From: David Herrmann <dh.herrmann@gmail.com> To: linux-kernel@vger.kernel.org Cc: James Morris <jmorris@namei.org>, Paul Moore <paul@paul-moore.com>, teg@jklm.no, Stephen Smalley <sds@tycho.nsa.gov>, selinux@tycho.nsa.gov, linux-security-module@vger.kernel.org, Eric Paris <eparis@parisplace.org>, serge@hallyn.com, davem@davemloft.net, netdev@vger.kernel.org, David Herrmann <dh.herrmann@gmail.com> Subject: [PATCH 1/3] security: add hook for socketpair(AF_UNIX, ...) Date: Mon, 23 Apr 2018 15:30:13 +0200 [thread overview] Message-ID: <20180423133015.5455-2-dh.herrmann@gmail.com> (raw) In-Reply-To: <20180423133015.5455-1-dh.herrmann@gmail.com> Right now the LSM labels for socketpairs are always uninitialized, since there is no security hook for the socketpair() syscall. This patch adds the required hooks so LSMs can properly label socketpairs. This allows SO_PEERSEC to return useful information on those sockets. Note that the behavior of socketpair() can be emulated by creating a listener socket, connecting to it, and then discarding the initial listener socket. With this workaround, SO_PEERSEC would return the caller's security context. However, with socketpair(), the uninitialized context is returned unconditionally. This is unexpected and makes socketpair() less useful in situations where the security context is crucial to the application. With the new socketpair-hook this disparity can be solved by making socketpair() return the expected security context. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> --- include/linux/lsm_hooks.h | 8 ++++++++ include/linux/security.h | 7 +++++++ security/security.c | 6 ++++++ 3 files changed, 21 insertions(+) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 9d0b286f3dba..2a23c75c1541 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -717,6 +717,12 @@ * @other contains the peer sock structure. * @newsk contains the new sock structure. * Return 0 if permission is granted. + * @unix_stream_socketpair: + * Check permissions before establishing a Unix domain stream connection + * for a fresh pair of sockets. + * @socka contains the first sock structure. + * @sockb contains the second sock structure. + * Return 0 if permission is granted and the connection was established. * @unix_may_send: * Check permissions before connecting or sending datagrams from @sock to * @other. @@ -1651,6 +1657,7 @@ union security_list_options { #ifdef CONFIG_SECURITY_NETWORK int (*unix_stream_connect)(struct sock *sock, struct sock *other, struct sock *newsk); + int (*unix_stream_socketpair)(struct sock *socka, struct sock *sockb); int (*unix_may_send)(struct socket *sock, struct socket *other); int (*socket_create)(int family, int type, int protocol, int kern); @@ -1919,6 +1926,7 @@ struct security_hook_heads { struct hlist_head inode_getsecctx; #ifdef CONFIG_SECURITY_NETWORK struct hlist_head unix_stream_connect; + struct hlist_head unix_stream_socketpair; struct hlist_head unix_may_send; struct hlist_head socket_create; struct hlist_head socket_post_create; diff --git a/include/linux/security.h b/include/linux/security.h index 200920f521a1..be275deeda10 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1187,6 +1187,7 @@ static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32 #ifdef CONFIG_SECURITY_NETWORK int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk); +int security_unix_stream_socketpair(struct sock *socka, struct sock *sockb); int security_unix_may_send(struct socket *sock, struct socket *other); int security_socket_create(int family, int type, int protocol, int kern); int security_socket_post_create(struct socket *sock, int family, @@ -1242,6 +1243,12 @@ static inline int security_unix_stream_connect(struct sock *sock, return 0; } +static inline int security_unix_stream_socketpair(struct sock *socka, + struct sock *sockb) +{ + return 0; +} + static inline int security_unix_may_send(struct socket *sock, struct socket *other) { diff --git a/security/security.c b/security/security.c index 7bc2fde023a7..3dfd374e84e5 100644 --- a/security/security.c +++ b/security/security.c @@ -1340,6 +1340,12 @@ int security_unix_stream_connect(struct sock *sock, struct sock *other, struct s } EXPORT_SYMBOL(security_unix_stream_connect); +int security_unix_stream_socketpair(struct sock *socka, struct sock *sockb) +{ + return call_int_hook(unix_stream_socketpair, 0, socka, sockb); +} +EXPORT_SYMBOL(security_unix_stream_socketpair); + int security_unix_may_send(struct socket *sock, struct socket *other) { return call_int_hook(unix_may_send, 0, sock, other); -- 2.17.0
WARNING: multiple messages have this Message-ID (diff)
From: dh.herrmann@gmail.com (David Herrmann) To: linux-security-module@vger.kernel.org Subject: [PATCH 1/3] security: add hook for socketpair(AF_UNIX, ...) Date: Mon, 23 Apr 2018 15:30:13 +0200 [thread overview] Message-ID: <20180423133015.5455-2-dh.herrmann@gmail.com> (raw) In-Reply-To: <20180423133015.5455-1-dh.herrmann@gmail.com> Right now the LSM labels for socketpairs are always uninitialized, since there is no security hook for the socketpair() syscall. This patch adds the required hooks so LSMs can properly label socketpairs. This allows SO_PEERSEC to return useful information on those sockets. Note that the behavior of socketpair() can be emulated by creating a listener socket, connecting to it, and then discarding the initial listener socket. With this workaround, SO_PEERSEC would return the caller's security context. However, with socketpair(), the uninitialized context is returned unconditionally. This is unexpected and makes socketpair() less useful in situations where the security context is crucial to the application. With the new socketpair-hook this disparity can be solved by making socketpair() return the expected security context. Signed-off-by: David Herrmann <dh.herrmann@gmail.com> --- include/linux/lsm_hooks.h | 8 ++++++++ include/linux/security.h | 7 +++++++ security/security.c | 6 ++++++ 3 files changed, 21 insertions(+) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 9d0b286f3dba..2a23c75c1541 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -717,6 +717,12 @@ * @other contains the peer sock structure. * @newsk contains the new sock structure. * Return 0 if permission is granted. + * @unix_stream_socketpair: + * Check permissions before establishing a Unix domain stream connection + * for a fresh pair of sockets. + * @socka contains the first sock structure. + * @sockb contains the second sock structure. + * Return 0 if permission is granted and the connection was established. * @unix_may_send: * Check permissions before connecting or sending datagrams from @sock to * @other. @@ -1651,6 +1657,7 @@ union security_list_options { #ifdef CONFIG_SECURITY_NETWORK int (*unix_stream_connect)(struct sock *sock, struct sock *other, struct sock *newsk); + int (*unix_stream_socketpair)(struct sock *socka, struct sock *sockb); int (*unix_may_send)(struct socket *sock, struct socket *other); int (*socket_create)(int family, int type, int protocol, int kern); @@ -1919,6 +1926,7 @@ struct security_hook_heads { struct hlist_head inode_getsecctx; #ifdef CONFIG_SECURITY_NETWORK struct hlist_head unix_stream_connect; + struct hlist_head unix_stream_socketpair; struct hlist_head unix_may_send; struct hlist_head socket_create; struct hlist_head socket_post_create; diff --git a/include/linux/security.h b/include/linux/security.h index 200920f521a1..be275deeda10 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1187,6 +1187,7 @@ static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32 #ifdef CONFIG_SECURITY_NETWORK int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk); +int security_unix_stream_socketpair(struct sock *socka, struct sock *sockb); int security_unix_may_send(struct socket *sock, struct socket *other); int security_socket_create(int family, int type, int protocol, int kern); int security_socket_post_create(struct socket *sock, int family, @@ -1242,6 +1243,12 @@ static inline int security_unix_stream_connect(struct sock *sock, return 0; } +static inline int security_unix_stream_socketpair(struct sock *socka, + struct sock *sockb) +{ + return 0; +} + static inline int security_unix_may_send(struct socket *sock, struct socket *other) { diff --git a/security/security.c b/security/security.c index 7bc2fde023a7..3dfd374e84e5 100644 --- a/security/security.c +++ b/security/security.c @@ -1340,6 +1340,12 @@ int security_unix_stream_connect(struct sock *sock, struct sock *other, struct s } EXPORT_SYMBOL(security_unix_stream_connect); +int security_unix_stream_socketpair(struct sock *socka, struct sock *sockb) +{ + return call_int_hook(unix_stream_socketpair, 0, socka, sockb); +} +EXPORT_SYMBOL(security_unix_stream_socketpair); + int security_unix_may_send(struct socket *sock, struct socket *other) { return call_int_hook(unix_may_send, 0, sock, other); -- 2.17.0 -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2018-04-23 13:32 UTC|newest] Thread overview: 30+ messages / expand[flat|nested] mbox.gz Atom feed top 2018-04-23 13:30 [PATCH 0/3] Introduce LSM-hook for socketpair(2) David Herrmann 2018-04-23 13:30 ` David Herrmann 2018-04-23 13:30 ` David Herrmann [this message] 2018-04-23 13:30 ` [PATCH 1/3] security: add hook for socketpair(AF_UNIX, ...) David Herrmann 2018-04-23 13:30 ` [PATCH 2/3] net/unix: hook unix_socketpair() into LSM David Herrmann 2018-04-23 13:30 ` David Herrmann 2018-04-24 17:55 ` Paul Moore 2018-04-24 17:55 ` Paul Moore 2018-04-24 17:56 ` David Miller 2018-04-24 17:56 ` David Miller 2018-04-24 17:58 ` Paul Moore 2018-04-24 17:58 ` Paul Moore 2018-04-23 13:30 ` [PATCH 3/3] selinux: provide unix_stream_socketpair callback David Herrmann 2018-04-23 13:30 ` David Herrmann 2018-04-23 16:48 ` Stephen Smalley 2018-04-23 16:48 ` Stephen Smalley 2018-04-23 17:04 ` [PATCH 0/3] Introduce LSM-hook for socketpair(2) Casey Schaufler 2018-04-23 17:04 ` Casey Schaufler 2018-04-23 17:52 ` Serge E. Hallyn 2018-04-23 17:52 ` Serge E. Hallyn 2018-04-25 18:44 ` James Morris 2018-04-25 18:44 ` James Morris 2018-04-25 18:48 ` David Miller 2018-04-25 18:48 ` David Miller 2018-04-25 18:51 ` Paul Moore 2018-04-25 18:51 ` Paul Moore 2018-04-25 19:02 ` James Morris 2018-04-25 19:02 ` James Morris 2018-05-04 14:29 ` David Herrmann 2018-05-04 14:29 ` David Herrmann
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20180423133015.5455-2-dh.herrmann@gmail.com \ --to=dh.herrmann@gmail.com \ --cc=davem@davemloft.net \ --cc=eparis@parisplace.org \ --cc=jmorris@namei.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=netdev@vger.kernel.org \ --cc=paul@paul-moore.com \ --cc=sds@tycho.nsa.gov \ --cc=selinux@tycho.nsa.gov \ --cc=serge@hallyn.com \ --cc=teg@jklm.no \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.