From: ebiederm@xmission.com (Eric W. Biederman) To: Stephen Smalley <sds@tycho.nsa.gov> Cc: Andrew Morton <akpm@osdl.org>, Ingo Molnar <mingo@elte.hu>, tglx@linutronix.de, linux-kernel@vger.kernel.org, selinux@tycho.nsa.gov, jmorris@namei.org Subject: Re: [PATCH 2/2] sysctl: Restore the selinux path based label lookup for sysctls. Date: Wed, 07 Feb 2007 15:21:02 -0700 [thread overview] Message-ID: <m17iutobht.fsf@ebiederm.dsl.xmission.com> (raw) In-Reply-To: <1170885244.11912.168.camel@moss-spartans.epoch.ncsc.mil> (Stephen Smalley's message of "Wed, 07 Feb 2007 16:54:04 -0500") Stephen Smalley <sds@tycho.nsa.gov> writes: > Actually, on further inspection, it looks like the real issue is the > "path" name generation; "cat /proc/sys/kernel/modprobe" yields a call to > security_genfs_sid() with just "/modprobe" rather than the expected > "/sys/kernel/modprobe". Which likewise leaves us with the generic proc > label, just as with the inode permission check, so I end up seeing > checks against it only. Ok. It looks like two silly thing are going on here. I failed to register the root sysctl table, so none of the parent pointers got set. I didn't prepend /sys in the compatibility code, so for something with the parent pointers set you would have gotten "/kernel/modprobe" instead of /sys/kernel/modprobe" Sorry about that. I think the patch below will fix it. Eric diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h index 24f36f1..f316854 100644 --- a/include/linux/sysctl.h +++ b/include/linux/sysctl.h @@ -929,8 +929,6 @@ extern struct ctl_table_header *sysctl_head_next(struct ctl_table_header *prev); extern void sysctl_head_finish(struct ctl_table_header *prev); extern int sysctl_perm(struct ctl_table *table, int op); -extern void sysctl_init(void); - typedef struct ctl_table ctl_table; typedef int ctl_handler (ctl_table *table, int __user *name, int nlen, diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 0a5499f..0bb2c5f 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1241,6 +1241,14 @@ static void sysctl_set_parent(struct ctl_table *parent, struct ctl_table *table) } } +static __init int sysctl_init(void) +{ + sysctl_set_parent(NULL, root_table); + return 0; +} + +core_initcall(sysctl_init); + /** * register_sysctl_table - register a sysctl hierarchy * @table: the top-level table structure diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index c17a8dd..aad2697 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1452,6 +1452,12 @@ static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid) path = end; table = table->parent; } + buflen -= 4; + if (buflen < 0) + goto out_free; + end -= 4; + memcpy(end, "/sys", 4); + path = end; rc = security_genfs_sid("proc", path, tclass, sid); out_free: free_page((unsigned long)buffer);
WARNING: multiple messages have this Message-ID (diff)
From: ebiederm@xmission.com (Eric W. Biederman) To: Stephen Smalley <sds@tycho.nsa.gov> Cc: Andrew Morton <akpm@osdl.org>, Ingo Molnar <mingo@elte.hu>, tglx@linutronix.de, linux-kernel@vger.kernel.org, selinux@tycho.nsa.gov, jmorris@namei.org Subject: Re: [PATCH 2/2] sysctl: Restore the selinux path based label lookup for sysctls. Date: Wed, 07 Feb 2007 15:21:02 -0700 [thread overview] Message-ID: <m17iutobht.fsf@ebiederm.dsl.xmission.com> (raw) In-Reply-To: <1170885244.11912.168.camel@moss-spartans.epoch.ncsc.mil> (Stephen Smalley's message of "Wed, 07 Feb 2007 16:54:04 -0500") Stephen Smalley <sds@tycho.nsa.gov> writes: > Actually, on further inspection, it looks like the real issue is the > "path" name generation; "cat /proc/sys/kernel/modprobe" yields a call to > security_genfs_sid() with just "/modprobe" rather than the expected > "/sys/kernel/modprobe". Which likewise leaves us with the generic proc > label, just as with the inode permission check, so I end up seeing > checks against it only. Ok. It looks like two silly thing are going on here. I failed to register the root sysctl table, so none of the parent pointers got set. I didn't prepend /sys in the compatibility code, so for something with the parent pointers set you would have gotten "/kernel/modprobe" instead of /sys/kernel/modprobe" Sorry about that. I think the patch below will fix it. Eric diff --git a/include/linux/sysctl.h b/include/linux/sysctl.h index 24f36f1..f316854 100644 --- a/include/linux/sysctl.h +++ b/include/linux/sysctl.h @@ -929,8 +929,6 @@ extern struct ctl_table_header *sysctl_head_next(struct ctl_table_header *prev); extern void sysctl_head_finish(struct ctl_table_header *prev); extern int sysctl_perm(struct ctl_table *table, int op); -extern void sysctl_init(void); - typedef struct ctl_table ctl_table; typedef int ctl_handler (ctl_table *table, int __user *name, int nlen, diff --git a/kernel/sysctl.c b/kernel/sysctl.c index 0a5499f..0bb2c5f 100644 --- a/kernel/sysctl.c +++ b/kernel/sysctl.c @@ -1241,6 +1241,14 @@ static void sysctl_set_parent(struct ctl_table *parent, struct ctl_table *table) } } +static __init int sysctl_init(void) +{ + sysctl_set_parent(NULL, root_table); + return 0; +} + +core_initcall(sysctl_init); + /** * register_sysctl_table - register a sysctl hierarchy * @table: the top-level table structure diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index c17a8dd..aad2697 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -1452,6 +1452,12 @@ static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid) path = end; table = table->parent; } + buflen -= 4; + if (buflen < 0) + goto out_free; + end -= 4; + memcpy(end, "/sys", 4); + path = end; rc = security_genfs_sid("proc", path, tclass, sid); out_free: free_page((unsigned long)buffer); -- This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with the words "unsubscribe selinux" without quotes as the message.
next prev parent reply other threads:[~2007-02-07 22:22 UTC|newest] Thread overview: 69+ messages / expand[flat|nested] mbox.gz Atom feed top 2007-01-28 1:05 + clocksource-add-verification-watchdog-helper-fix-3.patch added to -mm tree akpm [not found] ` <20070127172410.2b041952.akpm@osdl.org> [not found] ` <1169972718.17469.164.camel@localhost.localdomain> [not found] ` <20070128003549.2ca38dc8.akpm@osdl.org> [not found] ` <20070128093358.GA2071@elte.hu> [not found] ` <20070128095712.GA6485@elte.hu> [not found] ` <20070128100627.GA8416@elte.hu> [not found] ` <20070128104548.a835d859.akpm@osdl.org> 2007-01-28 19:21 ` [PATCH] sysctl selinux: Don't look at table->de Eric W. Biederman 2007-01-28 19:21 ` Eric W. Biederman 2007-01-29 13:04 ` Stephen Smalley 2007-01-29 13:04 ` Stephen Smalley 2007-01-29 15:23 ` James Morris 2007-01-29 15:23 ` James Morris 2007-01-29 17:55 ` Eric W. Biederman 2007-01-29 17:55 ` Eric W. Biederman 2007-01-29 19:26 ` Stephen Smalley 2007-01-29 19:26 ` Stephen Smalley 2007-01-29 17:43 ` Eric W. Biederman 2007-01-29 17:43 ` Eric W. Biederman 2007-01-29 18:43 ` Stephen Smalley 2007-01-29 18:43 ` Stephen Smalley 2007-01-29 19:08 ` Casey Schaufler 2007-01-29 19:08 ` Casey Schaufler 2007-01-29 20:07 ` Stephen Smalley 2007-01-29 20:07 ` Stephen Smalley 2007-01-30 10:25 ` Christoph Hellwig 2007-01-30 17:19 ` Casey Schaufler 2007-01-30 17:19 ` Casey Schaufler 2007-01-29 19:16 ` Eric W. Biederman 2007-01-29 19:16 ` Eric W. Biederman 2007-01-29 23:28 ` Russell Coker 2007-01-29 23:28 ` Russell Coker 2007-02-06 21:16 ` [PATCH 1/2] sysctl: Add a parent entry to ctl_table and set the parent entry Eric W. Biederman 2007-02-06 21:16 ` Eric W. Biederman 2007-02-06 21:21 ` [PATCH 2/2] sysctl: Restore the selinux path based label lookup for sysctls Eric W. Biederman 2007-02-06 21:21 ` Eric W. Biederman 2007-02-07 18:24 ` Stephen Smalley 2007-02-07 18:24 ` Stephen Smalley 2007-02-07 21:12 ` Stephen Smalley 2007-02-07 21:12 ` Stephen Smalley 2007-02-07 21:54 ` Stephen Smalley 2007-02-07 21:54 ` Stephen Smalley 2007-02-07 22:21 ` Eric W. Biederman [this message] 2007-02-07 22:21 ` Eric W. Biederman 2007-02-08 15:07 ` Stephen Smalley 2007-02-08 15:07 ` Stephen Smalley 2007-02-08 1:57 ` Eric W. Biederman 2007-02-08 1:57 ` Eric W. Biederman 2007-02-08 15:01 ` Stephen Smalley 2007-02-08 15:01 ` Stephen Smalley 2007-02-08 17:53 ` Eric W. Biederman 2007-02-08 17:53 ` Eric W. Biederman 2007-02-08 18:13 ` Stephen Smalley 2007-02-08 18:13 ` Stephen Smalley 2007-02-08 22:17 ` Eric W. Biederman 2007-02-08 22:17 ` Eric W. Biederman 2007-02-08 22:51 ` [PATCH 0/5] sysctl cleanup selinux fixes Eric W. Biederman 2007-02-08 22:51 ` Eric W. Biederman 2007-02-08 22:53 ` [PATCH 1/5] sysctl: Remove declaration of nonexistent sysctl_init() Eric W. Biederman 2007-02-08 22:53 ` Eric W. Biederman 2007-02-08 22:54 ` [PATCH 2/5] sysctl: Set the parent field in the root sysctl table Eric W. Biederman 2007-02-08 22:54 ` Eric W. Biederman 2007-02-08 22:55 ` [PATCH 3/5] sysctl: Fix the selinux_sysctl_get_sid Eric W. Biederman 2007-02-08 22:55 ` Eric W. Biederman 2007-02-08 23:02 ` [PATCH 4/5] selinux: Enhance selinux to always ignore private inodes Eric W. Biederman 2007-02-08 23:02 ` Eric W. Biederman 2007-02-08 23:04 ` [PATCH 5/5] sysctl: Hide the sysctl proc inodes from selinux Eric W. Biederman 2007-02-08 23:04 ` Eric W. Biederman 2007-02-09 12:26 ` [PATCH 4/5] selinux: Enhance selinux to always ignore private inodes Stephen Smalley 2007-02-09 12:26 ` Stephen Smalley 2007-02-09 12:24 ` [PATCH 3/5] sysctl: Fix the selinux_sysctl_get_sid Stephen Smalley 2007-02-09 12:24 ` Stephen Smalley 2007-02-09 11:05 ` [PATCH 0/5] sysctl cleanup selinux fixes Andrew Morton 2007-02-09 18:09 ` Eric W. Biederman 2007-02-09 18:09 ` Eric W. Biederman
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=m17iutobht.fsf@ebiederm.dsl.xmission.com \ --to=ebiederm@xmission.com \ --cc=akpm@osdl.org \ --cc=jmorris@namei.org \ --cc=linux-kernel@vger.kernel.org \ --cc=mingo@elte.hu \ --cc=sds@tycho.nsa.gov \ --cc=selinux@tycho.nsa.gov \ --cc=tglx@linutronix.de \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.