1. 04 May, 2018 1 commit
    • David Herrmann's avatar
      security: add hook for socketpair() · aae7cfcb
      David Herrmann authored
      Right now the LSM labels for socketpairs are always uninitialized,
      since there is no security hook for the socketpair() syscall. This
      patch adds the required hooks so LSMs can properly label socketpairs.
      This allows SO_PEERSEC to return useful information on those sockets.
      
      Note that the behavior of socketpair() can be emulated by creating a
      listener socket, connecting to it, and then discarding the initial
      listener socket. With this workaround, SO_PEERSEC would return the
      caller's security context. However, with socketpair(), the uninitialized
      context is returned unconditionally. This is unexpected and makes
      socketpair() less useful in situations where the security context is
      crucial to the application.
      
      With the new socketpair-hook this disparity can be solved by making
      socketpair() return the expected security context.
      Acked-by: Serge Hallyn's avatarSerge Hallyn <serge@hallyn.com>
      Signed-off-by: default avatarTom Gundersen <teg@jklm.no>
      Signed-off-by: David Herrmann's avatarDavid Herrmann <dh.herrmann@gmail.com>
      Signed-off-by: default avatarJames Morris <james.morris@microsoft.com>
      aae7cfcb
  2. 06 Apr, 2018 1 commit
  3. 31 Mar, 2018 1 commit
  4. 23 Mar, 2018 4 commits
  5. 06 Mar, 2018 1 commit
  6. 22 Feb, 2018 1 commit
  7. 20 Oct, 2017 1 commit
    • Chenbo Feng's avatar
      security: bpf: Add LSM hooks for bpf object related syscall · afdb09c7
      Chenbo Feng authored
      Introduce several LSM hooks for the syscalls that will allow the
      userspace to access to eBPF object such as eBPF programs and eBPF maps.
      The security check is aimed to enforce a per object security protection
      for eBPF object so only processes with the right priviliges can
      read/write to a specific map or use a specific eBPF program. Besides
      that, a general security hook is added before the multiplexer of bpf
      syscall to check the cmd and the attribute used for the command. The
      actual security module can decide which command need to be checked and
      how the cmd should be checked.
      Signed-off-by: default avatarChenbo Feng <fengc@google.com>
      Acked-by: default avatarJames Morris <james.l.morris@oracle.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      afdb09c7
  8. 01 Aug, 2017 1 commit
  9. 18 Jul, 2017 1 commit
  10. 09 Jun, 2017 1 commit
    • Scott Mayhew's avatar
      security/selinux: allow security_sb_clone_mnt_opts to enable/disable native labeling behavior · 0b4d3452
      Scott Mayhew authored
      When an NFSv4 client performs a mount operation, it first mounts the
      NFSv4 root and then does path walk to the exported path and performs a
      submount on that, cloning the security mount options from the root's
      superblock to the submount's superblock in the process.
      
      Unless the NFS server has an explicit fsid=0 export with the
      "security_label" option, the NFSv4 root superblock will not have
      SBLABEL_MNT set, and neither will the submount superblock after cloning
      the security mount options.  As a result, setxattr's of security labels
      over NFSv4.2 will fail.  In a similar fashion, NFSv4.2 mounts mounted
      with the context= mount option will not show the correct labels because
      the nfs_server->caps flags of the cloned superblock will still have
      NFS_CAP_SECURITY_LABEL set.
      
      Allowing the NFSv4 client to enable or disable SECURITY_LSM_NATIVE_LABELS
      behavior will ensure that the SBLABEL_MNT flag has the correct value
      when the client traverses from an exported path without the
      "security_label" option to one with the "security_label" option and
      vice versa.  Similarly, checking to see if SECURITY_LSM_NATIVE_LABELS is
      set upon return from security_sb_clone_mnt_opts() and clearing
      NFS_CAP_SECURITY_LABEL if necessary will allow the correct labels to
      be displayed for NFSv4.2 mounts mounted with the context= mount option.
      
      Resolves: https://github.com/SELinuxProject/selinux-kernel/issues/35Signed-off-by: default avatarScott Mayhew <smayhew@redhat.com>
      Reviewed-by: Stephen Smalley's avatarStephen Smalley <sds@tycho.nsa.gov>
      Tested-by: Stephen Smalley's avatarStephen Smalley <sds@tycho.nsa.gov>
      Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
      0b4d3452
  11. 23 May, 2017 3 commits
    • Daniel Jurgens's avatar
      IB/core: Enforce security on management datagrams · 47a2b338
      Daniel Jurgens authored
      Allocate and free a security context when creating and destroying a MAD
      agent.  This context is used for controlling access to PKeys and sending
      and receiving SMPs.
      
      When sending or receiving a MAD check that the agent has permission to
      access the PKey for the Subnet Prefix of the port.
      
      During MAD and snoop agent registration for SMI QPs check that the
      calling process has permission to access the manage the subnet  and
      register a callback with the LSM to be notified of policy changes. When
      notificaiton of a policy change occurs recheck permission and set a flag
      indicating sending and receiving SMPs is allowed.
      
      When sending and receiving MADs check that the agent has access to the
      SMI if it's on an SMI QP.  Because security policy can change it's
      possible permission was allowed when creating the agent, but no longer
      is.
      Signed-off-by: default avatarDaniel Jurgens <danielj@mellanox.com>
      Acked-by: Doug Ledford's avatarDoug Ledford <dledford@redhat.com>
      [PM: remove the LSM hook init code]
      Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
      47a2b338
    • Daniel Jurgens's avatar
      selinux lsm IB/core: Implement LSM notification system · 8f408ab6
      Daniel Jurgens authored
      Add a generic notificaiton mechanism in the LSM. Interested consumers
      can register a callback with the LSM and security modules can produce
      events.
      
      Because access to Infiniband QPs are enforced in the setup phase of a
      connection security should be enforced again if the policy changes.
      Register infiniband devices for policy change notification and check all
      QPs on that device when the notification is received.
      
      Add a call to the notification mechanism from SELinux when the AVC
      cache changes or setenforce is cleared.
      Signed-off-by: default avatarDaniel Jurgens <danielj@mellanox.com>
      Acked-by: default avatarJames Morris <james.l.morris@oracle.com>
      Acked-by: Doug Ledford's avatarDoug Ledford <dledford@redhat.com>
      Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
      8f408ab6
    • Daniel Jurgens's avatar
      IB/core: Enforce PKey security on QPs · d291f1a6
      Daniel Jurgens authored
      Add new LSM hooks to allocate and free security contexts and check for
      permission to access a PKey.
      
      Allocate and free a security context when creating and destroying a QP.
      This context is used for controlling access to PKeys.
      
      When a request is made to modify a QP that changes the port, PKey index,
      or alternate path, check that the QP has permission for the PKey in the
      PKey table index on the subnet prefix of the port. If the QP is shared
      make sure all handles to the QP also have access.
      
      Store which port and PKey index a QP is using. After the reset to init
      transition the user can modify the port, PKey index and alternate path
      independently. So port and PKey settings changes can be a merge of the
      previous settings and the new ones.
      
      In order to maintain access control if there are PKey table or subnet
      prefix change keep a list of all QPs are using each PKey index on
      each port. If a change occurs all QPs using that device and port must
      have access enforced for the new cache settings.
      
      These changes add a transaction to the QP modify process. Association
      with the old port and PKey index must be maintained if the modify fails,
      and must be removed if it succeeds. Association with the new port and
      PKey index must be established prior to the modify and removed if the
      modify fails.
      
      1. When a QP is modified to a particular Port, PKey index or alternate
         path insert that QP into the appropriate lists.
      
      2. Check permission to access the new settings.
      
      3. If step 2 grants access attempt to modify the QP.
      
      4a. If steps 2 and 3 succeed remove any prior associations.
      
      4b. If ether fails remove the new setting associations.
      
      If a PKey table or subnet prefix changes walk the list of QPs and
      check that they have permission. If not send the QP to the error state
      and raise a fatal error event. If it's a shared QP make sure all the
      QPs that share the real_qp have permission as well. If the QP that
      owns a security structure is denied access the security structure is
      marked as such and the QP is added to an error_list. Once the moving
      the QP to error is complete the security structure mark is cleared.
      
      Maintaining the lists correctly turns QP destroy into a transaction.
      The hardware driver for the device frees the ib_qp structure, so while
      the destroy is in progress the ib_qp pointer in the ib_qp_security
      struct is undefined. When the destroy process begins the ib_qp_security
      structure is marked as destroying. This prevents any action from being
      taken on the QP pointer. After the QP is destroyed successfully it
      could still listed on an error_list wait for it to be processed by that
      flow before cleaning up the structure.
      
      If the destroy fails the QPs port and PKey settings are reinserted into
      the appropriate lists, the destroying flag is cleared, and access control
      is enforced, in case there were any cache changes during the destroy
      flow.
      
      To keep the security changes isolated a new file is used to hold security
      related functionality.
      Signed-off-by: default avatarDaniel Jurgens <danielj@mellanox.com>
      Acked-by: Doug Ledford's avatarDoug Ledford <dledford@redhat.com>
      [PM: merge fixup in ib_verbs.h and uverbs_cmd.c]
      Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
      d291f1a6
  12. 14 May, 2017 1 commit
    • Mickaël Salaün's avatar
      LSM: Enable multiple calls to security_add_hooks() for the same LSM · 3bb857e4
      Mickaël Salaün authored
      The commit d69dece5 ("LSM: Add /sys/kernel/security/lsm") extend
      security_add_hooks() with a new parameter to register the LSM name,
      which may be useful to make the list of currently loaded LSM available
      to userspace. However, there is no clean way for an LSM to split its
      hook declarations into multiple files, which may reduce the mess with
      all the included files (needed for LSM hook argument types) and make the
      source code easier to review and maintain.
      
      This change allows an LSM to register multiple times its hook while
      keeping a consistent list of LSM names as described in
      Documentation/security/LSM.txt . The list reflects the order in which
      checks are made. This patch only check for the last registered LSM. If
      an LSM register multiple times its hooks, interleaved with other LSM
      registrations (which should not happen), its name will still appear in
      the same order that the hooks are called, hence multiple times.
      
      To sum up, "capability,selinux,foo,foo" will be replaced with
      "capability,selinux,foo", however "capability,foo,selinux,foo" will
      remain as is.
      Signed-off-by: default avatarMickaël Salaün <mic@digikod.net>
      Acked-by: default avatarKees Cook <keescook@chromium.org>
      Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
      Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
      3bb857e4
  13. 02 Apr, 2017 1 commit
    • mchehab@s-opensource.com's avatar
      kernel-api.rst: fix a series of errors when parsing C files · 0e056eb5
      mchehab@s-opensource.com authored
      ./lib/string.c:134: WARNING: Inline emphasis start-string without end-string.
      ./mm/filemap.c:522: WARNING: Inline interpreted text or phrase reference start-string without end-string.
      ./mm/filemap.c:1283: ERROR: Unexpected indentation.
      ./mm/filemap.c:3003: WARNING: Inline interpreted text or phrase reference start-string without end-string.
      ./mm/vmalloc.c:1544: WARNING: Inline emphasis start-string without end-string.
      ./mm/page_alloc.c:4245: ERROR: Unexpected indentation.
      ./ipc/util.c:676: ERROR: Unexpected indentation.
      ./drivers/pci/irq.c:35: WARNING: Block quote ends without a blank line; unexpected unindent.
      ./security/security.c:109: ERROR: Unexpected indentation.
      ./security/security.c:110: WARNING: Definition list ends without a blank line; unexpected unindent.
      ./block/genhd.c:275: WARNING: Inline strong start-string without end-string.
      ./block/genhd.c:283: WARNING: Inline strong start-string without end-string.
      ./include/linux/clk.h:134: WARNING: Inline emphasis start-string without end-string.
      ./include/linux/clk.h:134: WARNING: Inline emphasis start-string without end-string.
      ./ipc/util.c:477: ERROR: Unknown target name: "s".
      Signed-off-by: default avatarMauro Carvalho Chehab <mchehab@s-opensource.com>
      Acked-by: default avatarBjorn Helgaas <bhelgaas@google.com>
      Signed-off-by: default avatarJonathan Corbet <corbet@lwn.net>
      0e056eb5
  14. 28 Mar, 2017 1 commit
    • Tetsuo Handa's avatar
      LSM: Revive security_task_alloc() hook and per "struct task_struct" security blob. · e4e55b47
      Tetsuo Handa authored
      We switched from "struct task_struct"->security to "struct cred"->security
      in Linux 2.6.29. But not all LSM modules were happy with that change.
      TOMOYO LSM module is an example which want to use per "struct task_struct"
      security blob, for TOMOYO's security context is defined based on "struct
      task_struct" rather than "struct cred". AppArmor LSM module is another
      example which want to use it, for AppArmor is currently abusing the cred
      a little bit to store the change_hat and setexeccon info. Although
      security_task_free() hook was revived in Linux 3.4 because Yama LSM module
      wanted to release per "struct task_struct" security blob,
      security_task_alloc() hook and "struct task_struct"->security field were
      not revived. Nowadays, we are getting proposals of lightweight LSM modules
      which want to use per "struct task_struct" security blob.
      
      We are already allowing multiple concurrent LSM modules (up to one fully
      armored module which uses "struct cred"->security field or exclusive hooks
      like security_xfrm_state_pol_flow_match(), plus unlimited number of
      lightweight modules which do not use "struct cred"->security nor exclusive
      hooks) as long as they are built into the kernel. But this patch does not
      implement variable length "struct task_struct"->security field which will
      become needed when multiple LSM modules want to use "struct task_struct"->
      security field. Although it won't be difficult to implement variable length
      "struct task_struct"->security field, let's think about it after we merged
      this patch.
      Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
      Acked-by: default avatarJohn Johansen <john.johansen@canonical.com>
      Acked-by: Serge Hallyn's avatarSerge Hallyn <serge@hallyn.com>
      Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
      Tested-by: Djalal Harouni's avatarDjalal Harouni <tixxdz@gmail.com>
      Acked-by: josé bollo's avatarJosé Bollo <jobol@nonadev.net>
      Cc: Paul Moore <paul@paul-moore.com>
      Cc: Stephen Smalley <sds@tycho.nsa.gov>
      Cc: Eric Paris <eparis@parisplace.org>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: James Morris <james.l.morris@oracle.com>
      Cc: José Bollo <jobol@nonadev.net>
      Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
      e4e55b47
  15. 24 Mar, 2017 1 commit
  16. 06 Mar, 2017 1 commit
  17. 05 Mar, 2017 1 commit
    • Stephen Smalley's avatar
      prlimit,security,selinux: add a security hook for prlimit · 791ec491
      Stephen Smalley authored
      When SELinux was first added to the kernel, a process could only get
      and set its own resource limits via getrlimit(2) and setrlimit(2), so no
      MAC checks were required for those operations, and thus no security hooks
      were defined for them. Later, SELinux introduced a hook for setlimit(2)
      with a check if the hard limit was being changed in order to be able to
      rely on the hard limit value as a safe reset point upon context
      transitions.
      
      Later on, when prlimit(2) was added to the kernel with the ability to get
      or set resource limits (hard or soft) of another process, LSM/SELinux was
      not updated other than to pass the target process to the setrlimit hook.
      This resulted in incomplete control over both getting and setting the
      resource limits of another process.
      
      Add a new security_task_prlimit() hook to the check_prlimit_permission()
      function to provide complete mediation.  The hook is only called when
      acting on another task, and only if the existing DAC/capability checks
      would allow access.  Pass flags down to the hook to indicate whether the
      prlimit(2) call will read, write, or both read and write the resource
      limits of the target process.
      
      The existing security_task_setrlimit() hook is left alone; it continues
      to serve a purpose in supporting the ability to make decisions based on
      the old and/or new resource limit values when setting limits.  This
      is consistent with the DAC/capability logic, where
      check_prlimit_permission() performs generic DAC/capability checks for
      acting on another task, while do_prlimit() performs a capability check
      based on a comparison of the old and new resource limits.  Fix the
      inline documentation for the hook to match the code.
      
      Implement the new hook for SELinux.  For setting resource limits, we
      reuse the existing setrlimit permission.  Note that this does overload
      the setrlimit permission to mean the ability to set the resource limit
      (soft or hard) of another process or the ability to change one's own
      hard limit.  For getting resource limits, a new getrlimit permission
      is defined.  This was not originally defined since getrlimit(2) could
      only be used to obtain a process' own limits.
      Signed-off-by: Stephen Smalley's avatarStephen Smalley <sds@tycho.nsa.gov>
      Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
      791ec491
  18. 19 Jan, 2017 1 commit
  19. 12 Jan, 2017 1 commit
  20. 09 Jan, 2017 1 commit
  21. 09 Aug, 2016 3 commits
  22. 21 Jul, 2016 1 commit
  23. 06 Jun, 2016 1 commit
    • Casey Schaufler's avatar
      LSM: Fix for security_inode_getsecurity and -EOPNOTSUPP · 2885c1e3
      Casey Schaufler authored
      Serge Hallyn pointed out that the current implementation of
      security_inode_getsecurity() works if there is only one hook
      provided for it, but will fail if there is more than one and
      the attribute requested isn't supplied by the first module.
      This isn't a problem today, since only SELinux and Smack
      provide this hook and there is (currently) no way to enable
      both of those modules at the same time. Serge, however, wants
      to introduce a capability attribute and an inode_getsecurity
      hook in the capability security module to handle it. This
      addresses that upcoming problem, will be required for "extreme
      stacking" and is just a better implementation.
      Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
      Acked-by: Serge Hallyn's avatarSerge Hallyn <serge@hallyn.com>
      Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
      2885c1e3
  24. 22 Apr, 2016 1 commit
    • Baolin Wang's avatar
      security: Introduce security_settime64() · 457db29b
      Baolin Wang authored
      security_settime() uses a timespec, which is not year 2038 safe
      on 32bit systems. Thus this patch introduces the security_settime64()
      function with timespec64 type. We also convert the cap_settime() helper
      function to use the 64bit types.
      
      This patch then moves security_settime() to the header file as an
      inline helper function so that existing users can be iteratively
      converted.
      
      None of the existing hooks is using the timespec argument and therefor
      the patch is not making any functional changes.
      
      Cc: Serge Hallyn <serge.hallyn@canonical.com>,
      Cc: James Morris <james.l.morris@oracle.com>,
      Cc: "Serge E. Hallyn" <serge@hallyn.com>,
      Cc: Paul Moore <pmoore@redhat.com>
      Cc: Stephen Smalley <sds@tycho.nsa.gov>
      Cc: Kees Cook <keescook@chromium.org>
      Cc: Prarit Bhargava <prarit@redhat.com>
      Cc: Richard Cochran <richardcochran@gmail.com>
      Cc: Thomas Gleixner <tglx@linutronix.de>
      Cc: Ingo Molnar <mingo@kernel.org>
      Reviewed-by: default avatarJames Morris <james.l.morris@oracle.com>
      Signed-off-by: default avatarBaolin Wang <baolin.wang@linaro.org>
      [jstultz: Reworded commit message]
      Signed-off-by: default avatarJohn Stultz <john.stultz@linaro.org>
      457db29b
  25. 21 Apr, 2016 1 commit
  26. 11 Apr, 2016 1 commit
  27. 28 Mar, 2016 7 commits