From patchwork Tue Apr 26 19:36:22 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Seth Forshee X-Patchwork-Id: 8944561 Return-Path: X-Original-To: patchwork-selinux@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id E80FCBF29F for ; Tue, 26 Apr 2016 20:12:56 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id D75C7201FE for ; Tue, 26 Apr 2016 20:12:55 +0000 (UTC) Received: from emsm-gh1-uea11.nsa.gov (emsm-gh1-uea11.nsa.gov [8.44.101.9]) by mail.kernel.org (Postfix) with ESMTP id A09F320138 for ; Tue, 26 Apr 2016 20:12:54 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.24,538,1454976000"; d="scan'208";a="15644076" IronPort-PHdr: =?us-ascii?q?9a23=3AYTcbHxM6D7H9QLdRr+Ul6mtUPXoX/o7sNwtQ0KIM?= =?us-ascii?q?zox0Kf//rarrMEGX3/hxlliBBdydsKIUzbWH+Pm7ByQp2tWojjMrSNR0TRgLiM?= =?us-ascii?q?EbzUQLIfWuLgnFFsPsdDEwB89YVVVorDmROElRH9viNRWJ+iXhpQAbFhi3Dwdp?= =?us-ascii?q?POO9QteU1JTnkb/jsMSIPU1hv3mUX/BbFF2OtwLft80b08NJC50a7V/3mEZOYP?= =?us-ascii?q?lc3mhyJFiezF7W78a0+4N/oWwL46pyv+YJa6jxfrw5QLpEF3xmdjltvIy4/SXE?= =?us-ascii?q?GEGi/HoXGlpQ2jBJDgTI9hTzWN255ibwt+dx1TOfFd3zTKsvWDOkqaxsTUmswA?= =?us-ascii?q?wOLDMouFrcisVtgqZWulr1rBVkzp/8e4qVPedweq7HONgTA2FGW5ACeTZGB9aH?= =?us-ascii?q?YpcPR8QGJ/1YooS180ADsRv4Cw62H+PixxdDj3nx26wx2uBnGgbDil9zV+kSuW?= =?us-ascii?q?jZ+Y2mfJwZVvq4meyRlW3O?= X-IPAS-Result: =?us-ascii?q?A2EKBQBzyh9X/wHyM5BeHAGCcCuBULt3H4F2g3iBTUwBAQE?= =?us-ascii?q?BAQECAmIngi19Wz0BAQEDAQIPFRMGAQEMIAsBAgMJAQEXKQgIAwEtAwEFAQsRB?= =?us-ascii?q?gEHCwUYBAGICAGlVYExPjGKT4UoAQSMRgEBAQcBAQEBFgYKhA2CCohaEQGFdAG?= =?us-ascii?q?HcwWGVD6JCoFVjESBZYdFJQyFNI1yMIEOYoIFG4FpTgGHeIE1AQEB?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea11.nsa.gov with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 26 Apr 2016 20:12:53 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u3QKCqXH021864; Tue, 26 Apr 2016 16:12:53 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u3QJb1B5172306 for ; Tue, 26 Apr 2016 15:37:01 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u3QJakxv011587 for ; Tue, 26 Apr 2016 15:37:01 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A0A+BQD9wR9X/yUp0ApeHYJwK4FQt3CEEYYPAoFATAEBAQEBAWYnhEIBAQEDEhUZAQE3AQ9RNAEFARwGARIiiAgBpVeBMT4xik+FKAEEjEoBAQEBAQEBAwIBFwYKhA2CCo5gh3QFhlQ+iQqBVYxEgWWHRTGFNI1yMIEOYoF4DRuBaU4BiS0BAQE X-IPAS-Result: A0A+BQD9wR9X/yUp0ApeHYJwK4FQt3CEEYYPAoFATAEBAQEBAWYnhEIBAQEDEhUZAQE3AQ9RNAEFARwGARIiiAgBpVeBMT4xik+FKAEEjEoBAQEBAQEBAwIBFwYKhA2CCo5gh3QFhlQ+iQqBVYxEgWWHRTGFNI1yMIEOYoF4DRuBaU4BiS0BAQE X-IronPort-AV: E=Sophos;i="5.24,537,1454994000"; d="scan'208";a="5410383" Received: from emsm-gh1-uea11.corp.nsa.gov (HELO emsm-gh1-uea11.nsa.gov) ([10.208.41.37]) by goalie.tycho.ncsc.mil with ESMTP; 26 Apr 2016 15:37:01 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3AHU2Z8B+S5r0Uhv9uRHKM819IXTAuvvDOBiVQ1KB8?= =?us-ascii?q?0O4cTK2v8tzYMVDF4r011RmSDdWdtKMP0rGO+4nbGkU+or+5+EgYd5JNUxJXwe?= =?us-ascii?q?43pCcHRPC/NEvgMfTxZDY7FskRHHVs/nW8LFQHUJ2mPw6anHS+4HYoFwnlMkIt?= =?us-ascii?q?f6KuSt6U0JX8jrvqs7ToICx2xxOFKYtoKxu3qQiD/uI3uqBFbpgL9x3Sv3FTcP?= =?us-ascii?q?5Xz247bXianhL7+9vitMU7q3cYk7sb+sVBSaT3ebgjBfwdVWx+cjN92Mq+/zTZ?= =?us-ascii?q?TADH2T1UeGQbnhdSBgHDplmuU53wvyf3rO9VyCybJtb3SrZyUjOnueMjYxbzhT?= =?us-ascii?q?ZPDDU5+XzZjsFqxPZQqQmstjRkyI7dfY+ROeA7daqbdtQfEzlvRMFUAhdMHoP0?= =?us-ascii?q?QYwVFOoMMK4MtIThpx0AqgGlBQShLOjmzDhOh3T/2esx1OF3QlKO5xApA99b6C?= =?us-ascii?q?ecl97yLqpHFLntlKQ=3D?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0HzAAD9wR9Xj6zVVdFeHYJwgXu3cIQRg?= =?us-ascii?q?g2EAgKBQEwBAQEBAQECAg8BAQEBBwsLCSEvgi19Wz0BAQEDEhUZAQE3AQ9RNAE?= =?us-ascii?q?FARwGARIiiAgBpVeBMT4xik+FKAEEjEoBAQEBAQEBAwIBFwYKhA2CCo5gh3QFh?= =?us-ascii?q?lQ+iQqBVYxEgWWHRTGFNI1yMIEOgloNEQqBaU4BiS0BAQE?= X-IPAS-Result: =?us-ascii?q?A0HzAAD9wR9Xj6zVVdFeHYJwgXu3cIQRgg2EAgKBQEwBAQE?= =?us-ascii?q?BAQECAg8BAQEBBwsLCSEvgi19Wz0BAQEDEhUZAQE3AQ9RNAEFARwGARIiiAgBp?= =?us-ascii?q?VeBMT4xik+FKAEEjEoBAQEBAQEBAwIBFwYKhA2CCo5gh3QFhlQ+iQqBVYxEgWW?= =?us-ascii?q?HRTGFNI1yMIEOgloNEQqBaU4BiS0BAQE?= X-IronPort-AV: E=Sophos;i="5.24,537,1454976000"; d="scan'208";a="15642553" Received: from mail-ig0-f172.google.com ([209.85.213.172]) by emsm-gh1-uea11.nsa.gov with ESMTP/TLS/AES128-GCM-SHA256; 26 Apr 2016 19:37:00 +0000 Received: by mail-ig0-f172.google.com with SMTP id bi2so107337654igb.0 for ; Tue, 26 Apr 2016 12:37:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical-com.20150623.gappssmtp.com; s=20150623; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=aeG73OW9Xy1CAYW4s8YPsK1DWTEX4M6k8ROnPiImiQM=; b=dJVxu8CvR2IOnLiMj+nVhBBC3n8eJq/E/4Y+nwv8uyMy2EYW4Hs1l1Fw4IqD9NtpV/ ARLRjLtZ6VjapiRvzdMChXO0glLFF6hR5Z6weArYdRmZSaG18ZKObaCBVKwxSf6RPmIu 4iH+xXI0RDmJSWFko93KB2GD3dpkCmn0oUKjAPYQKO3BtcsY62/Y0a4rbKSMppqOSRIj mabfPjmUdAGnqEkTvIlZ3/yyPBCEgEmrBNE2cknP40OefG9Eu1kuvcw5OrhrxFR+fQK2 N6b533hcp8qAZDyMDMS8ytioZnfDxvvqhPT5M/xsmiIfW6jO1e58XFNczXqc2f77yD+g Im2Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=aeG73OW9Xy1CAYW4s8YPsK1DWTEX4M6k8ROnPiImiQM=; b=St6DjLq7gdQuaCV8e9bXn+9dusnMwvHG5GWbXT8kwYzBn5aXbUC1KJCi3l6Hh/qpsa xpoin0Du4y1V1Cij1WXZU0Yq83Giu2hSqzcrQtUzc1PVTf9/TKqFPEO8s0hadHMLnY28 IWAs/mQJSP65bHpKLW0caeYv/kE1cNFgSTblL2vh2BI0hXwChTrkmuT/DCTNAazULR4t FgfjaBYPyFS85egVHntrakhxUVPcXNJWcichanA+o6B9PlrAlKggqgZ5tXUDfJguPI2v 8E/8tYcLJyaDFlJ8L7JjzieacCjSBK+e2gSh/zsHnibdMp0L83yXPUEi75hIPj+XTkFf 1T4g== X-Gm-Message-State: AOPr4FVgnicC6OrSLJrYgZUIfRFHZvzlxllcfhtsE9mBH1dxQCKhx0yHsjzpu8xbQ6vVtGa/ X-Received: by 10.50.90.193 with SMTP id by1mr6096716igb.53.1461699419567; Tue, 26 Apr 2016 12:36:59 -0700 (PDT) Received: from localhost ([2605:a601:aab:f920:39a1:5bcf:aa:5b00]) by smtp.gmail.com with ESMTPSA id uh3sm2375581igb.3.2016.04.26.12.36.58 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 26 Apr 2016 12:36:58 -0700 (PDT) From: Seth Forshee To: "Eric W. Biederman" , Casey Schaufler Subject: [PATCH v4 09/21] Smack: Handle labels consistently in untrusted mounts Date: Tue, 26 Apr 2016 14:36:22 -0500 Message-Id: <1461699396-33000-10-git-send-email-seth.forshee@canonical.com> X-Mailer: git-send-email 2.7.4 In-Reply-To: <1461699396-33000-1-git-send-email-seth.forshee@canonical.com> References: <1461699396-33000-1-git-send-email-seth.forshee@canonical.com> X-Mailman-Approved-At: Tue, 26 Apr 2016 16:11:01 -0400 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Post: List-Help: Cc: linux-bcache@vger.kernel.org, Serge Hallyn , Seth Forshee , James Morris , dm-devel@redhat.com, Miklos Szeredi , Richard Weinberger , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, linux-raid@vger.kernel.org, fuse-devel@lists.sourceforge.net, Austin S Hemmelgarn , linux-mtd@lists.infradead.org, Alexander Viro , selinux@tycho.nsa.gov, linux-fsdevel@vger.kernel.org, cgroups@vger.kernel.org, Pavel Tikhomirov MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED, RP_MATCHES_RCVD, T_DKIM_INVALID, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled differently in untrusted mounts. This is confusing and potentically problematic. Change this to handle them all the same way that SMACK64 is currently handled; that is, read the label from disk and check it at use time. For SMACK64 and SMACK64MMAP access is denied if the label does not match smk_root. To be consistent with suid, a SMACK64EXEC label which does not match smk_root will still allow execution of the file but will not run with the label supplied in the xattr. Signed-off-by: Seth Forshee Acked-by: Casey Schaufler --- security/smack/smack_lsm.c | 29 +++++++++++++++++++---------- 1 file changed, 19 insertions(+), 10 deletions(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index aa17198cd5f2..ca564590cc1b 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -919,6 +919,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) struct inode *inode = file_inode(bprm->file); struct task_smack *bsp = bprm->cred->security; struct inode_smack *isp; + struct superblock_smack *sbsp; int rc; if (bprm->cred_prepared) @@ -928,6 +929,11 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task) return 0; + sbsp = inode->i_sb->s_security; + if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) && + isp->smk_task != sbsp->smk_root) + return 0; + if (bprm->unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) { struct task_struct *tracer; rc = 0; @@ -1725,6 +1731,7 @@ static int smack_mmap_file(struct file *file, struct task_smack *tsp; struct smack_known *okp; struct inode_smack *isp; + struct superblock_smack *sbsp; int may; int mmay; int tmay; @@ -1736,6 +1743,10 @@ static int smack_mmap_file(struct file *file, isp = file_inode(file)->i_security; if (isp->smk_mmap == NULL) return 0; + sbsp = file_inode(file)->i_sb->s_security; + if (sbsp->smk_flags & SMK_SB_UNTRUSTED && + isp->smk_mmap != sbsp->smk_root) + return -EACCES; mkp = isp->smk_mmap; tsp = current_security(); @@ -3546,16 +3557,14 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) if (rc >= 0) transflag = SMK_INODE_TRANSMUTE; } - if (!(sbsp->smk_flags & SMK_SB_UNTRUSTED)) { - /* - * Don't let the exec or mmap label be "*" or "@". - */ - skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); - if (IS_ERR(skp) || skp == &smack_known_star || - skp == &smack_known_web) - skp = NULL; - isp->smk_task = skp; - } + /* + * Don't let the exec or mmap label be "*" or "@". + */ + skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); + if (IS_ERR(skp) || skp == &smack_known_star || + skp == &smack_known_web) + skp = NULL; + isp->smk_task = skp; skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp); if (IS_ERR(skp) || skp == &smack_known_star ||