From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp-relay-internal-0.canonical.com (smtp-relay-internal-0.canonical.com [185.125.188.122]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 057DE21D5A7 for ; Wed, 7 May 2025 15:38:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=185.125.188.122 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746632282; cv=none; b=Q+vzfEK0bDdydYPFHIFIQIGjKX8TFVf8zKlGlXoVM9reGFM9THjMDzKMkovXJqRO9HRgK+mNaRgSuzHbX9AHGhnueTTpwaFPcJvrloB5ZXF7iLRKJLCwgjDudb2bnay9p+YeAky0z87FtkfMvjVJhwcNUq0EZjofmjy8dd+6caM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1746632282; c=relaxed/simple; bh=0bhqYQP3PQ1v+FgerLpzRYXmaHS7tm0meVxdVOpXWiA=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=k9NRUSNJcETfYLdn2hRVFCIgQ3Z2szGhJpDaAbFf2wamWCUVyNzTcM1DDP/JaAoMJnq293F0q4OkYyShTpUPjDwEsCytEca1TmYLBxdS6Uz0JPb+mviMV589iyK8ZiCObvU3CKyafwrVMx1npCHBJtNYM5ZNDR8OClprVOR7RLM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com; spf=pass smtp.mailfrom=canonical.com; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b=j51iPClm; arc=none smtp.client-ip=185.125.188.122 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=canonical.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=canonical.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=canonical.com header.i=@canonical.com header.b="j51iPClm" Received: from mail-ej1-f71.google.com (mail-ej1-f71.google.com [209.85.218.71]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-0.canonical.com (Postfix) with ESMTPS id EB9953F342 for ; Wed, 7 May 2025 15:37:58 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1746632278; bh=Rw+ajBmKH1oYIOuaY57PRGZktJSoo5Qqq7a4MCBkd4k=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=j51iPClmCN2QrGVV8RU24BRQbnTYxWP2UKCfhTlCa444BKctDcu/u1Z4gQ00FZKwn A7En20mr9obaRxIXmZeb2y0sDpW+jl5JmSxHLPF9qAg+j6zzpY2lmVRtbz7eZz9bn4 f1FZaKwBeCKieAIZhpJqrskoDlHLxSx4CpdtIXzeerNp72OvPukWBmrwDKHqi9vR3r tRBuq224yoih1WMzZIjSs8KZEt9tGKGnjXWag+wMQidDwGWxwh8U/pHXncfz4cht/x DqvwJp1UQ+P66g5gNqt4ZJPfXNz9pF8PGIrSLjWw+q5+jD1IusF9/paj8Koz/eZYN+ OGp2qgJ2VoAhw== Received: by mail-ej1-f71.google.com with SMTP id a640c23a62f3a-acb8f9f58ebso531978466b.2 for ; Wed, 07 May 2025 08:37:58 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1746632274; x=1747237074; h=content-transfer-encoding:in-reply-to:autocrypt:from :content-language:references:cc:to:subject:user-agent:mime-version :date:message-id:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Rw+ajBmKH1oYIOuaY57PRGZktJSoo5Qqq7a4MCBkd4k=; b=hSEuWSRoZ77ACWu96A2DKHU4MWMfcvwkntMDwxxm2wLqBGMsj/a/I608hg5bzwJvIj y2VYSJqqA+B4DhFrdO7zD0Yc0rGHEEawfMfoefp788BSWK/xG3M2McPnhmTDcWWP4Qjk 9OxkJGeNN1Wo9J4WFnzgAuWBcCAfP0iFrx/1YVd2cNcjGt+ziQ4ioFKWZWGO4y180e1i muiXSZ6eoy0nsa47DSsVX7ze8mUrRIeF0sKmwq5ZYGFkNn9Tap6pEqWGrzBU2DAE6vBV rqGMZlQ0i+nIlEzSGiv6bG8OVQGYGTc92YOryHvCLO4ev5pcUMeBbLDmSTsIQ1Ydi0fq phvw== X-Forwarded-Encrypted: i=1; AJvYcCVuO2bo+RuQBiGfclrSNnVYVr3dhg5Io2eYS9kaWquCOOTD49eh1l48+H5eW+wez3Mr5VOQVltPoZEhuQ4=@vger.kernel.org X-Gm-Message-State: AOJu0YyzyZoXIKijQOIL8Wgu1NeBnl0xx9eIVKLDGSp22jMHthHlLoUH NC3o3bNYDFYNIE2cn8XfW2a+buW4Z5MOZHCVGaeICzGOEWG2SYwfTaJm3qtCUAVJAE27mKgTpxv i/no/i9M/dloXNJ92PxzrnTCgtU3+/rHeVhYkRvWf/suJTca9DpBEM/SHAOHGUmxBi500b6+dMR E+vw== X-Gm-Gg: ASbGncsR67510LAoQFJKYRAMb5Lxa5N6hhgCohAHH5QxxPlhO1NPTnC2/VGWg6TWOCY AcYox4UuQe5HwCLp9uqwvG/RepTddO5ms9dPcF4o2XISOhg/qibRh+Nq4xr/LyXtJka/0d2nXeQ 3tRfuI+UVdNrVSDYMkcc029H2MPGHcPk3daaVWIHkU4BxadCU82zddhQBwgt4ZKBa+7+ijTYeQx tMtoi6lTLMtH5iQD51dLd9qZrpChnfmnsSw9e4m8wYN/aEESjjc7/8yoZiTdVz2JvfuiJTDLaHK pc4diwG9Of3tRlcanHZvTsHXTYGLcqLbde5XxLV6piujQJYc20ZABiJ19zf59D6NBW0= X-Received: by 2002:a17:907:8a8d:b0:ace:ed3b:285e with SMTP id a640c23a62f3a-ad1e8d8971amr360967766b.56.1746632274314; Wed, 07 May 2025 08:37:54 -0700 (PDT) X-Google-Smtp-Source: AGHT+IHIiet74C8oMIdKA/PaSf8H9s5ZGkI/NebFPYSp7/1cEBiQAWfXF+ATv0VmOBrz140lQ6CMAg== X-Received: by 2002:a17:907:8a8d:b0:ace:ed3b:285e with SMTP id a640c23a62f3a-ad1e8d8971amr360964566b.56.1746632273838; Wed, 07 May 2025 08:37:53 -0700 (PDT) Received: from ?IPV6:2001:861:3280:410:2ef0:5dff:fe60:6274? ([2001:861:3280:410:2ef0:5dff:fe60:6274]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-ad1ee0b7e4csm159333766b.52.2025.05.07.08.37.53 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Wed, 07 May 2025 08:37:53 -0700 (PDT) Message-ID: <705fa834-b680-4a0e-9996-cca0565b0987@canonical.com> Date: Wed, 7 May 2025 17:37:52 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH 2/3] lsm: introduce security_lsm_manage_policy hook To: Tetsuo Handa , linux-security-module@vger.kernel.org Cc: john.johansen@canonical.com, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, mic@digikod.net, kees@kernel.org, stephen.smalley.work@gmail.com, casey@schaufler-ca.com, takedakn@nttdata.co.jp, linux-api@vger.kernel.org, apparmor@lists.ubuntu.com, linux-kernel@vger.kernel.org References: <20250506143254.718647-1-maxime.belair@canonical.com> <20250506143254.718647-3-maxime.belair@canonical.com> <9c68743f-5efa-4a77-a29b-d3e8f2b2a462@I-love.SAKURA.ne.jp> Content-Language: en-US From: =?UTF-8?Q?Maxime_B=C3=A9lair?= Autocrypt: addr=maxime.belair@canonical.com; keydata= xsDNBGWdWVYBDADTTxrLrewr4UPUa9CvBTsQFOLNM1D8rvhDyf0UWHD0Z3EuqePliDUpQ1FQ EaDAd1qEmsf4ybF8dWN37OC25iBmolZv+tzpRmlhTQtyBu/xWu5LwWIpLFhQq+9AkcHa4Za8 2/ovK84K9u8RPN6Y9h/UOzAS23UI86T58KxzDHEHbRC5XA5VmOgcX71FQDalvMUaAHJV/WRe OifBAwPbapTmTuKEmuLXvDczKqAADKWHXi7JECpY+1Mpd9xRd9dWu7ooKQ+KmOFOZcOxKagY 9+qK77wUzgDleDU8ihuzOWol+K5vZg0saiRJQm8l9mhIXrREloiUntScBraHBSqSy0kMuIK7 bmIflfgDarYVXV5rxotIWu0guyn8kT/N+DKghi52/VbDdOBngwYLTBO3sZtIdw0pkhkwHDcl se+BThNz6xC0UXlSZrUBQ5RBruBSTXZHwZM9Oyhlf+S1EtZe2jO1R2hSZ0rrHJ/93LT5ARFd jGInAz6ocW0He8FB5nGjfQcAEQEAAc0sTWF4aW1lIELDqWxhaXIgPG1heGltZS5iZWxhaXJA Y2Fub25pY2FsLmNvbT7CwQ4EEwEKADgWIQTKdrj/a+71WSW+OmUnvE/6RFk5uAUCZZ1ZVgIb AwULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRAnvE/6RFk5uL/BC/98c45dc+GgTCgYO8YY lXJ/N9+QZyw5n4CBcXphBkd/xZkwlOgJ4bY5zHH3ukKBfuNB77RLRT+mzHwnCELXRqQOebtN ZhI2JDvdAwemyxsstj1lSadYhlRDjxLmphARRbiJ9q8g3MMhv/zLcM5ObFfSP4lQaxaiSEjw pAJNLR7d9rsMUYi/lWxQKDcjGaKnQkq5qDtLzoWw6pIf2VKGQDbibPdVTiedByIbF6x21LEQ rVNHTOnqoqC2X6JiSWz4pCuYRQM7bY1BW0ZUOWnshJNQqi8+4/A/h+Yss3vXp82+oKRw7Dls /B5MjR4yHdCBb8RWM0y0kghpvjMmp5Nbsh5XaDu2yv5qkxs4NHoklalUvBy34O2lx0ITVSGN pbzw93cUZtomDRtXder0cY6FPVNrN8aP6PljoYrobVDCb451nc1YrFEiMUG8jCfD85JpwK+S Ql9RccaMFTcPXe0rFWr7ecwjEtxDd6/Mu9tpW1mLMOKF5TJxrmVtbAIauPgKp0rOwM0EZZ1Z VgEMANEV0CsOdJHC9VROvdooRgl8Q7E19QdsCpDD1rziS1KeegSPo5n1uDsXoW88Rdpxqap0 fcgECJxZfH4bgHr0G/pWHbbltfM7jdvdW+cXD/8wVBgzZrbysPa9WpaM/S/DXj2qVIng3O43 izSedJ81iYyvi7i2e4YtZndGsz8DslaUDqBCHKvG5ydp/9W0Wj55SxYCmt1rdv5GUYULoVhI uevY8olct38tl7rSZxBpzez3rK3WCQkSN1uf8zzluDLWXEmJjafJfzO5YC6s+ScZ7kXEIcJC ttGXwVJWJF+Yq7EKaGoEMK+5e4SJgok6vrx3f+lKa3R70jqwAj1ulsvS3LRgrjtN8dhIuJdE aSNTkEO5TvrHzcDk/v5X7Tn7YOo4qheqC4k+PzNBI/Y4TGY6FJFskaii89wRVmSg3meRv9p4 kT2XXtNueH/CWtwvSK3f+2u21DbNnknjSXg0lNlO380NwN1Q0BnDTPcASENd5T4gwxBw5GED H6yK2jn5bFMUxwARAQABwsD2BBgBCgAgFiEEyna4/2vu9VklvjplJ7xP+kRZObgFAmWdWVYC GwwACgkQJ7xP+kRZObiqjQwAlD/IBOVIkpuGjO7LoxpA8qe63AO1HygvGVOlFHLrw4ap+edK bUpmEzht20VQNtzyosBbXYDDrcFiSiTNoBKFYx7ekfQ+OwxzU0wOkUJ2m56EKAlUHotwnHm+ s1FF7SFQO7oubKCZPSjPgex8XmY43uZXnKmsoFC0iJdB6a8wOPIk10VpaEfgrGdwUPeDchAX ZSAEPZRM0C2JDjghdIlVek0goTWh4RARJ/Mz73K0VZoqxecSArSglOqlpUO2YETJGB8kR6Ip uk605mf+aJoQq/8DtoYOTFFaTViKlKgVoNi0e1il6HkEhASyGQeQZkcq92O6ndDm//csiJT2 oRAG5XUu5Q1PWG0oY4cZ6XN1z8nkj5Mj23SRhBwVjh2PY2p4cyFRTBrBDaNV38LHw6tVjdhk 8YNqGOVqceueWdZmWbp8b88a0wzOcrPAvcxJ14FhMyMO9P7FblDYLNYr0oAYj+UyhxOPbRZz yriCIKEAbLqHTyj+RhbroZmv5q3X7iVq In-Reply-To: <9c68743f-5efa-4a77-a29b-d3e8f2b2a462@I-love.SAKURA.ne.jp> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit On 5/7/25 12:40, Tetsuo Handa wrote: > On 2025/05/06 23:32, Maxime Bélair wrote: >> diff --git a/security/lsm_syscalls.c b/security/lsm_syscalls.c >> index dcaad8818679..b39e6635a7d5 100644 >> --- a/security/lsm_syscalls.c >> +++ b/security/lsm_syscalls.c >> @@ -122,5 +122,10 @@ SYSCALL_DEFINE3(lsm_list_modules, u64 __user *, ids, u32 __user *, size, >> SYSCALL_DEFINE5(lsm_manage_policy, u32, lsm_id, u32, op, void __user *, buf, u32 >> __user *, size, u32, flags) >> { >> - return 0; >> + size_t usize; >> + >> + if (get_user(usize, size)) >> + return -EFAULT; >> + >> + return security_lsm_manage_policy(lsm_id, op, buf, usize, flags); >> } > > syzbot will report user-controlled unbounded huge size memory allocation attempt. ;-) > > This interface might be fine for AppArmor, but TOMOYO won't use this interface because > TOMOYO's policy is line-oriented ASCII text data where the destination is switched via > pseudo‑filesystem's filename; use of filename helps restricting which type of policy > can be manipulated by which process. First, like any LSM, TOMOYO is not obliged to implement every operation. It can simply expose the one that makes sense for its use case. For instance, I don't think it needs an equivalent of the manager interface. If TOMOYO wants to support several sub‑operations, it can distinguish them with the syscall’s flags parameter instead of filenames (as securityfs_if.c does today) and reuse the code already employed by its pseudo‑fs, as in the AppArmor patch. Supporting this syscall would therefore require only minimal changes. Line‑oriented ASCII text is not a barrier, either. The syscall can pass that format just fine. Because a typical TOMOYO line is very small, the performance gains from using the syscall are actually greater. A brief benchmark is available in [1]. Thanks, Maxime [1] https://gitlab.com/-/snippets/4840792