From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-12.8 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46520C433DB for ; Fri, 8 Jan 2021 19:39:42 +0000 (UTC) Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by mail.kernel.org (Postfix) with ESMTP id D3D7A23AA3 for ; Fri, 8 Jan 2021 19:39:41 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org D3D7A23AA3 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=gmail.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=owner-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix) id 2B75C8D01A4; Fri, 8 Jan 2021 14:39:41 -0500 (EST) Received: by kanga.kvack.org (Postfix, from userid 40) id 2655F8D0156; Fri, 8 Jan 2021 14:39:41 -0500 (EST) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id 17B618D01A4; Fri, 8 Jan 2021 14:39:41 -0500 (EST) X-Delivered-To: linux-mm@kvack.org Received: from forelay.hostedemail.com (smtprelay0077.hostedemail.com [216.40.44.77]) by kanga.kvack.org (Postfix) with ESMTP id 014A28D0156 for ; Fri, 8 Jan 2021 14:39:40 -0500 (EST) Received: from smtpin15.hostedemail.com (10.5.19.251.rfc1918.com [10.5.19.251]) by forelay05.hostedemail.com (Postfix) with ESMTP id A9A6F181AEF32 for ; Fri, 8 Jan 2021 19:39:40 +0000 (UTC) X-FDA: 77683622520.15.drug45_3d06183274f5 Received: from filter.hostedemail.com (10.5.16.251.rfc1918.com [10.5.16.251]) by smtpin15.hostedemail.com (Postfix) with ESMTP id 7FAAE1814B0C1 for ; Fri, 8 Jan 2021 19:39:40 +0000 (UTC) X-HE-Tag: drug45_3d06183274f5 X-Filterd-Recvd-Size: 7979 Received: from mail-lf1-f41.google.com (mail-lf1-f41.google.com [209.85.167.41]) by imf01.hostedemail.com (Postfix) with ESMTP for ; Fri, 8 Jan 2021 19:39:39 +0000 (UTC) Received: by mail-lf1-f41.google.com with SMTP id b26so25612072lff.9 for ; Fri, 08 Jan 2021 11:39:39 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=mime-version:references:in-reply-to:from:date:message-id:subject:to :cc; bh=lRRuQiPCIIeRicvu+E7yQv5jDQB4era/dfVIHrx38PY=; b=DDK07p/ZKmZovcAoUiUjhPZ9+WCGC807tO2pvPWlhUi9UtECGHDga2OUiQLvFRW6m1 CL7YpLNNsh3TSClAeQ/dcSMdqb7lPU03rY1tDf2yHm+w0ax3yV318Yy5oPz3DyHPicTI vmAGuZP3ws04WKr1+0mzPdwnygTMRJx0+iB6AAiBfXZc15OrNwotlxr94ltS3El5Ph1R 5WYgAdo103laqbvVr/QRVJacC46ys3XZ59rB6XDiSWFlvy8CFIN7IpE4eHnbipMfAj4j 9YLrGXSg4oVXIGeWUrPWGEnZJXsHYmpMQZxKHYjAY2W5nH/ttP52YDraR9DHsNuOMRyg ykbQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:mime-version:references:in-reply-to:from:date :message-id:subject:to:cc; bh=lRRuQiPCIIeRicvu+E7yQv5jDQB4era/dfVIHrx38PY=; b=feifVqbJ+q2Xyx8f3I+DEp/d/xEnZZap3iy2fMNMZS/13F1bGIPjbhITN5zXFPWo7v 0Q3coNc7D5sQRYClw/s783+OO1NJh4zE2bO/zPmYnH0ul5+iGr1fNRjp59w6rV0PvfrE SQr3+FMZtMLl5FqInGKg5Pcl/Riyw96e3rfCupRW9Pf4XS8TJ/8kE9WKJI6ct2xN6M5w jRbF75DXFpPYS0ZTRweCdKCFjjTL0pAf4mtUG9pY+dC7DIeReg/IMbnoEe2i/0SIdCm9 zQwIAMrwDJev5OEvCJOBN4TYG4/BiObgFBx1AClAJetmg6X4brpDnkHwbWBm97NORrRI tARg== X-Gm-Message-State: AOAM533Ixx4NnsU/yV6UZxnwnJjGM5GMQ97vFwmkqcCrDlEkj39XOi1T X0naejaY8bkwNwj2esJB4pMdbGKDjXzoWXBDQWc= X-Google-Smtp-Source: ABdhPJzp+tchs1WxNnpCyQKdVwlmdW4339VLO6VpJKuxPGqACDJSvoyrCRLpOfnZNEuPynu3i6RydgSvS62GOLzl5A8= X-Received: by 2002:a2e:b949:: with SMTP id 9mr2033333ljs.376.1610134778285; Fri, 08 Jan 2021 11:39:38 -0800 (PST) MIME-Version: 1.0 References: <20210108053259.726613-1-lokeshgidra@google.com> <20210108053259.726613-4-lokeshgidra@google.com> In-Reply-To: <20210108053259.726613-4-lokeshgidra@google.com> From: Stephen Smalley Date: Fri, 8 Jan 2021 14:39:26 -0500 Message-ID: Subject: Re: [PATCH v14 3/4] selinux: teach SELinux about anonymous inodes To: Lokesh Gidra Cc: Andrea Arcangeli , Alexander Viro , James Morris , Casey Schaufler , Eric Biggers , Paul Moore , "Serge E. Hallyn" , Eric Paris , Daniel Colascione , Kees Cook , "Eric W. Biederman" , KP Singh , David Howells , Anders Roxell , Sami Tolvanen , Matthew Garrett , Randy Dunlap , "Joel Fernandes (Google)" , YueHaibing , Christian Brauner , Alexei Starovoitov , Adrian Reber , Aleksa Sarai , Linux FS Devel , linux-kernel , LSM List , SElinux list , kaleshsingh@google.com, Calin Juravle , Suren Baghdasaryan , Jeffrey Vander Stoep , kernel-team@android.com, linux-mm@kvack.org, Andrew Morton , Christoph Hellwig Content-Type: text/plain; charset="UTF-8" X-Bogosity: Ham, tests=bogofilter, spamicity=0.000000, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: On Fri, Jan 8, 2021 at 12:33 AM Lokesh Gidra wrote: > > From: Daniel Colascione > > This change uses the anon_inodes and LSM infrastructure introduced in > the previous patches to give SELinux the ability to control > anonymous-inode files that are created using the new > anon_inode_getfd_secure() function. > > A SELinux policy author detects and controls these anonymous inodes by > adding a name-based type_transition rule that assigns a new security > type to anonymous-inode files created in some domain. The name used > for the name-based transition is the name associated with the > anonymous inode for file listings --- e.g., "[userfaultfd]" or > "[perf_event]". > > Example: > > type uffd_t; > type_transition sysadm_t sysadm_t : anon_inode uffd_t "[userfaultfd]"; > allow sysadm_t uffd_t:anon_inode { create }; > > (The next patch in this series is necessary for making userfaultfd > support this new interface. The example above is just > for exposition.) > > Signed-off-by: Daniel Colascione > Signed-off-by: Lokesh Gidra > --- > security/selinux/hooks.c | 59 +++++++++++++++++++++++++++++ > security/selinux/include/classmap.h | 2 + > 2 files changed, 61 insertions(+) > > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index 644b17ec9e63..8b4e155b2930 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -2934,6 +2933,63 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, > return 0; > } > > +static int selinux_inode_init_security_anon(struct inode *inode, > + const struct qstr *name, > + const struct inode *context_inode) > +{ > + const struct task_security_struct *tsec = selinux_cred(current_cred()); > + struct common_audit_data ad; > + struct inode_security_struct *isec; > + int rc; > + > + if (unlikely(!selinux_initialized(&selinux_state))) > + return 0; > + > + isec = selinux_inode(inode); > + > + /* > + * We only get here once per ephemeral inode. The inode has > + * been initialized via inode_alloc_security but is otherwise > + * untouched. > + */ > + isec->initialized = LABEL_INITIALIZED; > + isec->sclass = SECCLASS_ANON_INODE; > + > + if (context_inode) { > + struct inode_security_struct *context_isec = > + selinux_inode(context_inode); > + if (context_isec->initialized != LABEL_INITIALIZED) > + return -EACCES; > + if (context_isec->sclass != SECCLASS_ANON_INODE) { > + pr_err("SELinux: initializing anonymous inode with non-anonymous inode"); > + return -EACCES; > + } This would preclude using this facility for anonymous inodes created by kvm and other use cases. Don't do this. > + > + isec->sid = context_isec->sid; > + } else { > + rc = security_transition_sid( > + &selinux_state, tsec->sid, tsec->sid, > + isec->sclass, name, &isec->sid); > + if (rc) > + return rc; > + } > + > + /* > + * Now that we've initialized security, check whether we're > + * allowed to actually create this type of anonymous inode. > + */ > + > + ad.type = LSM_AUDIT_DATA_INODE; > + ad.u.inode = inode; > + > + return avc_has_perm(&selinux_state, > + tsec->sid, > + isec->sid, > + isec->sclass, > + ANON_INODE__CREATE, FILE__CREATE is perfectly appropriate here, not that it makes any difference.