From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, jmorris@namei.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: casey@schaufler-ca.com, keescook@chromium.org,
john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp,
paul@paul-moore.com, sds@tycho.nsa.gov
Subject: [PATCH v7 06/16] LSM: Make multiple MAC modules safe in nfs and kernfs
Date: Wed, 7 Aug 2019 15:42:35 -0700 [thread overview]
Message-ID: <20190807224245.10798-8-casey@schaufler-ca.com> (raw)
In-Reply-To: <20190807224245.10798-1-casey@schaufler-ca.com>
Add use of "compound" security contexts to kernfs so that
multiple security modules using contexts can be represented
in the internal kernfs data. Disambiguate which security
module will be represented in NFS4.2 transactions by using only
the first encountered ismaclabel hook.
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
fs/kernfs/inode.c | 3 +-
fs/nfs/inode.c | 9 +-
fs/nfsd/nfs4proc.c | 6 +-
fs/nfsd/vfs.c | 5 +-
include/linux/security.h | 10 ++-
security/security.c | 179 ++++++++++++++++++++++++++-------------
6 files changed, 143 insertions(+), 69 deletions(-)
diff --git a/fs/kernfs/inode.c b/fs/kernfs/inode.c
index ffbf7863306d..cd225121aff7 100644
--- a/fs/kernfs/inode.c
+++ b/fs/kernfs/inode.c
@@ -185,8 +185,7 @@ static void kernfs_refresh_inode(struct kernfs_node *kn, struct inode *inode)
* persistent copy in kernfs_node.
*/
set_inode_attr(inode, &attrs->ia_iattr);
- security_inode_notifysecctx(inode, attrs->ia_context.context,
- attrs->ia_context.len);
+ security_inode_notifysecctx(inode, &attrs->ia_context);
}
if (kernfs_type(kn) == KERNFS_DIR)
diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
index 414a90d48493..8acc5eef4d08 100644
--- a/fs/nfs/inode.c
+++ b/fs/nfs/inode.c
@@ -341,13 +341,16 @@ void nfs_setsecurity(struct inode *inode, struct nfs_fattr *fattr,
struct nfs4_label *label)
{
int error;
+ struct lsmcontext context = { .slot = LSMBLOB_FIRST };
if (label == NULL)
return;
- if ((fattr->valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL) && inode->i_security) {
- error = security_inode_notifysecctx(inode, label->label,
- label->len);
+ if ((fattr->valid & NFS_ATTR_FATTR_V4_SECURITY_LABEL) &&
+ inode->i_security) {
+ context.context = label->label;
+ context.len = label->len;
+ error = security_inode_notifysecctx(inode, &context);
if (error)
printk(KERN_ERR "%s() %s %d "
"security_inode_notifysecctx() %d\n",
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 0cfd257ffdaf..0f166c81f596 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -54,12 +54,14 @@
static inline void
nfsd4_security_inode_setsecctx(struct svc_fh *resfh, struct xdr_netobj *label, u32 *bmval)
{
+ struct lsmcontext context = { .slot = LSMBLOB_FIRST };
struct inode *inode = d_inode(resfh->fh_dentry);
int status;
inode_lock(inode);
- status = security_inode_setsecctx(resfh->fh_dentry,
- label->data, label->len);
+ context.context = label->data;
+ context.len = label->len;
+ status = security_inode_setsecctx(resfh->fh_dentry, &context);
inode_unlock(inode);
if (status)
diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
index 7dc98e14655d..274a998cc123 100644
--- a/fs/nfsd/vfs.c
+++ b/fs/nfsd/vfs.c
@@ -531,6 +531,7 @@ __be32 nfsd4_set_nfs4_label(struct svc_rqst *rqstp, struct svc_fh *fhp,
__be32 error;
int host_error;
struct dentry *dentry;
+ struct lsmcontext context = { .slot = LSMBLOB_FIRST };
error = fh_verify(rqstp, fhp, 0 /* S_IFREG */, NFSD_MAY_SATTR);
if (error)
@@ -539,7 +540,9 @@ __be32 nfsd4_set_nfs4_label(struct svc_rqst *rqstp, struct svc_fh *fhp,
dentry = fhp->fh_dentry;
inode_lock(d_inode(dentry));
- host_error = security_inode_setsecctx(dentry, label->data, label->len);
+ context.context = label->data;
+ context.len = label->len;
+ host_error = security_inode_setsecctx(dentry, &context);
inode_unlock(d_inode(dentry));
return nfserrno(host_error);
}
diff --git a/include/linux/security.h b/include/linux/security.h
index 0665a27a2891..2f442746dede 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -493,8 +493,8 @@ int security_secctx_to_secid(const char *secdata, u32 seclen,
void security_release_secctx(struct lsmcontext *cp);
void security_inode_invalidate_secctx(struct inode *inode);
-int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
-int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
+int security_inode_notifysecctx(struct inode *inode, struct lsmcontext *cp);
+int security_inode_setsecctx(struct dentry *dentry, struct lsmcontext *cp);
int security_inode_getsecctx(struct inode *inode, struct lsmcontext *cp);
#else /* CONFIG_SECURITY */
@@ -1288,11 +1288,13 @@ static inline void security_inode_invalidate_secctx(struct inode *inode)
{
}
-static inline int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
+static inline int security_inode_notifysecctx(struct inode *inode,
+ struct lsmcontext *cp);
{
return -EOPNOTSUPP;
}
-static inline int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
+static inline int security_inode_setsecctx(struct dentry *dentry,
+ struct lsmcontext *cp)
{
return -EOPNOTSUPP;
}
diff --git a/security/security.c b/security/security.c
index 13102d16bf2c..c71ddae6760e 100644
--- a/security/security.c
+++ b/security/security.c
@@ -743,6 +743,42 @@ static int lsm_superblock_alloc(struct super_block *sb)
return 0;
}
+/**
+ * append_ctx - append a lsm/context pair to a compound context
+ * @ctx: the existing compound context
+ * @ctxlen: size of the old context, including terminating nul byte
+ * @lsm: new lsm name, nul terminated
+ * @new: new context, possibly nul terminated
+ * @newlen: maximum size of @new
+ *
+ * replace @ctx with a new compound context, appending @newlsm and @new
+ * to @ctx. On exit the new data replaces the old, which is freed.
+ * @ctxlen is set to the new size, which includes a trailing nul byte.
+ *
+ * Returns 0 on success, -ENOMEM if no memory is available.
+ */
+static int append_ctx(char **ctx, int *ctxlen, const char *lsm, char *new,
+ int newlen)
+{
+ char *final;
+ int llen;
+
+ llen = strlen(lsm) + 1;
+ newlen = strnlen(new, newlen) + 1;
+
+ final = kzalloc(*ctxlen + llen + newlen, GFP_KERNEL);
+ if (final == NULL)
+ return -ENOMEM;
+ if (*ctxlen)
+ memcpy(final, *ctx, *ctxlen);
+ memcpy(final + *ctxlen, lsm, llen);
+ memcpy(final + *ctxlen + llen, new, newlen);
+ kfree(*ctx);
+ *ctx = final;
+ *ctxlen = *ctxlen + llen + newlen;
+ return 0;
+}
+
/*
* Hook list operation macros.
*
@@ -2083,12 +2119,8 @@ int security_getprocattr(struct task_struct *p, const char *lsm, char *name,
struct security_hook_list *hp;
char *final = NULL;
char *cp;
- char *tp;
int rc = 0;
int finallen = 0;
- int llen;
- int clen;
- int tlen;
int display = lsm_task_display(current);
int slot = 0;
@@ -2116,26 +2148,12 @@ int security_getprocattr(struct task_struct *p, const char *lsm, char *name,
kfree(final);
return rc;
}
- llen = strlen(hp->lsmid->lsm) + 1;
- clen = strlen(cp) + 1;
- tlen = llen + clen;
- if (final)
- tlen += finallen;
- tp = kzalloc(tlen, GFP_KERNEL);
- if (tp == NULL) {
- kfree(cp);
+ rc = append_ctx(&final, &finallen, hp->lsmid->lsm,
+ cp, rc);
+ if (rc < 0) {
kfree(final);
- return -ENOMEM;
+ return rc;
}
- if (final)
- memcpy(tp, final, finallen);
- memcpy(tp + finallen, hp->lsmid->lsm, llen);
- memcpy(tp + finallen + llen, cp, clen);
- kfree(cp);
- if (final)
- kfree(final);
- final = tp;
- finallen = tlen;
}
if (final == NULL)
return -EINVAL;
@@ -2210,13 +2228,22 @@ int security_netlink_send(struct sock *sk, struct sk_buff *skb)
return call_int_hook(netlink_send, 0, sk, skb);
}
+/**
+ * security_ismaclabel - Does @name identify a MAC attribute
+ * @name: attribute name in question
+ *
+ * If @name is the name of a Mandatory Access Control (MAC) attribute
+ * that the first module on the list recognizes return 1. Don't look
+ * beyond the first module, as this is only used by NFS and NFS can't
+ * differentiate which module to use.
+ */
int security_ismaclabel(const char *name)
{
struct security_hook_list *hp;
hlist_for_each_entry(hp, &security_hook_heads.ismaclabel, list)
- if (hp->hook.ismaclabel(name) != 0)
- return 1;
+ return hp->hook.ismaclabel(name);
+
return 0;
}
EXPORT_SYMBOL(security_ismaclabel);
@@ -2284,6 +2311,15 @@ void security_release_secctx(struct lsmcontext *cp)
struct security_hook_list *hp;
bool found = false;
+ if (cp->slot == LSMBLOB_INVALID)
+ return;
+
+ if (cp->slot == LSMBLOB_COMPOUND) {
+ kfree(cp->context);
+ found = true;
+ goto clear_out;
+ }
+
hlist_for_each_entry(hp, &security_hook_heads.release_secctx, list)
if (cp->slot == hp->lsmid->slot) {
hp->hook.release_secctx(cp->context, cp->len);
@@ -2291,6 +2327,7 @@ void security_release_secctx(struct lsmcontext *cp)
break;
}
+clear_out:
memset(cp, 0, sizeof(*cp));
if (!found)
@@ -2305,30 +2342,82 @@ void security_inode_invalidate_secctx(struct inode *inode)
}
EXPORT_SYMBOL(security_inode_invalidate_secctx);
-int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
+int security_inode_notifysecctx(struct inode *inode, struct lsmcontext *cp)
{
- return call_int_hook(inode_notifysecctx, 0, inode, ctx, ctxlen);
+ struct security_hook_list *hp;
+ char *raw = cp->context;
+ char *ctx;
+ int llen;
+ int clen;
+ int rc;
+
+ if (cp->slot == LSMBLOB_COMPOUND) {
+ hlist_for_each_entry(hp,
+ &security_hook_heads.inode_notifysecctx, list) {
+ llen = strlen(raw) + 1;
+ ctx = raw + llen;
+ clen = strlen(ctx) + 1;
+ if (!strcmp(hp->lsmid->lsm, raw)) {
+ rc = hp->hook.inode_notifysecctx(inode, ctx,
+ clen);
+ if (WARN_ON(rc != 0))
+ return rc;
+ }
+ raw = ctx + clen;
+ }
+ return 0;
+ }
+
+ hlist_for_each_entry(hp, &security_hook_heads.inode_notifysecctx, list)
+ if (cp->slot == LSMBLOB_FIRST || cp->slot == hp->lsmid->slot)
+ return hp->hook.inode_notifysecctx(inode, cp->context,
+ cp->len);
+ return 0;
}
EXPORT_SYMBOL(security_inode_notifysecctx);
-int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
+int security_inode_setsecctx(struct dentry *dentry, struct lsmcontext *cp)
{
- return call_int_hook(inode_setsecctx, 0, dentry, ctx, ctxlen);
+ struct security_hook_list *hp;
+
+ if (WARN_ON(cp->slot != LSMBLOB_FIRST))
+ return -EINVAL;
+
+ hlist_for_each_entry(hp, &security_hook_heads.inode_setsecctx, list)
+ return hp->hook.inode_setsecctx(dentry, cp->context, cp->len);
+ return 0;
}
EXPORT_SYMBOL(security_inode_setsecctx);
int security_inode_getsecctx(struct inode *inode, struct lsmcontext *cp)
{
struct security_hook_list *hp;
+ char *finalctx = NULL;
+ int rc = -EOPNOTSUPP;
+ int finallen = 0;
memset(cp, 0, sizeof(*cp));
hlist_for_each_entry(hp, &security_hook_heads.inode_getsecctx, list) {
+ rc = hp->hook.inode_getsecctx(inode, (void **)&cp->context,
+ &cp->len);
+ if (rc) {
+ kfree(finalctx);
+ return rc;
+ }
cp->slot = hp->lsmid->slot;
- return hp->hook.inode_getsecctx(inode, (void **)&cp->context,
- &cp->len);
+ rc = append_ctx(&finalctx, &finallen, hp->lsmid->lsm,
+ cp->context, cp->len);
+ security_release_secctx(cp);
+ if (rc) {
+ kfree(finalctx);
+ return rc;
+ }
}
- return -EOPNOTSUPP;
+ cp->slot = LSMBLOB_COMPOUND;
+ cp->context = finalctx;
+ cp->len = finallen;
+ return 0;
}
EXPORT_SYMBOL(security_inode_getsecctx);
@@ -2433,12 +2522,9 @@ int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
struct security_hook_list *hp;
char *final = NULL;
char *cp;
- char *tp;
int rc = 0;
unsigned finallen = 0;
- unsigned llen;
unsigned clen = 0;
- unsigned tlen;
switch (display) {
case LSMBLOB_DISPLAY:
@@ -2471,29 +2557,8 @@ int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
kfree(final);
return rc;
}
- /*
- * Don't propogate trailing nul bytes.
- */
- clen = strnlen(cp, clen) + 1;
- llen = strlen(hp->lsmid->lsm) + 1;
- tlen = llen + clen;
- if (final)
- tlen += finallen;
- tp = kzalloc(tlen, GFP_KERNEL);
- if (tp == NULL) {
- kfree(cp);
- kfree(final);
- return -ENOMEM;
- }
- if (final)
- memcpy(tp, final, finallen);
- memcpy(tp + finallen, hp->lsmid->lsm, llen);
- memcpy(tp + finallen + llen, cp, clen);
- kfree(cp);
- if (final)
- kfree(final);
- final = tp;
- finallen = tlen;
+ rc = append_ctx(&final, &finallen, hp->lsmid->lsm,
+ cp, clen);
}
if (final == NULL)
return -EINVAL;
--
2.20.1
next prev parent reply other threads:[~2019-08-07 22:43 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-08-07 22:42 [PATCH v7 00/16] LSM: Full module stacking Casey Schaufler
2019-08-07 22:42 ` Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 01/16] LSM: Single hook called in secmark refcounting Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 02/16] Smack: Detect if secmarks can be safely used Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 03/16] LSM: Support multiple LSMs using inode_init_security Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 04/16] LSM: List multiple security attributes in security_inode_listsecurity Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 05/16] LSM: Multiple modules using security_ismaclabel Casey Schaufler
2019-08-07 22:42 ` Casey Schaufler [this message]
2019-08-07 22:42 ` [PATCH v7 07/16] LSM: Correct handling of ENOSYS in inode_setxattr Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 08/16] LSM: Infrastructure security blobs for mount options Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 09/16] LSM: Fix for security_init_inode_security Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 10/16] LSM: Change error detection for UDP peer security Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 11/16] Netlabel: Add a secattr comparison API function Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 12/16] Netlabel: Provide labeling type to security modules Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 13/16] LSM: Remember the NLTYPE of netlabel sockets Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 14/16] LSM: Hook for netlabel reconciliation Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 15/16] LSM: Avoid network conflicts in SELinux and Smack Casey Schaufler
2019-08-07 22:42 ` [PATCH v7 16/16] Smack: Remove the exclusive flag Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190807224245.10798-8-casey@schaufler-ca.com \
--to=casey@schaufler-ca.com \
--cc=casey.schaufler@intel.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=keescook@chromium.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).