From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755606AbbEUL4T (ORCPT ); Thu, 21 May 2015 07:56:19 -0400 Received: from mailout3.w1.samsung.com ([210.118.77.13]:16069 "EHLO mailout3.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753730AbbEULyA (ORCPT ); Thu, 21 May 2015 07:54:00 -0400 X-AuditID: cbfec7f4-f79c56d0000012ee-a1-555dc7563384 From: Lukasz Pawelczyk To: "David S. Miller" , "Eric W. Biederman" , "Kirill A. Shutemov" , "Serge E. Hallyn" , Al Viro , Alexey Dobriyan , Andrew Morton , Andy Lutomirski , Casey Schaufler , Christoph Hellwig , David Howells , Eric Dumazet , Fabian Frederick , Greg KH , Ingo Molnar , Ionut Alexa , James Morris , Jeff Layton , Joe Perches , Jonathan Corbet , Kees Cook , Lukasz Pawelczyk , Mauro Carvalho Chehab , Michal Hocko , Miklos Szeredi , Nick Kralevich , Oleg Nesterov , Paul Moore , Peter Hurley , Peter Zijlstra , Rik van Riel , Serge Hallyn , Stephen Smalley , Tejun Heo , Zefan Li , Rafal Krypa , linux-doc@vger.kernel.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, containers@lists.linux-foundation.org Cc: Lukasz Pawelczyk Subject: [PATCH 3/8] smack: extend capability functions and fix 2 checks Date: Thu, 21 May 2015 13:53:37 +0200 Message-id: <1432209222-8479-4-git-send-email-l.pawelczyk@samsung.com> X-Mailer: git-send-email 2.1.0 In-reply-to: <1432209222-8479-1-git-send-email-l.pawelczyk@samsung.com> References: <1432209222-8479-1-git-send-email-l.pawelczyk@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAAzWSa0hTYRjHe3fOeXccrQ7L8qDYZSiBlFkEPUSUEOpbH8pKAwWrVSeVnI4t K/sQW2rZSivtYt5t3p2sthRzmea1lnjJMiXMrisrUzIyXWpe6Nvvef6/h+fLn6Vko7QrGxl9 QlBHK6LkWEI/m2p9sXZ/a1iwz3SGO9zS7YQskxHDm6oJDMaiQQwf6y8gyOpIoOHHOQcN01UJ YvjU8l4Mesc4hniDCcP0tzVQWt4sAtvtewykfNgLxj8DCDIHPtDQdkkJxmv5FLSl5ovAMpaE If98AQ3dNVkYRi6/x5CalCyG8gotA+X20/A1fowBu/UeBeVTNgT913MpqKxLRNDyfApBa3K9 CEZ7JsQwlFpCweQLEw2NVgMF7brPNHR0tothorgZQcdkK+PrRQa+T9IkQ5uMSaa2iyb3S/tE 5EFGv5jkmWNJjzWEJDQNMaTkrwkTS4kXMZddxORJuoMmddlGMUnrLUbE2qfFxJCSxgSuCJVs OSpERZ4U1Ou2HpJEVDzMY1Q18tM3uvRIi4bc9IhleW4j/7TaWY+cZnAZ3/nGhPVIwsq4QsTn pFyj5gediC/qf0vPWpjz4cc6a+cCZy51IX/lYyWaDShuNV+YGT8nLeEI/9imw7NMc558W+Pv OZZy/ry+rwDPv1vO37VOz906cQF8Tu9T8SzLZpxxu4G5iqR5aEEZWirEHlFpDocr13trFEpN bHS495EYpRnNV+FXNTK0bG5AHIvkC6Xs6rBgGaM4qYlTNiCepeTO0l2PZlbSo4q4M4I65qA6 NkrQNCA3lpa7SLNrhoNkXLjihHBcEFSC+n8qYp1cteiYaOOpDMsi30gdkS4JqxssCxj232FP 3Bf8411u0p/qdD/P7rgs5aLskNfmqd3u1kO2494BZ5tKKnruf7UcGIlz8ZBssL+tyVn8qi4z cNUmR3uoativ987K7R6+6Xy4r5D2M+ilW29Eot2lIUbl/SVw50t0AG44tu25evOSV23ybZuc 1kQo1ntRao3iH77doSkGAwAA Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch extends smack capability functions to a full list to those equivalent in the kernel has_ns_capability -> smack_has_ns_privilege has_capability -> smack_has_privilege ns_capable -> smack_ns_privileged capable -> smack_privileged It also puts the smack related part to a common function: smack_capability_allowed() Those functions will be needed for capability checks in the upcoming Smack namespace patches. Additionally there were 2 smack capability checks that used generic capability functions instead of specific Smack ones effectively ignoring the onlycap rule. This has been fixed now with the introduction of those new functions. This has implications on the Smack namespace as well as the additional Smack checks in smack_capability_allowed() will be extended beyond the onlycap rule. Not using Smack specific checks in those 2 places could mean breaking the Smack label namespace separation. Signed-off-by: Lukasz Pawelczyk --- security/smack/smack.h | 63 +++++++++++++++++++++++++++++++++++++++++++--- security/smack/smack_lsm.c | 4 +-- 2 files changed, 61 insertions(+), 6 deletions(-) diff --git a/security/smack/smack.h b/security/smack/smack.h index b8c1a86..fa8fa87 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -332,21 +332,76 @@ static inline struct smack_known *smk_of_current(void) } /* + * Internal smack capability check complimentary to the + * set of kernel capable() and has_capability() functions + * + * For a capability in smack related checks to be effective it needs to: + * - have empty onlycap or the current label be the same as onlycap + * - be in the initial user ns + */ +static inline int smack_capability_allowed(struct smack_known *skp, + struct user_namespace *user_ns) +{ + if (user_ns != &init_user_ns) + return 0; + + if (smack_onlycap != NULL && smack_onlycap != skp) + return 0; + + return 1; +} + +/* + * Is the task privileged in a namespace and allowed to be privileged + * by additional smack rules. + */ +static inline int smack_has_ns_privilege(struct task_struct *task, + struct user_namespace *user_ns, + int cap) +{ + struct smack_known *skp = smk_of_task_struct(task); + + if (!has_ns_capability(task, user_ns, cap)) + return 0; + if (smack_capability_allowed(skp, user_ns)) + return 1; + return 0; +} + +/* * Is the task privileged and allowed to be privileged - * by the onlycap rule. + * by additional smack rules. */ -static inline int smack_privileged(int cap) +static inline int smack_has_privilege(struct task_struct *task, int cap) +{ + return smack_has_ns_privilege(task, &init_user_ns, cap); +} + +/* + * Is the current task privileged in a namespace and allowed to be privileged + * by additional smack rules. + */ +static inline int smack_ns_privileged(struct user_namespace *user_ns, int cap) { struct smack_known *skp = smk_of_current(); - if (!capable(cap)) + if (!ns_capable(user_ns, cap)) return 0; - if (smack_onlycap == NULL || smack_onlycap == skp) + if (smack_capability_allowed(skp, user_ns)) return 1; return 0; } /* + * Is the current task privileged and allowed to be privileged + * by additional smack rules. + */ +static inline int smack_privileged(int cap) +{ + return smack_ns_privileged(&init_user_ns, cap); +} + +/* * logging functions */ #define SMACK_AUDIT_DENIED 0x1 diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index a143328..ee7bb63 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -403,7 +403,7 @@ static int smk_ptrace_rule_check(struct task_struct *tracer, rc = 0; else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN) rc = -EACCES; - else if (capable(CAP_SYS_PTRACE)) + else if (smack_has_privilege(tracer, CAP_SYS_PTRACE)) rc = 0; else rc = -EACCES; @@ -1646,7 +1646,7 @@ static int smack_file_send_sigiotask(struct task_struct *tsk, skp = file->f_security; rc = smk_access(skp, tkp, MAY_WRITE, NULL); rc = smk_bu_note("sigiotask", skp, tkp, MAY_WRITE, rc); - if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE)) + if (rc != 0 && smack_has_privilege(tsk, CAP_MAC_OVERRIDE)) rc = 0; smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); -- 2.1.0