From: Seth Forshee <seth.forshee@canonical.com> To: "Eric W. Biederman" <ebiederm@xmission.com>, Alexander Viro <viro@zeniv.linux.org.uk>, Casey Schaufler <casey@schaufler-ca.com> Cc: Serge Hallyn <serge.hallyn@canonical.com>, Andy Lutomirski <luto@amacapital.net>, Seth Forshee <seth.forshee@canonical.com>, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, linux-kernel@vger.kernel.org, James Morris <james.l.morris@oracle.com>, "Serge E. Hallyn" <serge@hallyn.com> Subject: [PATCH 7/7] smack: Don't use security labels for user namespace mounts Date: Wed, 15 Jul 2015 14:46:08 -0500 [thread overview] Message-ID: <1436989569-69582-8-git-send-email-seth.forshee@canonical.com> (raw) In-Reply-To: <1436989569-69582-1-git-send-email-seth.forshee@canonical.com> Avoid use of untrusted security labels when s_user_ns != init_user_ns: - smk_fetch: refuse to read labels from disk - smack_inode_init_security: return -ENOTSUPP - smack_d_instantiate: don't use security xattrs from disk Signed-off-by: Seth Forshee <seth.forshee@canonical.com> --- security/smack/smack_lsm.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index a143328f75eb..6a849da94f47 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -255,6 +255,9 @@ static struct smack_known *smk_fetch(const char *name, struct inode *ip, char *buffer; struct smack_known *skp = NULL; + if (ip->i_sb->s_user_ns != &init_user_ns) + return NULL; + if (ip->i_op->getxattr == NULL) return ERR_PTR(-EOPNOTSUPP); @@ -833,6 +836,9 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir, struct smack_known *dsp = smk_of_inode(dir); int may; + if (inode->i_sb->s_user_ns != &init_user_ns) + return -ENOTSUPP; + if (name) *name = XATTR_SMACK_SUFFIX; @@ -3176,11 +3182,13 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) } /* * No xattr support means, alas, no SMACK label. - * Use the aforeapplied default. + * Use the aforeapplied default. Also don't use + * xattrs from userns mounts. * It would be curious if the label of the task * does not match that assigned. */ - if (inode->i_op->getxattr == NULL) + if (inode->i_sb->s_user_ns != &init_user_ns || + inode->i_op->getxattr == NULL) break; /* * Get the dentry for xattr. -- 1.9.1
WARNING: multiple messages have this Message-ID (diff)
From: Seth Forshee <seth.forshee@canonical.com> To: "Eric W. Biederman" <ebiederm@xmission.com>, Alexander Viro <viro@zeniv.linux.org.uk>, Casey Schaufler <casey@schaufler-ca.com> Cc: Serge Hallyn <serge.hallyn@canonical.com>, James Morris <james.l.morris@oracle.com>, linux-kernel@vger.kernel.org, Andy Lutomirski <luto@amacapital.net>, Seth Forshee <seth.forshee@canonical.com>, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov, linux-fsdevel@vger.kernel.org Subject: [PATCH 7/7] smack: Don't use security labels for user namespace mounts Date: Wed, 15 Jul 2015 14:46:08 -0500 [thread overview] Message-ID: <1436989569-69582-8-git-send-email-seth.forshee@canonical.com> (raw) In-Reply-To: <1436989569-69582-1-git-send-email-seth.forshee@canonical.com> Avoid use of untrusted security labels when s_user_ns != init_user_ns: - smk_fetch: refuse to read labels from disk - smack_inode_init_security: return -ENOTSUPP - smack_d_instantiate: don't use security xattrs from disk Signed-off-by: Seth Forshee <seth.forshee@canonical.com> --- security/smack/smack_lsm.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index a143328f75eb..6a849da94f47 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -255,6 +255,9 @@ static struct smack_known *smk_fetch(const char *name, struct inode *ip, char *buffer; struct smack_known *skp = NULL; + if (ip->i_sb->s_user_ns != &init_user_ns) + return NULL; + if (ip->i_op->getxattr == NULL) return ERR_PTR(-EOPNOTSUPP); @@ -833,6 +836,9 @@ static int smack_inode_init_security(struct inode *inode, struct inode *dir, struct smack_known *dsp = smk_of_inode(dir); int may; + if (inode->i_sb->s_user_ns != &init_user_ns) + return -ENOTSUPP; + if (name) *name = XATTR_SMACK_SUFFIX; @@ -3176,11 +3182,13 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) } /* * No xattr support means, alas, no SMACK label. - * Use the aforeapplied default. + * Use the aforeapplied default. Also don't use + * xattrs from userns mounts. * It would be curious if the label of the task * does not match that assigned. */ - if (inode->i_op->getxattr == NULL) + if (inode->i_sb->s_user_ns != &init_user_ns || + inode->i_op->getxattr == NULL) break; /* * Get the dentry for xattr. -- 1.9.1
next prev parent reply other threads:[~2015-07-15 19:47 UTC|newest] Thread overview: 210+ messages / expand[flat|nested] mbox.gz Atom feed top 2015-07-15 19:46 [PATCH 0/7] Initial support for user namespace owned mounts Seth Forshee 2015-07-15 19:46 ` Seth Forshee 2015-07-15 19:46 ` [PATCH 1/7] fs: Add user namesapace member to struct super_block Seth Forshee 2015-07-15 19:46 ` Seth Forshee 2015-07-16 2:47 ` Eric W. Biederman 2015-07-16 2:47 ` Eric W. Biederman 2015-08-05 21:03 ` Seth Forshee 2015-08-05 21:03 ` Seth Forshee 2015-08-05 21:19 ` Eric W. Biederman 2015-08-05 21:19 ` Eric W. Biederman 2015-08-06 14:20 ` Seth Forshee 2015-08-06 14:20 ` Seth Forshee 2015-08-06 14:51 ` Stephen Smalley 2015-08-06 14:51 ` Stephen Smalley 2015-08-06 15:44 ` Seth Forshee 2015-08-06 15:44 ` Seth Forshee 2015-08-06 16:11 ` Stephen Smalley 2015-08-06 16:11 ` Stephen Smalley 2015-08-07 14:16 ` Seth Forshee 2015-08-07 14:16 ` Seth Forshee 2015-08-07 14:32 ` Seth Forshee 2015-08-07 14:32 ` Seth Forshee 2015-08-07 18:35 ` Casey Schaufler 2015-08-07 18:35 ` Casey Schaufler 2015-08-07 18:57 ` Seth Forshee 2015-08-07 18:57 ` Seth Forshee 2015-07-15 19:46 ` [PATCH 2/7] userns: Simpilify MNT_NODEV handling Seth Forshee 2015-07-15 19:46 ` Seth Forshee 2015-07-15 19:46 ` [PATCH 3/7] fs: Ignore file caps in mounts from other user namespaces Seth Forshee 2015-07-15 19:46 ` Seth Forshee 2015-07-15 21:48 ` Serge E. Hallyn 2015-07-15 21:48 ` Serge E. Hallyn 2015-07-15 21:50 ` Andy Lutomirski 2015-07-15 21:50 ` Andy Lutomirski 2015-07-15 22:35 ` Eric W. Biederman 2015-07-15 22:35 ` Eric W. Biederman 2015-07-16 1:14 ` Seth Forshee 2015-07-16 1:14 ` Seth Forshee 2015-07-16 1:23 ` Andy Lutomirski 2015-07-16 1:23 ` Andy Lutomirski 2015-07-16 13:06 ` Seth Forshee 2015-07-16 13:06 ` Seth Forshee 2015-07-16 1:19 ` Andy Lutomirski 2015-07-16 1:19 ` Andy Lutomirski 2015-07-16 4:23 ` Eric W. Biederman 2015-07-16 4:23 ` Eric W. Biederman 2015-07-16 4:49 ` Andy Lutomirski 2015-07-16 4:49 ` Andy Lutomirski 2015-07-16 5:04 ` Eric W. Biederman 2015-07-16 5:04 ` Eric W. Biederman 2015-07-16 5:15 ` Andy Lutomirski 2015-07-16 5:15 ` Andy Lutomirski 2015-07-16 5:44 ` Eric W. Biederman 2015-07-16 5:44 ` Eric W. Biederman 2015-07-16 13:13 ` Seth Forshee 2015-07-16 13:13 ` Seth Forshee 2015-07-17 0:43 ` Eric W. Biederman 2015-07-17 0:43 ` Eric W. Biederman 2015-07-29 16:04 ` Serge E. Hallyn 2015-07-29 16:04 ` Serge E. Hallyn 2015-07-29 16:18 ` Serge E. Hallyn 2015-07-29 16:18 ` Serge E. Hallyn 2015-07-15 19:46 ` [PATCH 4/7] fs: Treat foreign mounts as nosuid Seth Forshee 2015-07-15 19:46 ` Seth Forshee 2015-07-17 6:46 ` Nikolay Borisov 2015-07-17 6:46 ` Nikolay Borisov 2015-07-15 19:46 ` [PATCH 5/7] security: Restrict security attribute updates for userns mounts Seth Forshee 2015-07-15 19:46 ` Seth Forshee 2015-07-15 19:46 ` [PATCH 6/7] selinux: Ignore security labels on user namespace mounts Seth Forshee 2015-07-15 19:46 ` Seth Forshee 2015-07-16 13:23 ` Stephen Smalley 2015-07-22 16:02 ` Stephen Smalley 2015-07-22 16:14 ` Seth Forshee 2015-07-22 16:14 ` Seth Forshee 2015-07-22 20:25 ` Stephen Smalley 2015-07-22 20:25 ` Stephen Smalley 2015-07-22 20:40 ` Stephen Smalley 2015-07-22 20:40 ` Stephen Smalley 2015-07-23 13:57 ` Stephen Smalley 2015-07-23 13:57 ` Stephen Smalley 2015-07-23 14:39 ` Seth Forshee 2015-07-23 14:39 ` Seth Forshee 2015-07-23 15:36 ` Stephen Smalley 2015-07-23 15:36 ` Stephen Smalley 2015-07-23 16:23 ` Seth Forshee 2015-07-23 16:23 ` Seth Forshee 2015-07-24 15:11 ` Seth Forshee 2015-07-24 15:11 ` Seth Forshee 2015-07-30 15:57 ` Stephen Smalley 2015-07-30 15:57 ` Stephen Smalley 2015-07-30 16:24 ` Seth Forshee 2015-07-30 16:24 ` Seth Forshee 2015-07-15 19:46 ` Seth Forshee [this message] 2015-07-15 19:46 ` [PATCH 7/7] smack: Don't use security labels for " Seth Forshee 2015-07-15 20:43 ` Casey Schaufler 2015-07-15 20:43 ` Casey Schaufler 2015-07-15 20:36 ` [PATCH 0/7] Initial support for user namespace owned mounts Casey Schaufler 2015-07-15 20:36 ` Casey Schaufler 2015-07-15 21:06 ` Eric W. Biederman 2015-07-15 21:06 ` Eric W. Biederman 2015-07-15 21:48 ` Seth Forshee 2015-07-15 21:48 ` Seth Forshee 2015-07-15 22:28 ` Eric W. Biederman 2015-07-15 22:28 ` Eric W. Biederman 2015-07-16 1:05 ` Andy Lutomirski 2015-07-16 1:05 ` Andy Lutomirski 2015-07-16 2:20 ` Eric W. Biederman 2015-07-16 2:20 ` Eric W. Biederman 2015-07-16 13:12 ` Stephen Smalley 2015-07-16 13:12 ` Stephen Smalley 2015-07-15 23:04 ` Casey Schaufler 2015-07-15 23:04 ` Casey Schaufler 2015-07-15 22:39 ` Casey Schaufler 2015-07-15 22:39 ` Casey Schaufler 2015-07-16 1:08 ` Andy Lutomirski 2015-07-16 1:08 ` Andy Lutomirski 2015-07-16 2:54 ` Casey Schaufler 2015-07-16 2:54 ` Casey Schaufler 2015-07-16 4:47 ` Eric W. Biederman 2015-07-16 4:47 ` Eric W. Biederman 2015-07-17 0:09 ` Dave Chinner 2015-07-17 0:09 ` Dave Chinner 2015-07-17 0:42 ` Eric W. Biederman 2015-07-17 0:42 ` Eric W. Biederman 2015-07-17 2:47 ` Dave Chinner 2015-07-17 2:47 ` Dave Chinner 2015-07-21 17:37 ` J. Bruce Fields 2015-07-21 17:37 ` J. Bruce Fields 2015-07-22 7:56 ` Dave Chinner 2015-07-22 7:56 ` Dave Chinner 2015-07-22 14:09 ` J. Bruce Fields 2015-07-22 14:09 ` J. Bruce Fields 2015-07-22 16:52 ` Austin S Hemmelgarn 2015-07-22 16:52 ` Austin S Hemmelgarn 2015-07-22 17:41 ` J. Bruce Fields 2015-07-22 17:41 ` J. Bruce Fields 2015-07-23 1:51 ` Dave Chinner 2015-07-23 1:51 ` Dave Chinner 2015-07-23 13:19 ` J. Bruce Fields 2015-07-23 13:19 ` J. Bruce Fields 2015-07-23 23:48 ` Dave Chinner 2015-07-23 23:48 ` Dave Chinner 2015-07-18 0:07 ` Serge E. Hallyn 2015-07-18 0:07 ` Serge E. Hallyn 2015-07-20 17:54 ` Colin Walters 2015-07-20 17:54 ` Colin Walters 2015-07-16 11:16 ` Lukasz Pawelczyk 2015-07-16 11:16 ` Lukasz Pawelczyk 2015-07-17 0:10 ` Eric W. Biederman 2015-07-17 0:10 ` Eric W. Biederman 2015-07-17 10:13 ` Lukasz Pawelczyk 2015-07-17 10:13 ` Lukasz Pawelczyk 2015-07-16 3:15 ` Eric W. Biederman 2015-07-16 3:15 ` Eric W. Biederman 2015-07-16 13:59 ` Seth Forshee 2015-07-16 13:59 ` Seth Forshee 2015-07-16 15:09 ` Casey Schaufler 2015-07-16 15:09 ` Casey Schaufler 2015-07-16 18:57 ` Seth Forshee 2015-07-16 18:57 ` Seth Forshee 2015-07-16 21:42 ` Casey Schaufler 2015-07-16 21:42 ` Casey Schaufler 2015-07-16 22:27 ` Andy Lutomirski 2015-07-16 22:27 ` Andy Lutomirski 2015-07-16 23:08 ` Casey Schaufler 2015-07-16 23:08 ` Casey Schaufler 2015-07-16 23:29 ` Andy Lutomirski 2015-07-16 23:29 ` Andy Lutomirski 2015-07-17 0:45 ` Casey Schaufler 2015-07-17 0:45 ` Casey Schaufler 2015-07-17 0:59 ` Andy Lutomirski 2015-07-17 0:59 ` Andy Lutomirski 2015-07-17 14:28 ` Serge E. Hallyn 2015-07-17 14:28 ` Serge E. Hallyn 2015-07-17 14:56 ` Seth Forshee 2015-07-17 14:56 ` Seth Forshee 2015-07-21 20:35 ` Seth Forshee 2015-07-21 20:35 ` Seth Forshee 2015-07-22 1:52 ` Casey Schaufler 2015-07-22 1:52 ` Casey Schaufler 2015-07-22 15:56 ` Seth Forshee 2015-07-22 15:56 ` Seth Forshee 2015-07-22 18:10 ` Casey Schaufler 2015-07-22 18:10 ` Casey Schaufler 2015-07-22 19:32 ` Seth Forshee 2015-07-22 19:32 ` Seth Forshee 2015-07-23 0:05 ` Casey Schaufler 2015-07-23 0:05 ` Casey Schaufler 2015-07-23 0:15 ` Eric W. Biederman 2015-07-23 0:15 ` Eric W. Biederman 2015-07-23 5:15 ` Seth Forshee 2015-07-23 5:15 ` Seth Forshee 2015-07-23 21:48 ` Casey Schaufler 2015-07-23 21:48 ` Casey Schaufler 2015-07-28 20:40 ` Seth Forshee 2015-07-28 20:40 ` Seth Forshee 2015-07-30 16:18 ` Casey Schaufler 2015-07-30 16:18 ` Casey Schaufler 2015-07-30 17:05 ` Eric W. Biederman 2015-07-30 17:05 ` Eric W. Biederman 2015-07-30 17:25 ` Seth Forshee 2015-07-30 17:25 ` Seth Forshee 2015-07-30 17:33 ` Eric W. Biederman 2015-07-30 17:33 ` Eric W. Biederman 2015-07-17 13:21 ` Seth Forshee 2015-07-17 13:21 ` Seth Forshee 2015-07-17 17:14 ` Casey Schaufler 2015-07-17 17:14 ` Casey Schaufler 2015-07-16 15:59 ` Seth Forshee 2015-07-16 15:59 ` Seth Forshee
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1436989569-69582-8-git-send-email-seth.forshee@canonical.com \ --to=seth.forshee@canonical.com \ --cc=casey@schaufler-ca.com \ --cc=ebiederm@xmission.com \ --cc=james.l.morris@oracle.com \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=luto@amacapital.net \ --cc=selinux@tycho.nsa.gov \ --cc=serge.hallyn@canonical.com \ --cc=serge@hallyn.com \ --cc=viro@zeniv.linux.org.uk \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.