From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Cyrus-Session-Id: sloti22d1t05-2556813-1516315009-2-13839347198470713661 X-Sieve: CMU Sieve 3.0 X-Spam-known-sender: no X-Spam-score: 0.0 X-Spam-hits: BAYES_00 -1.9, HEADER_FROM_DIFFERENT_DOMAINS 0.25, RCVD_IN_DNSWL_HI -5, T_RP_MATCHES_RCVD -0.01, LANGUAGES enda, BAYES_USED global, SA_VERSION 3.4.0 X-Spam-source: IP='209.132.180.67', Host='vger.kernel.org', Country='US', FromHeader='com', MailFrom='org', XOriginatingCountry='US' X-Spam-charsets: plain='UTF-8' X-Resolved-to: greg@kroah.com X-Delivered-to: greg@kroah.com X-Mail-from: stable-owner@vger.kernel.org ARC-Seal: i=1; a=rsa-sha256; cv=none; d=messagingengine.com; s=arctest; t=1516315007; b=CDbtKq/3mn6NJ6JqPdxYJ04ELssIUkk4gADGpsPRsaMH6n2 QDnMyLSL9ytG08bgo0FDjN7HnSOwu5W7YPm0X0st4zAuGf/8SlXqFGzUHQ8Gs42r pHnlz5L3Rc6q2var/DYvYReC17TaC3RTHYHd2G3S4SNeD1D2QQjhNjpo/bODpdI+ lxCe6mBHRRuPYsadd5Knlo+l+08k1Vy/8UXTX0s7dWqCwTey0dWAnVezUYwOASRH JJUQ/Ykb6FtVlyoBOChWEzMNELZrgUAuNp1NJZh/W711GHUFFM5iz2nMjiWtc38X DtUALuNQNRSJqRcPnlJsOGLOUFEYcnfPpRjNarw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d= messagingengine.com; h=mime-version:in-reply-to:references:from :date:message-id:subject:to:cc:content-type:sender:list-id; s= arctest; t=1516315007; bh=OaZ8msL4u63LxNoRfrJiVTqTsJNoYwyo6yC+A5 NmsLU=; b=ZTY3HR8ZHUvZmTnqpkBQRWhgornrcianvzu8jX7pVbrCCU0FIcv++i aci7YNl3k041JV+cTTvsdUxhbGuIG2YEt3Nc+jAYZlIIU+ewPmjNBVZ4Biebnc/3 E7zEw+jmuzv1hCz2qp4xad3lJdnalCDCs53JAy1p1AvZ8KmPnAvd3ZZmLbrmXjcY /fdNBjSTSbi9/8OJn6dkaLUyJu5LSqXEQgVg5z/St4qOGMLAf7H5D/zVuOkaeFE+ 3ROXoBjs6H5AeTyKSVVWl0WK5AEfyzP800gNYhhJHRxq3ubt5N/caJXz6QWBfGBX FSQ4PSDA1itzKQdZtNftMV62g3A5O9gg== ARC-Authentication-Results: i=1; mx3.messagingengine.com; arc=none (no signatures found); dkim=pass (2048-bit rsa key sha256) header.d=paul-moore-com.20150623.gappssmtp.com header.i=@paul-moore-com.20150623.gappssmtp.com header.b=rtGvWUyX x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20150623; dmarc=none (p=none,has-list-id=yes,d=none) header.from=paul-moore.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=Vs3bixoB; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=paul-moore.com header.result=pass header_is_org_domain=yes Authentication-Results: mx3.messagingengine.com; arc=none (no signatures found); dkim=pass (2048-bit rsa key sha256) header.d=paul-moore-com.20150623.gappssmtp.com header.i=@paul-moore-com.20150623.gappssmtp.com header.b=rtGvWUyX x-bits=2048 x-keytype=rsa x-algorithm=sha256 x-selector=20150623; dmarc=none (p=none,has-list-id=yes,d=none) header.from=paul-moore.com; iprev=pass policy.iprev=209.132.180.67 (vger.kernel.org); spf=none smtp.mailfrom=stable-owner@vger.kernel.org smtp.helo=vger.kernel.org; x-aligned-from=fail; x-google-dkim=pass (2048-bit rsa key) header.d=1e100.net header.i=@1e100.net header.b=Vs3bixoB; x-ptr=pass x-ptr-helo=vger.kernel.org x-ptr-lookup=vger.kernel.org; x-return-mx=pass smtp.domain=vger.kernel.org smtp.result=pass smtp_org.domain=kernel.org smtp_org.result=pass smtp_is_org_domain=no header.domain=paul-moore.com header.result=pass header_is_org_domain=yes Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932414AbeARWgn (ORCPT ); Thu, 18 Jan 2018 17:36:43 -0500 Received: from mail-lf0-f67.google.com ([209.85.215.67]:35532 "EHLO mail-lf0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754104AbeARWgl (ORCPT ); Thu, 18 Jan 2018 17:36:41 -0500 X-Google-Smtp-Source: ACJfBoueyI+4epPYHFaeqbgEJyK85tg3PF+02GKM7sJ6QTzoTl5adm5zLe7Xo4OtGQVxMTWyJm1lIvzkT4Hky1jsqKo= MIME-Version: 1.0 X-Originating-IP: [108.20.156.165] In-Reply-To: <20180118215853.228182-1-salyzyn@android.com> References: <20180118215853.228182-1-salyzyn@android.com> From: Paul Moore Date: Thu, 18 Jan 2018 17:36:38 -0500 Message-ID: Subject: Re: [PATCH] general protection fault in sock_has_perm To: Mark Salyzyn Cc: linux-kernel@vger.kernel.org, Stephen Smalley , Eric Paris , James Morris , "Serge E. Hallyn" , selinux@tycho.nsa.gov, linux-security-module@vger.kernel.org, stable@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Sender: stable-owner@vger.kernel.org X-Mailing-List: stable@vger.kernel.org X-getmail-retrieved-from-mailbox: INBOX X-Mailing-List: linux-kernel@vger.kernel.org List-ID: On Thu, Jan 18, 2018 at 4:58 PM, Mark Salyzyn wrote: > general protection fault: 0000 [#1] PREEMPT SMP KASAN > CPU: 1 PID: 14233 Comm: syz-executor2 Not tainted 4.4.112-g5f6325b #28 > task: ffff8801d1095f00 task.stack: ffff8800b5950000 > RIP: 0010:[] [] sock_has_perm+0x1fe/0x3e0 security/selinux/hooks.c:4069 > RSP: 0018:ffff8800b5957ce0 EFLAGS: 00010202 > RAX: dffffc0000000000 RBX: 1ffff10016b2af9f RCX: ffffffff81b69b51 > RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000010 > RBP: ffff8800b5957de0 R08: 0000000000000001 R09: 0000000000000001 > R10: 0000000000000000 R11: 1ffff10016b2af68 R12: ffff8800b5957db8 > R13: 0000000000000000 R14: ffff8800b7259f40 R15: 00000000000000d7 > FS: 00007f72f5ae2700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000a2fa38 CR3: 00000001d7980000 CR4: 0000000000160670 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Stack: > ffffffff81b69a1f ffff8800b5957d58 00008000b5957d30 0000000041b58ab3 > ffffffff83fc82f2 ffffffff81b69980 0000000000000246 ffff8801d1096770 > ffff8801d3165668 ffffffff8157844b ffff8801d1095f00 > ffff880000000001 > Call Trace: > [] selinux_socket_setsockopt+0x4d/0x80 security/selinux/hooks.c:4338 > [] security_socket_setsockopt+0x7d/0xb0 security/security.c:1257 > [] SYSC_setsockopt net/socket.c:1757 [inline] > [] SyS_setsockopt+0xe8/0x250 net/socket.c:1746 > [] entry_SYSCALL_64_fastpath+0x16/0x92 > Code: c2 42 9b b6 81 be 01 00 00 00 48 c7 c7 a0 cb 2b 84 e8 > f7 2f 6d ff 49 8d 7d 10 48 b8 00 00 00 00 00 fc ff df 48 89 > fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 01 00 > 00 41 8b 75 10 31 > RIP [] sock_has_perm+0x1fe/0x3e0 security/selinux/hooks.c:4069 > RSP > ---[ end trace 7b5aaf788fef6174 ]--- > > In the absence of commit a4298e4522d6 ("net: add SOCK_RCU_FREE socket > flag") and all the associated infrastructure changes to take advantage > of a RCU grace period before freeing, there is a heightened > possibility that a security check is performed while an ill-timed > setsockopt call races in from user space. It then is prudent to null > check sk_security, and if the case, reject the permissions. > > This adjustment is orthogonal to infrastructure improvements that may > nullify the needed check, but should be added as good code hygiene. I'm skeptical that this is the full solution for systems that lack the SOCK_RCU_FREE protection. Is this really limited to just setsockopt()? > Signed-off-by: Mark Salyzyn > Cc: Paul Moore > Cc: Stephen Smalley > Cc: Eric Paris > Cc: James Morris > Cc: "Serge E. Hallyn" > Cc: selinux@tycho.nsa.gov > Cc: linux-security-module@vger.kernel.org > Cc: linux-kernel@vger.kernel.org > Cc: stable@vger.kernel.org > --- > This patch should be applied to all stable trees (author wants > minimum of 3.18, 4.4, 4.9 and 4.14) > > security/selinux/hooks.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 8644d864e3c1..95d7c8143373 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -4342,7 +4342,7 @@ static int sock_has_perm(struct sock *sk, u32 perms) > struct common_audit_data ad; > struct lsm_network_audit net = {0,}; > > - if (sksec->sid == SECINITSID_KERNEL) > + if (!sksec || sksec->sid == SECINITSID_KERNEL) > return 0; > > ad.type = LSM_AUDIT_DATA_NET; > -- > 2.16.0.rc1.238.g530d649a79-goog -- paul moore www.paul-moore.com From mboxrd@z Thu Jan 1 00:00:00 1970 From: paul@paul-moore.com (Paul Moore) Date: Thu, 18 Jan 2018 17:36:38 -0500 Subject: [PATCH] general protection fault in sock_has_perm In-Reply-To: <20180118215853.228182-1-salyzyn@android.com> References: <20180118215853.228182-1-salyzyn@android.com> Message-ID: To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org On Thu, Jan 18, 2018 at 4:58 PM, Mark Salyzyn wrote: > general protection fault: 0000 [#1] PREEMPT SMP KASAN > CPU: 1 PID: 14233 Comm: syz-executor2 Not tainted 4.4.112-g5f6325b #28 > task: ffff8801d1095f00 task.stack: ffff8800b5950000 > RIP: 0010:[] [] sock_has_perm+0x1fe/0x3e0 security/selinux/hooks.c:4069 > RSP: 0018:ffff8800b5957ce0 EFLAGS: 00010202 > RAX: dffffc0000000000 RBX: 1ffff10016b2af9f RCX: ffffffff81b69b51 > RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000010 > RBP: ffff8800b5957de0 R08: 0000000000000001 R09: 0000000000000001 > R10: 0000000000000000 R11: 1ffff10016b2af68 R12: ffff8800b5957db8 > R13: 0000000000000000 R14: ffff8800b7259f40 R15: 00000000000000d7 > FS: 00007f72f5ae2700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 > CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 > CR2: 0000000000a2fa38 CR3: 00000001d7980000 CR4: 0000000000160670 > DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 > DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 > Stack: > ffffffff81b69a1f ffff8800b5957d58 00008000b5957d30 0000000041b58ab3 > ffffffff83fc82f2 ffffffff81b69980 0000000000000246 ffff8801d1096770 > ffff8801d3165668 ffffffff8157844b ffff8801d1095f00 > ffff880000000001 > Call Trace: > [] selinux_socket_setsockopt+0x4d/0x80 security/selinux/hooks.c:4338 > [] security_socket_setsockopt+0x7d/0xb0 security/security.c:1257 > [] SYSC_setsockopt net/socket.c:1757 [inline] > [] SyS_setsockopt+0xe8/0x250 net/socket.c:1746 > [] entry_SYSCALL_64_fastpath+0x16/0x92 > Code: c2 42 9b b6 81 be 01 00 00 00 48 c7 c7 a0 cb 2b 84 e8 > f7 2f 6d ff 49 8d 7d 10 48 b8 00 00 00 00 00 fc ff df 48 89 > fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 03 0f 8e 83 01 00 > 00 41 8b 75 10 31 > RIP [] sock_has_perm+0x1fe/0x3e0 security/selinux/hooks.c:4069 > RSP > ---[ end trace 7b5aaf788fef6174 ]--- > > In the absence of commit a4298e4522d6 ("net: add SOCK_RCU_FREE socket > flag") and all the associated infrastructure changes to take advantage > of a RCU grace period before freeing, there is a heightened > possibility that a security check is performed while an ill-timed > setsockopt call races in from user space. It then is prudent to null > check sk_security, and if the case, reject the permissions. > > This adjustment is orthogonal to infrastructure improvements that may > nullify the needed check, but should be added as good code hygiene. I'm skeptical that this is the full solution for systems that lack the SOCK_RCU_FREE protection. Is this really limited to just setsockopt()? > Signed-off-by: Mark Salyzyn > Cc: Paul Moore > Cc: Stephen Smalley > Cc: Eric Paris > Cc: James Morris > Cc: "Serge E. Hallyn" > Cc: selinux at tycho.nsa.gov > Cc: linux-security-module at vger.kernel.org > Cc: linux-kernel at vger.kernel.org > Cc: stable at vger.kernel.org > --- > This patch should be applied to all stable trees (author wants > minimum of 3.18, 4.4, 4.9 and 4.14) > > security/selinux/hooks.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 8644d864e3c1..95d7c8143373 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -4342,7 +4342,7 @@ static int sock_has_perm(struct sock *sk, u32 perms) > struct common_audit_data ad; > struct lsm_network_audit net = {0,}; > > - if (sksec->sid == SECINITSID_KERNEL) > + if (!sksec || sksec->sid == SECINITSID_KERNEL) > return 0; > > ad.type = LSM_AUDIT_DATA_NET; > -- > 2.16.0.rc1.238.g530d649a79-goog -- paul moore www.paul-moore.com -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html