From: Christian Brauner <christian.brauner@ubuntu.com>
To: Alexander Viro <viro@zeniv.linux.org.uk>,
Christoph Hellwig <hch@infradead.org>,
linux-fsdevel@vger.kernel.org
Cc: "John Johansen" <john.johansen@canonical.com>,
"James Morris" <jmorris@namei.org>,
"Mimi Zohar" <zohar@linux.ibm.com>,
"Dmitry Kasatkin" <dmitry.kasatkin@gmail.com>,
"Stephen Smalley" <stephen.smalley.work@gmail.com>,
"Casey Schaufler" <casey@schaufler-ca.com>,
"Arnd Bergmann" <arnd@arndb.de>,
"Andreas Dilger" <adilger.kernel@dilger.ca>,
"OGAWA Hirofumi" <hirofumi@mail.parknet.co.jp>,
"Geoffrey Thomas" <geofft@ldpreload.com>,
"Mrunal Patel" <mpatel@redhat.com>,
"Josh Triplett" <josh@joshtriplett.org>,
"Andy Lutomirski" <luto@kernel.org>,
"Theodore Tso" <tytso@mit.edu>, "Alban Crequy" <alban@kinvolk.io>,
"Tycho Andersen" <tycho@tycho.ws>,
"David Howells" <dhowells@redhat.com>,
"James Bottomley" <James.Bottomley@hansenpartnership.com>,
"Seth Forshee" <seth.forshee@canonical.com>,
"Stéphane Graber" <stgraber@ubuntu.com>,
"Aleksa Sarai" <cyphar@cyphar.com>,
"Lennart Poettering" <lennart@poettering.net>,
"Eric W. Biederman" <ebiederm@xmission.com>,
smbarber@chromium.org, "Phil Estes" <estesp@gmail.com>,
"Serge Hallyn" <serge@hallyn.com>,
"Kees Cook" <keescook@chromium.org>,
"Todd Kjos" <tkjos@google.com>,
"Paul Moore" <paul@paul-moore.com>,
"Jonathan Corbet" <corbet@lwn.net>,
containers@lists.linux-foundation.org,
linux-security-module@vger.kernel.org, linux-api@vger.kernel.org,
linux-ext4@vger.kernel.org, linux-integrity@vger.kernel.org,
selinux@vger.kernel.org,
"Christian Brauner" <christian.brauner@ubuntu.com>
Subject: [PATCH v4 32/40] apparmor: handle idmapped mounts
Date: Fri, 4 Dec 2020 00:57:28 +0100 [thread overview]
Message-ID: <20201203235736.3528991-33-christian.brauner@ubuntu.com> (raw)
In-Reply-To: <20201203235736.3528991-1-christian.brauner@ubuntu.com>
The i_uid and i_gid are only ever used when logging for AppArmor. This
is already broken in a bunch of places where the global root id is
reported instead of the i_uid or i_gid of the file. Nonetheless, be kind
and log the mapped inode if we're coming from an idmapped mount. If the
initial user namespace is passed nothing changes so non-idmapped mounts
will see identical behavior as before.
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
---
/* v2 */
unchanged
/* v3 */
unchanged
/* v4 */
- Serge Hallyn <serge@hallyn.com>:
- Use "mnt_userns" to refer to a vfsmount's userns everywhere to make
terminology consistent.
---
security/apparmor/domain.c | 9 ++++++---
security/apparmor/file.c | 5 ++++-
security/apparmor/lsm.c | 12 ++++++++----
3 files changed, 18 insertions(+), 8 deletions(-)
diff --git a/security/apparmor/domain.c b/security/apparmor/domain.c
index 16f184bc48de..890aa0b43bab 100644
--- a/security/apparmor/domain.c
+++ b/security/apparmor/domain.c
@@ -10,12 +10,14 @@
#include <linux/errno.h>
#include <linux/fdtable.h>
+#include <linux/fs.h>
#include <linux/file.h>
#include <linux/mount.h>
#include <linux/syscalls.h>
#include <linux/tracehook.h>
#include <linux/personality.h>
#include <linux/xattr.h>
+#include <linux/user_namespace.h>
#include "include/audit.h"
#include "include/apparmorfs.h"
@@ -858,8 +860,10 @@ int apparmor_bprm_creds_for_exec(struct linux_binprm *bprm)
const char *info = NULL;
int error = 0;
bool unsafe = false;
+ struct user_namespace *mnt_userns = mnt_user_ns(bprm->file->f_path.mnt);
+ kuid_t i_uid = i_uid_into_mnt(mnt_userns, file_inode(bprm->file));
struct path_cond cond = {
- file_inode(bprm->file)->i_uid,
+ i_uid,
file_inode(bprm->file)->i_mode
};
@@ -967,8 +971,7 @@ int apparmor_bprm_creds_for_exec(struct linux_binprm *bprm)
error = fn_for_each(label, profile,
aa_audit_file(profile, &nullperms, OP_EXEC, MAY_EXEC,
bprm->filename, NULL, new,
- file_inode(bprm->file)->i_uid, info,
- error));
+ i_uid, info, error));
aa_put_label(new);
goto done;
}
diff --git a/security/apparmor/file.c b/security/apparmor/file.c
index 92acf9a49405..d70d09a5ce7d 100644
--- a/security/apparmor/file.c
+++ b/security/apparmor/file.c
@@ -11,6 +11,8 @@
#include <linux/tty.h>
#include <linux/fdtable.h>
#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/mount.h>
#include "include/apparmor.h"
#include "include/audit.h"
@@ -508,8 +510,9 @@ static int __file_path_perm(const char *op, struct aa_label *label,
{
struct aa_profile *profile;
struct aa_perms perms = {};
+ struct user_namespace *mnt_userns = mnt_user_ns(file->f_path.mnt);
struct path_cond cond = {
- .uid = file_inode(file)->i_uid,
+ .uid = i_uid_into_mnt(mnt_userns, file_inode(file)),
.mode = file_inode(file)->i_mode
};
char *buffer;
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index ffeaee5ed968..03260983b471 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -224,7 +224,8 @@ static int common_perm(const char *op, const struct path *path, u32 mask,
*/
static int common_perm_cond(const char *op, const struct path *path, u32 mask)
{
- struct path_cond cond = { d_backing_inode(path->dentry)->i_uid,
+ struct user_namespace *mnt_userns = mnt_user_ns(path->mnt);
+ struct path_cond cond = { i_uid_into_mnt(mnt_userns, d_backing_inode(path->dentry)),
d_backing_inode(path->dentry)->i_mode
};
@@ -266,12 +267,13 @@ static int common_perm_rm(const char *op, const struct path *dir,
struct dentry *dentry, u32 mask)
{
struct inode *inode = d_backing_inode(dentry);
+ struct user_namespace *mnt_userns = mnt_user_ns(dir->mnt);
struct path_cond cond = { };
if (!inode || !path_mediated_fs(dentry))
return 0;
- cond.uid = inode->i_uid;
+ cond.uid = i_uid_into_mnt(mnt_userns, inode);
cond.mode = inode->i_mode;
return common_perm_dir_dentry(op, dir, dentry, mask, &cond);
@@ -361,11 +363,12 @@ static int apparmor_path_rename(const struct path *old_dir, struct dentry *old_d
label = begin_current_label_crit_section();
if (!unconfined(label)) {
+ struct user_namespace *mnt_userns = mnt_user_ns(old_dir->mnt);
struct path old_path = { .mnt = old_dir->mnt,
.dentry = old_dentry };
struct path new_path = { .mnt = new_dir->mnt,
.dentry = new_dentry };
- struct path_cond cond = { d_backing_inode(old_dentry)->i_uid,
+ struct path_cond cond = { i_uid_into_mnt(mnt_userns, d_backing_inode(old_dentry)),
d_backing_inode(old_dentry)->i_mode
};
@@ -420,8 +423,9 @@ static int apparmor_file_open(struct file *file)
label = aa_get_newest_cred_label(file->f_cred);
if (!unconfined(label)) {
+ struct user_namespace *mnt_userns = mnt_user_ns(file->f_path.mnt);
struct inode *inode = file_inode(file);
- struct path_cond cond = { inode->i_uid, inode->i_mode };
+ struct path_cond cond = { i_uid_into_mnt(mnt_userns, inode), inode->i_mode };
error = aa_path_perm(OP_OPEN, label, &file->f_path, 0,
aa_map_file_to_perms(file), &cond);
--
2.29.2
next prev parent reply other threads:[~2020-12-04 0:11 UTC|newest]
Thread overview: 47+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-03 23:56 [PATCH v4 00/40] idmapped mounts Christian Brauner
2020-12-03 23:56 ` [PATCH v4 01/40] namespace: take lock_mount_hash() directly when changing flags Christian Brauner
2020-12-03 23:56 ` [PATCH v4 02/40] mount: make {lock,unlock}_mount_hash() static Christian Brauner
2020-12-03 23:56 ` [PATCH v4 03/40] namespace: only take read lock in do_reconfigure_mnt() Christian Brauner
2020-12-03 23:57 ` [PATCH v4 04/40] fs: split out functions to hold writers Christian Brauner
2020-12-07 17:08 ` Christoph Hellwig
2020-12-03 23:57 ` [PATCH v4 05/40] fs: add attr_flags_to_mnt_flags helper Christian Brauner
2020-12-07 17:10 ` Christoph Hellwig
2020-12-08 10:07 ` Christian Brauner
2020-12-03 23:57 ` [PATCH v4 06/40] fs: add mount_setattr() Christian Brauner
2020-12-07 17:14 ` Christoph Hellwig
2020-12-08 10:37 ` Christian Brauner
2020-12-08 15:05 ` Christoph Hellwig
2020-12-08 15:22 ` Christian Brauner
2020-12-08 15:26 ` Christian Brauner
2020-12-03 23:57 ` [PATCH v4 07/40] tests: add mount_setattr() selftests Christian Brauner
2020-12-03 23:57 ` [PATCH v4 08/40] fs: add id translation helpers Christian Brauner
2020-12-03 23:57 ` [PATCH v4 09/40] mount: attach mappings to mounts Christian Brauner
2020-12-03 23:57 ` [PATCH v4 10/40] capability: handle idmapped mounts Christian Brauner
2020-12-03 23:57 ` [PATCH v4 11/40] namei: make permission helpers idmapped mount aware Christian Brauner
2020-12-03 23:57 ` [PATCH v4 12/40] inode: make init and " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 13/40] attr: handle idmapped mounts Christian Brauner
2020-12-03 23:57 ` [PATCH v4 14/40] acl: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 15/40] xattr: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 16/40] commoncap: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 17/40] stat: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 18/40] namei: handle idmapped mounts in may_*() helpers Christian Brauner
2020-12-03 23:57 ` [PATCH v4 19/40] namei: introduce struct renamedata Christian Brauner
2020-12-03 23:57 ` [PATCH v4 20/40] namei: prepare for idmapped mounts Christian Brauner
2020-12-03 23:57 ` [PATCH v4 21/40] open: handle idmapped mounts in do_truncate() Christian Brauner
2020-12-03 23:57 ` [PATCH v4 22/40] open: handle idmapped mounts Christian Brauner
2020-12-03 23:57 ` [PATCH v4 23/40] af_unix: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 24/40] utimes: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 25/40] fcntl: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 26/40] notify: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 27/40] init: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 28/40] ioctl: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 29/40] would_dump: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 30/40] exec: " Christian Brauner
2020-12-03 23:57 ` Christian Brauner [this message]
2020-12-03 23:57 ` [PATCH v4 33/40] ima: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 34/40] fat: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 35/40] ext4: support " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 36/40] ecryptfs: do not mount on top of " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 37/40] overlayfs: " Christian Brauner
2020-12-03 23:57 ` [PATCH v4 38/40] fs: introduce MOUNT_ATTR_IDMAP Christian Brauner
2020-12-03 23:57 ` [PATCH v4 39/40] tests: extend mount_setattr tests Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201203235736.3528991-33-christian.brauner@ubuntu.com \
--to=christian.brauner@ubuntu.com \
--cc=James.Bottomley@hansenpartnership.com \
--cc=adilger.kernel@dilger.ca \
--cc=alban@kinvolk.io \
--cc=arnd@arndb.de \
--cc=casey@schaufler-ca.com \
--cc=containers@lists.linux-foundation.org \
--cc=corbet@lwn.net \
--cc=cyphar@cyphar.com \
--cc=dhowells@redhat.com \
--cc=dmitry.kasatkin@gmail.com \
--cc=ebiederm@xmission.com \
--cc=estesp@gmail.com \
--cc=geofft@ldpreload.com \
--cc=hch@infradead.org \
--cc=hirofumi@mail.parknet.co.jp \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=josh@joshtriplett.org \
--cc=keescook@chromium.org \
--cc=lennart@poettering.net \
--cc=linux-api@vger.kernel.org \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=luto@kernel.org \
--cc=mpatel@redhat.com \
--cc=paul@paul-moore.com \
--cc=selinux@vger.kernel.org \
--cc=serge@hallyn.com \
--cc=seth.forshee@canonical.com \
--cc=smbarber@chromium.org \
--cc=stephen.smalley.work@gmail.com \
--cc=stgraber@ubuntu.com \
--cc=tkjos@google.com \
--cc=tycho@tycho.ws \
--cc=tytso@mit.edu \
--cc=viro@zeniv.linux.org.uk \
--cc=zohar@linux.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).