[GIT] SELinux fixes

[GIT] SELinux fixes

[James Morris]

Please pull.


The following changes since commit 54fb723cc48db2fde964fb9bb0eaaccf2cf31a9f:

  Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm (2013-12-12 15:46:06 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git for-linus

Geyslan G. Bem (1):
      selinux: fix possible memory leak

James Morris (1):
      Merge branch 'master' of git://git.infradead.org/users/pcmoore/selinux_fixes into for-linus

Paul Moore (5):
      Merge tag 'v3.12'
      selinux: handle TCP SYN-ACK packets correctly in selinux_ip_output()
      selinux: handle TCP SYN-ACK packets correctly in selinux_ip_postroute()
      selinux: look for IPsec labels on both inbound and outbound packets
      selinux: process labeled IPsec TCP SYN-ACK packets properly in selinux_ip_postroute()

 security/selinux/hooks.c        |  137 ++++++++++++++++++++++++++++++++-------
 security/selinux/include/xfrm.h |    8 ++-
 security/selinux/xfrm.c         |   62 ++++++++++++++----
 3 files changed, 165 insertions(+), 42 deletions(-)

Re: [GIT] SELinux fixes

[Josh Boyer]

On Thu, Dec 12, 2013 at 9:52 PM, James Morris <jmorris@namei.org> wrote:
> Please pull.
>
>
> The following changes since commit 54fb723cc48db2fde964fb9bb0eaaccf2cf31a9f:
>
>   Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm (2013-12-12 15:46:06 -0800)
>
> are available in the git repository at:
>
>   git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git for-linus
>
> Geyslan G. Bem (1):
>       selinux: fix possible memory leak
>
> James Morris (1):
>       Merge branch 'master' of git://git.infradead.org/users/pcmoore/selinux_fixes into for-linus
>
> Paul Moore (5):
>       Merge tag 'v3.12'
>       selinux: handle TCP SYN-ACK packets correctly in selinux_ip_output()
>       selinux: handle TCP SYN-ACK packets correctly in selinux_ip_postroute()
>       selinux: look for IPsec labels on both inbound and outbound packets
>       selinux: process labeled IPsec TCP SYN-ACK packets properly in selinux_ip_postroute()

Should probably figure out which path to take on this one soon:

http://thread.gmane.org/gmane.linux.kernel/1611662

A revert might be the easiest for now.

josh

Re: [GIT] SELinux fixes

[Paul Moore]

On Fri, Dec 13, 2013 at 9:02 AM, Josh Boyer <jwboyer@fedoraproject.org> wrote:
> Should probably figure out which path to take on this one soon:
>
> http://thread.gmane.org/gmane.linux.kernel/1611662
>
> A revert might be the easiest for now.

Yeah, I followed the discussion you and Eric were having earlier this
week; I was hoping that you guys would be able to arrive at a fix as I
would much prefer to fix the issue and not have to revert.

If I don't see something from Eric within the next couple of hours
I'll go ahead and do the revert.

-Paul

-- 
paul moore
www.paul-moore.com

Re: [GIT] SELinux fixes

[Eric Paris]

On Fri, 2013-12-13 at 09:36 -0500, Paul Moore wrote:
> On Fri, Dec 13, 2013 at 9:02 AM, Josh Boyer <jwboyer@fedoraproject.org> wrote:
> > Should probably figure out which path to take on this one soon:
> >
> > http://thread.gmane.org/gmane.linux.kernel/1611662
> >
> > A revert might be the easiest for now.
> 
> Yeah, I followed the discussion you and Eric were having earlier this
> week; I was hoping that you guys would be able to arrive at a fix as I
> would much prefer to fix the issue and not have to revert.
> 
> If I don't see something from Eric within the next couple of hours
> I'll go ahead and do the revert.

Paul, please revert 102aefdda4d8275ce7d7100bc16c88c74272b260

SELinux policy can specify if it should use a filesystem's xattrs or
not.  In current policy we have a specification that fuse should not use
xattrs but fuse.glusterfs should use xattrs.  This patch has a bug in
which non-glusterfs filesystems would match the rule saying
fuse.glusterfs should use xattrs.  If both fuse and the particular
filesystem in question are not written to handle xattr calls during the
mount command, they will deadlock.

I have fixed the bug to do proper matching, however I believe a revert
is still the correct solution.  The reason I believe that is because the
code still does not work.  The s_subtype is not set until after the
SELinux hook which attempts to match on the ".gluster" portion of the
rule.  So we cannot match on the rule in question.  The code is useless.

In the next cycle the code should be re-re-verted and fixed, but we also
need to address the fact that it just plain doesn't work.

-Eric

Re: [GIT] SELinux fixes

[Paul Moore]

On Fri, Dec 13, 2013 at 9:52 AM, Eric Paris <eparis@redhat.com> wrote:
> On Fri, 2013-12-13 at 09:36 -0500, Paul Moore wrote:
>> On Fri, Dec 13, 2013 at 9:02 AM, Josh Boyer <jwboyer@fedoraproject.org> wrote:
>> > Should probably figure out which path to take on this one soon:
>> >
>> > http://thread.gmane.org/gmane.linux.kernel/1611662
>> >
>> > A revert might be the easiest for now.
>>
>> Yeah, I followed the discussion you and Eric were having earlier this
>> week; I was hoping that you guys would be able to arrive at a fix as I
>> would much prefer to fix the issue and not have to revert.
>>
>> If I don't see something from Eric within the next couple of hours
>> I'll go ahead and do the revert.
>
> Paul, please revert 102aefdda4d8275ce7d7100bc16c88c74272b260

Okay, expect another git pull request with the revert today.

-- 
paul moore
www.paul-moore.com

[GIT] SELinux fixes

[James Morris]

Please pull for 3.14

The following changes since commit 9c1db7798141e2658e4b5bb170128dfdc3270ff4:

  Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs (2014-02-09 11:12:26 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git for-linus

James Morris (1):
      Merge branch 'stable-3.14' of git://git.infradead.org/users/pcmoore/selinux into for-linus

Paul Moore (2):
      Merge tag 'v3.13' into stable-3.14
      selinux: add SOCK_DIAG_BY_FAMILY to the list of netlink message types

Stephen Smalley (1):
      SELinux:  Fix kernel BUG on empty security contexts.

 security/selinux/nlmsgtab.c    |    2 ++
 security/selinux/ss/services.c |    4 ++++
 2 files changed, 6 insertions(+), 0 deletions(-)

[GIT] SELinux fixes

[James Morris]

Hi Linus,

Please pull these SELinux fixes to your current tree.

The following changes since commit f5835372ebedf26847c2b9e193284075cc9c1f7f:

  Merge branch 'drm-fixes' of git://people.freedesktop.org/~airlied/linux (2013-12-23 11:49:16 -0800)

are available in the git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security.git for-linus

Chad Hanson (1):
      selinux: fix broken peer recv check

Oleg Nesterov (1):
      selinux: selinux_setprocattr()->ptrace_parent() needs rcu_read_lock()

 security/selinux/hooks.c |    8 +++++---
 1 files changed, 5 insertions(+), 3 deletions(-)

---

commit c0c1439541f5305b57a83d599af32b74182933fe
Author: Oleg Nesterov <oleg@redhat.com>
Date:   Mon Dec 23 17:45:01 2013 -0500

    selinux: selinux_setprocattr()->ptrace_parent() needs rcu_read_lock()
    
    selinux_setprocattr() does ptrace_parent(p) under task_lock(p),
    but task_struct->alloc_lock doesn't pin ->parent or ->ptrace,
    this looks confusing and triggers the "suspicious RCU usage"
    warning because ptrace_parent() does rcu_dereference_check().
    
    And in theory this is wrong, spin_lock()->preempt_disable()
    doesn't necessarily imply rcu_read_lock() we need to access
    the ->parent.
    
    Reported-by: Evan McNabb <emcnabb@redhat.com>
    Signed-off-by: Oleg Nesterov <oleg@redhat.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Paul Moore <pmoore@redhat.com>

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 5db2646..6625699 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -5588,11 +5588,11 @@ static int selinux_setprocattr(struct task_struct *p,
 		/* Check for ptracing, and update the task SID if ok.
 		   Otherwise, leave SID unchanged and fail. */
 		ptsid = 0;
-		task_lock(p);
+		rcu_read_lock();
 		tracer = ptrace_parent(p);
 		if (tracer)
 			ptsid = task_sid(tracer);
-		task_unlock(p);
+		rcu_read_unlock();
 
 		if (tracer) {
 			error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,

commit 46d01d63221c3508421dd72ff9c879f61053cffc
Author: Chad Hanson <chanson@trustedcs.com>
Date:   Mon Dec 23 17:45:01 2013 -0500

    selinux: fix broken peer recv check
    
    Fix a broken networking check. Return an error if peer recv fails.  If
    secmark is active and the packet recv succeeds the peer recv error is
    ignored.
    
    Signed-off-by: Chad Hanson <chanson@trustedcs.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Paul Moore <pmoore@redhat.com>

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 419491d..5db2646 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4334,8 +4334,10 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
 		}
 		err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
 				   PEER__RECV, &ad);
-		if (err)
+		if (err) {
 			selinux_netlbl_err(skb, err, 0);
+			return err;
+		}
 	}
 
 	if (secmark_active) {