From patchwork Mon Jul 15 16:04:48 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Micah Morton X-Patchwork-Id: 11044491 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id ABEA913B1 for ; Mon, 15 Jul 2019 16:05:01 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 9A5FD27F3E for ; Mon, 15 Jul 2019 16:05:01 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 8DF6B284D4; Mon, 15 Jul 2019 16:05:01 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-7.0 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 1E08927F3E for ; Mon, 15 Jul 2019 16:05:01 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729674AbfGOQFA (ORCPT ); Mon, 15 Jul 2019 12:05:00 -0400 Received: from mail-io1-f67.google.com ([209.85.166.67]:33004 "EHLO mail-io1-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729533AbfGOQFA (ORCPT ); Mon, 15 Jul 2019 12:05:00 -0400 Received: by mail-io1-f67.google.com with SMTP id z3so34997095iog.0 for ; Mon, 15 Jul 2019 09:04:59 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=mime-version:from:date:message-id:subject:to; bh=abd3MzgGdND+mibf+9QP7+SAzCXmIg9aBJBUAlhxoSE=; b=Vx5UHmP4FSl+2sW2xSMATHmt/TstgDDB2D2BYOmRytxQn8jrzjv9CHvBN6ziokACKV yzABsXIgYMdyMShtxK0HrEeZ6yqmlt1ErRBouLjdWGCgNDX8nI3gIQGZ6TbZfGsRZAHQ G91t8osAi33e15JefGOz/Q8Tfy03uYvccBxHc= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:from:date:message-id:subject:to; bh=abd3MzgGdND+mibf+9QP7+SAzCXmIg9aBJBUAlhxoSE=; b=SmccNtKR07DWU/tadN3VCHn7FM8KcU78dICb/Ign6EfKHISy8E8fSck0FyIi+S1wzu XknQPxFi+PC5w2cpav5totXcXa3bkdbfxDKyRBJez3GFymiC+Y8nVXxSZ6bedun+Oshr bM0UzvPhoAYIgYXqX7HulAkbwRBaynsJbgKagiNUqa5HFVKT4PI3prTKjq0foIxh98g2 q8fJReMwlmORoCRjR97LEqR/iRMbrxu5xMWe5trFpRD2fZnO8pVO1CN7JZ46aJamKbU7 AuX10gjx8Q9OiGDzOhv8UcW0EsL6iMDUHEzdJkmFuC8zsWAbADtZW6ieWXer+D8ErZoW QXEw== X-Gm-Message-State: APjAAAWTfQ8DRdx1PNoGKysKL3GtntraEqeWzzANds296pH+VZuFO/Af QO+uWCeB94VNHVh3jzFx/pXxns/KHCsxubC6bZ8MBw== X-Google-Smtp-Source: APXvYqxIWrDZQA5aJHb2ZwP6MlOqQQByu0F7zWYD236UlUTqOmdsc6Xfpir6+WTeVaRUAFknNlgvqiYC7RyKKDGoS4g= X-Received: by 2002:a05:6638:81:: with SMTP id v1mr27332807jao.72.1563206699374; Mon, 15 Jul 2019 09:04:59 -0700 (PDT) MIME-Version: 1.0 From: Micah Morton Date: Mon, 15 Jul 2019 09:04:48 -0700 Message-ID: Subject: [GIT PULL] SafeSetID LSM changes for 5.3 To: torvalds@linux-foundation.org, Linux Kernel Mailing List , linux-security-module Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Hi Linus, I'm maintaining the new SafeSetID LSM and was told to set up my own tree for sending pull requests rather than sending my changes through James Morris and the security subsystem tree. This is my first time doing one of these pull requests so hopefully I didn't screw something up. Thanks, Micah --- The following changes since commit fec88ab0af9706b2201e5daf377c5031c62d11f7: Merge tag 'for-linus-hmm' of git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma (2019-07-14 19:42:11 -0700) are available in the Git repository at: https://github.com/micah-morton/linux.git tags/safesetid-5.3 for you to fetch changes up to e10337daefecb47209fd2af5f4fab0d1a370737f: LSM: SafeSetID: fix use of literal -1 in capable hook (2019-07-15 08:08:03 -0700) ---------------------------------------------------------------- SafeSetID patches for 5.3 These changes from Jann Horn fix a couple issues in the recently added SafeSetID LSM: (1) There was a simple logic bug in one of the hooks for the LSM where the code was incorrectly returning early in some cases before all security checks had been passed. (2) There was a more high level issue with how this LSM gets configured that could allow for a program to bypass the security restrictions by switching to an allowed UID and then again to any other UID on the system if the target UID of the first transition is unconstrained on the system. Luckily this is an easy fix that we now enforce at the time the LSM gets configured. There are also some changes from Jann that make policy updates for this LSM atomic. Kees Cook, Jann and myself have reviewed these changes and they look good from our point of view. Signed-off-by: Micah Morton ---------------------------------------------------------------- Jann Horn (10): LSM: SafeSetID: fix pr_warn() to include newline LSM: SafeSetID: fix check for setresuid(new1, new2, new3) LSM: SafeSetID: refactor policy hash table LSM: SafeSetID: refactor safesetid_security_capable() LSM: SafeSetID: refactor policy parsing LSM: SafeSetID: fix userns handling in securityfs LSM: SafeSetID: rewrite userspace API to atomic updates LSM: SafeSetID: add read handler LSM: SafeSetID: verify transitive constrainedness LSM: SafeSetID: fix use of literal -1 in capable hook security/safesetid/lsm.c | 276 +++++++++++++----------------------------- security/safesetid/lsm.h | 34 ++++-- security/safesetid/securityfs.c | 307 +++++++++++++++++++++++++++++------------------ tools/testing/selftests/safesetid/safesetid-test.c | 18 ++- 4 files changed, 306 insertions(+), 329 deletions(-)