From: Casey Schaufler <casey@schaufler-ca.com>
To: John Johansen <john.johansen@canonical.com>,
casey.schaufler@intel.com, jmorris@namei.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: linux-audit@redhat.com, keescook@chromium.org,
penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com,
sds@tycho.nsa.gov, linux-api@vger.kernel.org,
Casey Schaufler <casey@schaufler-ca.com>
Subject: Re: [PATCH v19 22/23] LSM: Add /proc attr entry for full LSM context
Date: Thu, 30 Jul 2020 15:22:47 -0700 [thread overview]
Message-ID: <18fcf6b1-3ef6-bb8b-d2b2-e0fd45bdb68c@schaufler-ca.com> (raw)
In-Reply-To: <97330b2d-5447-cfef-b6d0-444249e671b7@canonical.com>
On 7/30/2020 1:57 PM, John Johansen wrote:
> On 7/30/20 1:44 PM, Casey Schaufler wrote:
>> On 7/30/2020 3:03 AM, John Johansen wrote:
>>> On 7/24/20 1:32 PM, Casey Schaufler wrote:
>>>> Add an entry /proc/.../attr/context which displays the full
>>>> process security "context" in compound format:
>>>> lsm1\0value\0lsm2\0value\0...
>>>> This entry is not writable.
>>>>
>>>> A security module may decide that its policy does not allow
>>>> this information to be displayed. In this case none of the
>>>> information will be displayed.
>>>>
>>>> Reviewed-by: Kees Cook <keescook@chromium.org>
>>>> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
>>>> Cc: linux-api@vger.kernel.org
>>>> ---
>>>> Documentation/security/lsm.rst | 28 +++++++++++
>>>> fs/proc/base.c | 1 +
>>>> include/linux/lsm_hooks.h | 6 +++
>>>> security/apparmor/include/procattr.h | 2 +-
>>>> security/apparmor/lsm.c | 8 +++-
>>>> security/apparmor/procattr.c | 22 +++++----
>>>> security/security.c | 70 ++++++++++++++++++++++++++++
>>>> security/selinux/hooks.c | 2 +-
>>>> security/smack/smack_lsm.c | 2 +-
>>>> 9 files changed, 126 insertions(+), 15 deletions(-)
>> <snip>
>>
>>>>
>>>> /**
>>>> diff --git a/security/security.c b/security/security.c
>>>> index d35e578fa45b..bce6be720401 100644
>>>> --- a/security/security.c
>>>> +++ b/security/security.c
>>>> @@ -754,6 +754,48 @@ static void __init lsm_early_task(struct task_struct *task)
>>>> panic("%s: Early task alloc failed.\n", __func__);
>>>> }
>>>>
>>>> +/**
>>>> + * append_ctx - append a lsm/context pair to a compound context
>>>> + * @ctx: the existing compound context
>>>> + * @ctxlen: size of the old context, including terminating nul byte
>>>> + * @lsm: new lsm name, nul terminated
>>>> + * @new: new context, possibly nul terminated
>>>> + * @newlen: maximum size of @new
>>>> + *
>>>> + * replace @ctx with a new compound context, appending @newlsm and @new
>>>> + * to @ctx. On exit the new data replaces the old, which is freed.
>>>> + * @ctxlen is set to the new size, which includes a trailing nul byte.
>>>> + *
>>>> + * Returns 0 on success, -ENOMEM if no memory is available.
>>>> + */
>>>> +static int append_ctx(char **ctx, int *ctxlen, const char *lsm, char *new,
>>>> + int newlen)
>>>> +{
>>>> + char *final;
>>>> + size_t llen;
>>>> +
>>>> + llen = strlen(lsm) + 1;
>>>> + /*
>>>> + * A security module may or may not provide a trailing nul on
>>>> + * when returning a security context. There is no definition
>>>> + * of which it should be, and there are modules that do it
>>>> + * each way.
>>>> + */
>>>> + newlen = strnlen(new, newlen) + 1;
>>>> +
>>>> + final = kzalloc(*ctxlen + llen + newlen, GFP_KERNEL);
>>>> + if (final == NULL)
>>>> + return -ENOMEM;
>>>> + if (*ctxlen)
>>>> + memcpy(final, *ctx, *ctxlen);
>>>> + memcpy(final + *ctxlen, lsm, llen);
>>>> + memcpy(final + *ctxlen + llen, new, newlen);
>>> if @new doesn't have a newline appended at its end this will read 1 byte
>>> passed the end of the @new buffer. Nor will the result have a trailing
>>> \0 as expected unless we get lucky.
>> @new will never have a newline at the end. The trailing nul comes
>> from the allocation being done with kzalloc(). This function has to
>> be considered in the context of its caller.
>>
> ugh, sorry not trailing newline, I meant trailing \0. The problem isn't
> the kzalloc, the target has the space. It is the source @new. It is
> dangerous to assume that the @new buffer has a null byte after its
> declared length. Which is potentially what we are doing if @new
> doesn't have an embedded null byte. In that case strlen(new, newlen)
> will then return newlen and we add 1 to it.
>
> which means in the memcpy we are copying an extra byte beyond what
> was declared to exist in @new.
You're right. Good point. Fix coming.
??
next prev parent reply other threads:[~2020-07-30 22:22 UTC|newest]
Thread overview: 46+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200724203226.16374-1-casey.ref@schaufler-ca.com>
2020-07-24 20:32 ` [PATCH v19 00/23] LSM: Module stacking for AppArmor Casey Schaufler
2020-07-24 20:32 ` [PATCH v19 01/23] LSM: Infrastructure management of the sock security Casey Schaufler
2020-07-24 20:32 ` [PATCH v19 02/23] LSM: Create and manage the lsmblob data structure Casey Schaufler
2020-07-27 16:12 ` Stephen Smalley
2020-07-27 21:04 ` Casey Schaufler
2020-07-28 19:50 ` John Johansen
2020-07-24 20:32 ` [PATCH v19 03/23] LSM: Use lsmblob in security_audit_rule_match Casey Schaufler
2020-07-24 20:32 ` [PATCH v19 04/23] LSM: Use lsmblob in security_kernel_act_as Casey Schaufler
2020-07-28 10:34 ` John Johansen
2020-07-24 20:32 ` [PATCH v19 05/23] net: Prepare UDS for security module stacking Casey Schaufler
2020-07-28 10:57 ` John Johansen
2020-07-24 20:32 ` [PATCH v19 06/23] LSM: Use lsmblob in security_secctx_to_secid Casey Schaufler
2020-07-28 11:11 ` John Johansen
2020-07-28 23:41 ` Casey Schaufler
2020-07-29 0:30 ` John Johansen
2020-07-24 20:32 ` [PATCH v19 07/23] LSM: Use lsmblob in security_secid_to_secctx Casey Schaufler
2020-07-24 20:32 ` [PATCH v19 08/23] LSM: Use lsmblob in security_ipc_getsecid Casey Schaufler
2020-07-24 20:32 ` [PATCH v19 09/23] LSM: Use lsmblob in security_task_getsecid Casey Schaufler
2020-07-24 20:32 ` [PATCH v19 10/23] LSM: Use lsmblob in security_inode_getsecid Casey Schaufler
2020-07-24 20:32 ` [PATCH v19 11/23] LSM: Use lsmblob in security_cred_getsecid Casey Schaufler
2020-07-24 20:32 ` [PATCH v19 12/23] IMA: Change internal interfaces to use lsmblobs Casey Schaufler
2020-07-24 20:32 ` [PATCH v19 13/23] LSM: Specify which LSM to display Casey Schaufler
2020-07-27 20:36 ` James Morris
2020-07-27 20:40 ` John Johansen
2020-07-28 18:29 ` John Johansen
2020-07-24 20:32 ` [PATCH v19 14/23] LSM: Ensure the correct LSM context releaser Casey Schaufler
2020-07-24 20:32 ` [PATCH v19 15/23] LSM: Use lsmcontext in security_secid_to_secctx Casey Schaufler
2020-07-28 20:13 ` John Johansen
2020-07-24 20:32 ` [PATCH v19 16/23] LSM: Use lsmcontext in security_inode_getsecctx Casey Schaufler
2020-07-28 20:28 ` John Johansen
2020-07-24 20:32 ` [PATCH v19 17/23] LSM: security_secid_to_secctx in netlink netfilter Casey Schaufler
2020-07-27 20:37 ` James Morris
2020-07-24 20:32 ` [PATCH v19 18/23] NET: Store LSM netlabel data in a lsmblob Casey Schaufler
2020-07-24 20:32 ` [PATCH v19 19/23] LSM: Verify LSM display sanity in binder Casey Schaufler
2020-07-30 8:40 ` John Johansen
2020-07-24 20:32 ` [PATCH v19 20/23] Audit: Add new record for multiple process LSM attributes Casey Schaufler
2020-07-27 19:04 ` Stephen Smalley
2020-07-24 20:32 ` [PATCH v19 21/23] Audit: Add a new record for multiple object " Casey Schaufler
2020-07-27 20:40 ` James Morris
2020-07-24 20:32 ` [PATCH v19 22/23] LSM: Add /proc attr entry for full LSM context Casey Schaufler
2020-07-30 10:03 ` John Johansen
2020-07-30 20:44 ` Casey Schaufler
2020-07-30 20:57 ` John Johansen
2020-07-30 22:22 ` Casey Schaufler [this message]
2020-07-24 20:32 ` [PATCH v19 23/23] AppArmor: Remove the exclusive flag Casey Schaufler
2020-07-30 9:23 ` John Johansen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=18fcf6b1-3ef6-bb8b-d2b2-e0fd45bdb68c@schaufler-ca.com \
--to=casey@schaufler-ca.com \
--cc=casey.schaufler@intel.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=keescook@chromium.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-audit@redhat.com \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).