From: Stephen Smalley <sds@tycho.nsa.gov>
To: "J. Bruce Fields" <bfields@fieldses.org>
Cc: Paul Moore <paul@paul-moore.com>,
Eric Paris <eparis@parisplace.org>,
selinux@vger.kernel.org, Scott Mayhew <smayhew@redhat.com>,
linux-nfs@vger.kernel.org
Subject: Re: [PATCH] security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock
Date: Wed, 6 Mar 2019 11:49:36 -0500 [thread overview]
Message-ID: <0d7ff441-fcfe-b68f-cdf9-44a923165a2c@tycho.nsa.gov> (raw)
In-Reply-To: <20190306153435.GF2426@fieldses.org>
On 3/6/19 10:34 AM, J. Bruce Fields wrote:
> On Wed, Mar 06, 2019 at 09:34:43AM -0500, Stephen Smalley wrote:
>> On 3/5/19 4:17 PM, J. Bruce Fields wrote:
>>> From: "J. Bruce Fields" <bfields@redhat.com>
>>>
>>> In the case when we're reusing a superblock, selinux_sb_clone_mnt_opts()
>>> fails to set set_kern_flags, with the result that
>>> nfs_clone_sb_security() incorrectly clears NFS_CAP_SECURITY_LABEL.
>>>
>>> The result is that if you mount the same NFS filesystem twice, NFS
>>> security labels are turned off, even if they would work fine if you
>>> mounted the filesystem only once.
>>>
>>> ("fixes" may be not exactly the right tag, it may be more like
>>> "fixed-other-cases-but-missed-this-one".)
>>>
>>> Cc: Scott Mayhew <smayhew@redhat.com>
>>> Cc: stable@vger.kernel.org
>>> Fixes: 0b4d3452b8b4 "security/selinux: allow security_sb_clone_mnt_opts..."
>>> Signed-off-by: J. Bruce Fields <bfields@redhat.com>
>>
>> Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
>>
>> Do you have some tests you are using for the selinux nfs support?
>
> No. I'll ask around. Trond or Anna, do either of you do any selinux
> testing?
>
>> I have an open issue on the selinux-testsuite with an example script
>> for running the regular selinux tests on a NFS mount but it can't
>> fully succeed as noted there,
>> https://github.com/SELinuxProject/selinux-testsuite/issues/32
>
> So if I just clone
> https://github.com/SELinuxProject/selinux-testsuite.git and filter out
> those known failures, would that be a good starting point?
Yes, although you might want to remove the inet_socket and sctp tests
from tests/Makefile before running it over NFS; it looks like there are
some interactions between NFS and labeled networking (netlabel and
ipsec/xfrm) that require further test policy changes to permit.
>
>> I've also have another script to test context= mount handling for
>> nfs since that should take precedence over native labels; it looks
>> like that might be broken again:
>
> Thanks for the report, I'll take a look. That's before or after
> applying this patch? Assuming the former, do you have an idea how
> recent a regression it is?
Now I'm having difficulty reproducing it entirely. I thought on stock
Fedora 29 (4.20.x) I was seeing the actual underlying security labels
leaking through on files within the NFS mount despite using a context=
mount, while correctly seeing the context mount values with your patch,
but now I can't seem to repro. It was this bug that originally
motivated Scott's commit that you are further fixing IIUC,
https://github.com/SELinuxProject/selinux-kernel/issues/35
>
> --b.
>
>> #!/bin/sh
>> cat > /etc/exports <<EOF
>> /home localhost(rw,no_root_squash,security_label)
>> EOF
>> exportfs -a
>> systemctl start nfs-server
>> mkdir -p /mnt/home
>> mount -t nfs -o vers=4.0,context=system_u:object_r:etc_t:s0
>> localhost:/home /mnt/home
>> echo "Under NFSv4.0:"
>> ls -Za /mnt/home
>> touch /mnt/home/foo
>> ls -Z /mnt/home/foo
>> ls -Z /home/foo
>> rm /mnt/home/foo
>> umount /mnt/home
>> mount -t nfs -o vers=4.2,context=system_u:object_r:etc_t:s0
>> localhost:/home /mnt/home
>> echo "Under NFSv4.2:"
>> ls -Za /mnt/home
>> touch /mnt/home/foo
>> ls -Z /mnt/home/foo
>> ls -Z /home/foo
>> rm /home/foo
>> umount /mnt/home
>> rmdir /mnt/home
>> rm /etc/exports
>> exportfs -ua
>> systemctl stop nfs-server
>>
>>> ---
>>> security/selinux/hooks.c | 5 ++++-
>>> 1 file changed, 4 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
>>> index f0e36c3492ba..5e9304567233 100644
>>> --- a/security/selinux/hooks.c
>>> +++ b/security/selinux/hooks.c
>>> @@ -959,8 +959,11 @@ static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
>>> BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
>>> /* if fs is reusing a sb, make sure that the contexts match */
>>> - if (newsbsec->flags & SE_SBINITIALIZED)
>>> + if (newsbsec->flags & SE_SBINITIALIZED) {
>>> + if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
>>> + *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
>>> return selinux_cmp_sb_context(oldsb, newsb);
>>> + }
>>> mutex_lock(&newsbsec->lock);
>>>
next prev parent reply other threads:[~2019-03-06 16:49 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-05 21:17 [PATCH] security/selinux: fix SECURITY_LSM_NATIVE_LABELS on reused superblock J. Bruce Fields
2019-03-05 21:25 ` J. Bruce Fields
2019-03-06 14:34 ` Stephen Smalley
2019-03-06 15:34 ` J. Bruce Fields
2019-03-06 16:49 ` Stephen Smalley [this message]
2019-03-06 17:25 ` J. Bruce Fields
2019-03-06 17:28 ` Stephen Smalley
2019-03-11 20:12 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0d7ff441-fcfe-b68f-cdf9-44a923165a2c@tycho.nsa.gov \
--to=sds@tycho.nsa.gov \
--cc=bfields@fieldses.org \
--cc=eparis@parisplace.org \
--cc=linux-nfs@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=selinux@vger.kernel.org \
--cc=smayhew@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).