From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 42087C433EA for ; Mon, 27 Jul 2020 19:47:04 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 27A5D2073E for ; Mon, 27 Jul 2020 19:47:04 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728524AbgG0TrD (ORCPT ); Mon, 27 Jul 2020 15:47:03 -0400 Received: from smtp-1909.mail.infomaniak.ch ([185.125.25.9]:41873 "EHLO smtp-1909.mail.infomaniak.ch" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726196AbgG0TrD (ORCPT ); Mon, 27 Jul 2020 15:47:03 -0400 Received: from smtp-2-0000.mail.infomaniak.ch (unknown [10.5.36.107]) by smtp-2-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4BFr1022KyzlhTrH; Mon, 27 Jul 2020 21:47:00 +0200 (CEST) Received: from ns3096276.ip-94-23-54.eu (unknown [94.23.54.103]) by smtp-2-0000.mail.infomaniak.ch (Postfix) with ESMTPA id 4BFr0w2zRPzlh8T4; Mon, 27 Jul 2020 21:46:56 +0200 (CEST) Subject: Re: [PATCH v7 4/7] fs: Introduce O_MAYEXEC flag for openat2(2) To: Florian Weimer , Al Viro Cc: linux-kernel@vger.kernel.org, Aleksa Sarai , Alexei Starovoitov , Andrew Morton , Andy Lutomirski , Christian Brauner , Christian Heimes , Daniel Borkmann , Deven Bowers , Dmitry Vyukov , Eric Biggers , Eric Chiang , James Morris , Jan Kara , Jann Horn , Jonathan Corbet , Kees Cook , Lakshmi Ramasubramanian , Matthew Garrett , Matthew Wilcox , Michael Kerrisk , Mimi Zohar , =?UTF-8?Q?Philippe_Tr=c3=a9buchet?= , Scott Shell , Sean Christopherson , Shuah Khan , Steve Dower , Steve Grubb , Tetsuo Handa , Thibaut Sautereau , Vincent Strubel , kernel-hardening@lists.openwall.com, linux-api@vger.kernel.org, linux-integrity@vger.kernel.org, linux-security-module@vger.kernel.org, linux-fsdevel@vger.kernel.org, Thibaut Sautereau References: <20200723171227.446711-1-mic@digikod.net> <20200723171227.446711-5-mic@digikod.net> <20200727042106.GB794331@ZenIV.linux.org.uk> <87y2n55xzv.fsf@oldenburg2.str.redhat.com> From: =?UTF-8?Q?Micka=c3=abl_Sala=c3=bcn?= Message-ID: Date: Mon, 27 Jul 2020 21:46:55 +0200 User-Agent: MIME-Version: 1.0 In-Reply-To: <87y2n55xzv.fsf@oldenburg2.str.redhat.com> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 8bit X-Antivirus: Dr.Web (R) for Unix mail servers drweb plugin ver.6.0.2.8 X-Antivirus-Code: 0x100000 Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: On 27/07/2020 07:27, Florian Weimer wrote: > * Al Viro: > >> On Thu, Jul 23, 2020 at 07:12:24PM +0200, Mickaël Salaün wrote: >>> When the O_MAYEXEC flag is passed, openat2(2) may be subject to >>> additional restrictions depending on a security policy managed by the >>> kernel through a sysctl or implemented by an LSM thanks to the >>> inode_permission hook. This new flag is ignored by open(2) and >>> openat(2) because of their unspecified flags handling. When used with >>> openat2(2), the default behavior is only to forbid to open a directory. >> >> Correct me if I'm wrong, but it looks like you are introducing a magical >> flag that would mean "let the Linux S&M take an extra special whip >> for this open()". There is nothing magic, it doesn't only work with the LSM framework, and there is nothing painful nor humiliating here (except maybe this language). >> >> Why is it done during open? If the caller is passing it deliberately, >> why not have an explicit request to apply given torture device to an >> already opened file? Why not sys_masochism(int fd, char *hurt_flavour), >> for that matter? > > While I do not think this is appropriate language for a workplace, Al > has a point: If the auditing event can be generated on an already-open > descriptor, it would also cover scenarios like this one: > > perl < /path/to/script > > Where the process that opens the file does not (and cannot) know that it > will be used for execution purposes. The check is done during open because the goal of this patch series is to address the problem of script execution when opening a script in well controlled systems (e.g. to enforce a "write xor execute" policy, to do an atomic integrity check [1], to check specific execute/read permissions, etc.). As discussed multiple times, controlling other means to interpret commands (stdin, environment variables, etc.) is out of scope and should be handled by interpreters (in userspace). Someone could still extend fcntl(2) to enable to check file descriptors, but it is an independent change not required for now. Specific audit features are also out of scope for now [2]. [1] https://lore.kernel.org/lkml/1544699060.6703.11.camel@linux.ibm.com/ [2] https://lore.kernel.org/lkml/202007160822.CCDB5478@keescook/