From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.6 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS, USER_AGENT_SANE_1 autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 5B726C3A5A3 for ; Thu, 22 Aug 2019 15:48:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 31B4123401 for ; Thu, 22 Aug 2019 15:48:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1566488889; bh=uipZavMt5Z1fZAX+sVlMS1INMUxP9WzC4H4BLym3E3M=; h=Date:From:To:Cc:Subject:References:In-Reply-To:List-ID:From; b=tsIE9udvpG+hhbGfOMoyqa6OdLfKmQ7eCvvYscFvBSdBK029aampDJk46Xnz6ZUUj nF8S1Zi5sZCh609fEnZSaayOCsgpDuG68tRC+QiHOi++MfXRqrXrq1E3OlJU8lMB+N 0u+kFrbDoR431YflpzsxBhYA3an05zt6u/pfwp3Q= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2388049AbfHVPsF (ORCPT ); Thu, 22 Aug 2019 11:48:05 -0400 Received: from mail.kernel.org ([198.145.29.99]:57538 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387880AbfHVPsF (ORCPT ); Thu, 22 Aug 2019 11:48:05 -0400 Received: from zzz.localdomain (ip-173-136-158-138.anahca.spcsdns.net [173.136.158.138]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 684B523400; Thu, 22 Aug 2019 15:48:03 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1566488884; bh=uipZavMt5Z1fZAX+sVlMS1INMUxP9WzC4H4BLym3E3M=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=jHKmYzwY8waO4dpG6B4Fjk/MSEZD03cPKRGG5tDzo3xWM2ikozg6sh9qTjWAFn9xF Ok+z1PnH1dQl7NBvJDL+TTolIZMAt5KQ2llFU4mxFXKRkZN5zZSj7Nb9imaaBL5XG7 36ip3+Y6lJyDNPTuNR2SzLdgobtgHdHxUCsigCe8= Date: Thu, 22 Aug 2019 08:47:59 -0700 From: Eric Biggers To: Tetsuo Handa Cc: Al Viro , linux-fsdevel@vger.kernel.org, syzbot , jmorris@namei.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, serge@hallyn.com, syzkaller-bugs@googlegroups.com, takedakn@nttdata.co.jp, "David S. Miller" Subject: Re: [PATCH v2] tomoyo: Don't check open/getattr permission on sockets. Message-ID: <20190822154759.GA2020@zzz.localdomain> Mail-Followup-To: Tetsuo Handa , Al Viro , linux-fsdevel@vger.kernel.org, syzbot , jmorris@namei.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, serge@hallyn.com, syzkaller-bugs@googlegroups.com, takedakn@nttdata.co.jp, "David S. Miller" References: <201908220655.x7M6tVmv029579@www262.sakura.ne.jp> <20190822070129.GL6111@zzz.localdomain> <201908220742.x7M7gQJW078160@www262.sakura.ne.jp> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <201908220742.x7M7gQJW078160@www262.sakura.ne.jp> User-Agent: Mutt/1.12.1 (2019-06-15) Sender: linux-fsdevel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org On Thu, Aug 22, 2019 at 04:42:26PM +0900, Tetsuo Handa wrote: > Eric Biggers wrote: > > On Thu, Aug 22, 2019 at 03:55:31PM +0900, Tetsuo Handa wrote: > > > > Also, isn't the same bug in other places too?: > > > > > > > > - tomoyo_path_chmod() > > > > - tomoyo_path_chown() > > > > - smack_inode_getsecurity() > > > > - smack_inode_setsecurity() > > > > > > What's the bug? The file descriptor returned by open(O_PATH) cannot be > > > passed to read(2), write(2), fchmod(2), fchown(2), fgetxattr(2), mmap(2) etc. > > > > > > > chmod(2), chown(2), getxattr(2), and setxattr(2) take a path, not a fd. > > > > OK. Then, is the correct fix > > inode_lock(inode); > if (SOCKET_I(inode)->sk) { > // Can access SOCKET_I(sock)->sk->* > } else { > // Already close()d. Don't touch. > } > inode_unlock(inode); > > thanks to > > commit 6d8c50dcb029872b ("socket: close race condition between sock_close() and sockfs_setattr()") > commit ff7b11aa481f682e ("net: socket: set sock->sk to NULL after calling proto_ops::release()") > > changes? inode_lock() is already held during security_path_chmod(), security_path_chown(), and security_inode_setxattr(). So you can't just take it again. - Eric