From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752686AbbEYMde (ORCPT ); Mon, 25 May 2015 08:33:34 -0400 Received: from mailout1.w1.samsung.com ([210.118.77.11]:36927 "EHLO mailout1.w1.samsung.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752404AbbEYMdP (ORCPT ); Mon, 25 May 2015 08:33:15 -0400 X-AuditID: cbfec7f5-f794b6d000001495-fd-556316866c91 From: Lukasz Pawelczyk To: "David S. Miller" , "Eric W. Biederman" , "Kirill A. Shutemov" , "Serge E. Hallyn" , Al Viro , Alexey Dobriyan , Andrew Morton , Andy Lutomirski , Casey Schaufler , David Howells , Fabian Frederick , Greg KH , James Morris , Jeff Layton , Jingoo Han , Joe Perches , John Johansen , Jonathan Corbet , Kees Cook , Lukasz Pawelczyk , Mauro Carvalho Chehab , Miklos Szeredi , Oleg Nesterov , Paul Moore , Stephen Smalley , Tetsuo Handa , Zefan Li , Rafal Krypa , linux-doc@vger.kernel.org, linux-api@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, containers@lists.linux-foundation.org Cc: Lukasz Pawelczyk Subject: [PATCH v2 2/7] smack: extend capability functions and fix 2 checks Date: Mon, 25 May 2015 14:32:37 +0200 Message-id: <1432557162-19123-3-git-send-email-l.pawelczyk@samsung.com> X-Mailer: git-send-email 2.1.0 In-reply-to: <1432557162-19123-1-git-send-email-l.pawelczyk@samsung.com> References: <1432209222-8479-1-git-send-email-l.pawelczyk@samsung.com> <1432557162-19123-1-git-send-email-l.pawelczyk@samsung.com> X-Brightmail-Tracker: H4sIAAAAAAAAAzWRfSzUcRzH+97v4c7Nbb8d8cPW6rZmNUSr9hlFbVq/lfVg2ag/dPjtyB26 w7C1nZwLdaqz8nBXI0k4TiXLHZEMxTxGqXk6MZWHMg0Jeaj/Xp/P+/XZ5483DxN24I68iKhY Vh4llopIPt622tLnqrYLDXCfercHspNPgt5oIGGo+jcJhsdfSfjScB2BvlOFw8y1ZRzWqlVc yFheIiGl0EjC2ncXyBzzh96CHgIMi8MIdMNjOLTOp5LQfkMGhjsFGLRrCzjwfCGNhAL1Ixx6 TXoSfty0kKBN03ChrFxJQNlEAkyYn2Lwoj4VwWdtNg461QwB09onGLwxF2LQ2dXBhc6VFuKo iBmeWsGZPKWGZHTKbpypKhngMDV5g1ym3xzEqJqmCaamvJTDtOYs40z9fQOXyfpYjJjCzCyC +Tn+af3g1rpbXjeJmPnSfuys0wX+4TBWGhHPyvd5X+KHl9fmEzEmUcLd7gykRNNOGciKR1MH 6NHXhdwttqO7hoxkBuLzhFQRolPa0v8NyRw6eU6Jb1gk5U4vdNVhG4EtpeHTZo2F3Agwypku 0qVsSjbUKdoy0YRtME7tprU9zZuOgDpBr6nfo613O+hK89omW1EMXZn7YZOFlArRtYPUbSTI R9tK0XY2LjRGESKR7XdTiGWKuCiJW2i07BnaavnXS1TU7NmIKB4SWQsCw0MChIQ4XpEoa0Q0 DxPZCjz+rK8EYeLEJFYeHSyPk7KKRuTEw0X2glzT7HkhJRHHspEsG8PK/6ccnpWjEgXNEvMz Glj0SvMtWarSYNYj49hIQyBn58HGy9WeModdDyuSda6TFm/7cGfiW0Nkn1OFoPWMpJi18gn0 Ej/w07ceGvBZdbiaNCjSK5ylvjl+o7PVzbH3OP5znqePNeXRQ1cumvQuNsax42/VqwOmqSPB 6ZFhEXmvzqVLJel+fSJcES722IvJFeK/ErTcteECAAA= Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org This patch extends smack capability functions to a full list to those equivalent in the kernel has_ns_capability -> smack_has_ns_privilege has_capability -> smack_has_privilege ns_capable -> smack_ns_privileged capable -> smack_privileged It also puts the smack related part to a common function: smack_capability_allowed() Those functions will be needed for capability checks in the upcoming Smack namespace patches. Additionally there were 2 smack capability checks that used generic capability functions instead of specific Smack ones effectively ignoring the onlycap rule. This has been fixed now with the introduction of those new functions. This has implications on the Smack namespace as well as the additional Smack checks in smack_capability_allowed() will be extended beyond the onlycap rule. Not using Smack specific checks in those 2 places could mean breaking the Smack label namespace separation. Signed-off-by: Lukasz Pawelczyk --- security/smack/smack.h | 63 +++++++++++++++++++++++++++++++++++++++++++--- security/smack/smack_lsm.c | 4 +-- 2 files changed, 61 insertions(+), 6 deletions(-) diff --git a/security/smack/smack.h b/security/smack/smack.h index b8c1a86..fa8fa87 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -332,21 +332,76 @@ static inline struct smack_known *smk_of_current(void) } /* + * Internal smack capability check complimentary to the + * set of kernel capable() and has_capability() functions + * + * For a capability in smack related checks to be effective it needs to: + * - have empty onlycap or the current label be the same as onlycap + * - be in the initial user ns + */ +static inline int smack_capability_allowed(struct smack_known *skp, + struct user_namespace *user_ns) +{ + if (user_ns != &init_user_ns) + return 0; + + if (smack_onlycap != NULL && smack_onlycap != skp) + return 0; + + return 1; +} + +/* + * Is the task privileged in a namespace and allowed to be privileged + * by additional smack rules. + */ +static inline int smack_has_ns_privilege(struct task_struct *task, + struct user_namespace *user_ns, + int cap) +{ + struct smack_known *skp = smk_of_task_struct(task); + + if (!has_ns_capability(task, user_ns, cap)) + return 0; + if (smack_capability_allowed(skp, user_ns)) + return 1; + return 0; +} + +/* * Is the task privileged and allowed to be privileged - * by the onlycap rule. + * by additional smack rules. */ -static inline int smack_privileged(int cap) +static inline int smack_has_privilege(struct task_struct *task, int cap) +{ + return smack_has_ns_privilege(task, &init_user_ns, cap); +} + +/* + * Is the current task privileged in a namespace and allowed to be privileged + * by additional smack rules. + */ +static inline int smack_ns_privileged(struct user_namespace *user_ns, int cap) { struct smack_known *skp = smk_of_current(); - if (!capable(cap)) + if (!ns_capable(user_ns, cap)) return 0; - if (smack_onlycap == NULL || smack_onlycap == skp) + if (smack_capability_allowed(skp, user_ns)) return 1; return 0; } /* + * Is the current task privileged and allowed to be privileged + * by additional smack rules. + */ +static inline int smack_privileged(int cap) +{ + return smack_ns_privileged(&init_user_ns, cap); +} + +/* * logging functions */ #define SMACK_AUDIT_DENIED 0x1 diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index a143328..ee7bb63 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -403,7 +403,7 @@ static int smk_ptrace_rule_check(struct task_struct *tracer, rc = 0; else if (smack_ptrace_rule == SMACK_PTRACE_DRACONIAN) rc = -EACCES; - else if (capable(CAP_SYS_PTRACE)) + else if (smack_has_privilege(tracer, CAP_SYS_PTRACE)) rc = 0; else rc = -EACCES; @@ -1646,7 +1646,7 @@ static int smack_file_send_sigiotask(struct task_struct *tsk, skp = file->f_security; rc = smk_access(skp, tkp, MAY_WRITE, NULL); rc = smk_bu_note("sigiotask", skp, tkp, MAY_WRITE, rc); - if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE)) + if (rc != 0 && smack_has_privilege(tsk, CAP_MAC_OVERRIDE)) rc = 0; smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_TASK); -- 2.1.0