rc = avc_has_perm(sid, sid, SECCLASS_SYSTEM, + SYSTEM__MODULE_LOAD, NULL); + goto out; + } + + /* finit_module */ + ad.type = LSM_AUDIT_DATA_PATH; + ad.u.path = file->f_path; + + inode = file_inode(file); + isec = inode->i_security; + fsec = file->f_security; + + if (sid != fsec->sid) { + rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad); + if (rc) + goto out; + } + + rc = avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM, + SYSTEM__MODULE_LOAD, &ad); +out: + return rc; +} + +static selinux_kernel_read_file(struct file *file, enum kernel_read_file_id id) +{ + int rc = 0; + + switch (id) { + case READING_MODULE: + rc = selinux_kernel_module_from_file(file); + break; + default: + break; + } + + return rc; +} + static int selinux_task_setpgid(struct task_struct *p, pid_t pgid) { return current_has_perm(p, PROCESS__SETPGID); @@ -6022,6 +6073,7 @@ static struct security_hook_list selinux_hooks[] = { LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as), LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as), LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request), + LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file), LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid), LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid), LSM_HOOK_INIT(task_getsid, selinux_task_getsid), diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h index ef83c4b..8fbd138 100644 --- a/security/selinux/include/classmap.h +++ b/security/selinux/include/classmap.h @@ -32,7 +32,7 @@ struct security_class_mapping secclass_map[] = { "setsockcreate", NULL } }, { "system", { "ipc_info", "syslog_read", "syslog_mod", - "syslog_console", "module_request", NULL } }, + "syslog_console", "module_request", "module_load", NULL } }, { "capability", { "chown", "dac_override", "dac_read_search", "fowner", "fsetid", "kill", "setgid", "setuid", "setpcap",