iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: Fix setting of PF_SUPERPRIV by __capable()

Browse Source 
Fix the setting of PF_SUPERPRIV by __capable() as it could corrupt the flags
the target process if that is not the current process and it is trying to
change its own flags in a different way at the same time.

__capable() is using neither atomic ops nor locking to protect t->flags.  This
patch removes __capable() and introduces has_capability() that doesn't set
PF_SUPERPRIV on the process being queried.

This patch further splits security_ptrace() in two:

 (1) security_ptrace_may_access().  This passes judgement on whether one
     process may access another only (PTRACE_MODE_ATTACH for ptrace() and
     PTRACE_MODE_READ for /proc), and takes a pointer to the child process.
     current is the parent.

 (2) security_ptrace_traceme().  This passes judgement on PTRACE_TRACEME only,
     and takes only a pointer to the parent process.  current is the child.

     In Smack and commoncap, this uses has_capability() to determine whether
     the parent will be permitted to use PTRACE_ATTACH if normal checks fail.
     This does not set PF_SUPERPRIV.

Two of the instances of __capable() actually only act on current, and so have
been changed to calls to capable().

Of the places that were using __capable():

 (1) The OOM killer calls __capable() thrice when weighing the killability of a
     process.  All of these now use has_capability().

 (2) cap_ptrace() and smack_ptrace() were using __capable() to check to see
     whether the parent was allowed to trace any process.  As mentioned above,
     these have been split.  For PTRACE_ATTACH and /proc, capable() is now
     used, and for PTRACE_TRACEME, has_capability() is used.

 (3) cap_safe_nice() only ever saw current, so now uses capable().

 (4) smack_setprocattr() rejected accesses to tasks other than current just
     after calling __capable(), so the order of these two tests have been
     switched and capable() is used instead.

 (5) In smack_file_send_sigiotask(), we need to allow privileged processes to
     receive SIGIO on files they're manipulating.

 (6) In smack_task_wait(), we let a process wait for a privileged process,
     whether or not the process doing the waiting is privileged.

I've tested this with the LTP SELinux and syscalls testscripts.

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Morris <jmorris@namei.org>
This commit is contained in:
David Howells
2008-08-14 11:37:28 +01:00
committed by James Morris
parent 8d0968abd0
commit 5cd9c58fbe
11 changed files with 137 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files

49
security/smack/smack_lsm.c
View File

@ -87,27 +87,46 @@ struct inode_smack *new_inode_smack(char *smack)
*/
/**
* smack_ptrace - Smack approval on ptrace
* @ptp: parent task pointer
* smack_ptrace_may_access - Smack approval on PTRACE_ATTACH
* @ctp: child task pointer
*
* Returns 0 if access is OK, an error code otherwise
*
* Do the capability checks, and require read and write.
*/
static int smack_ptrace(struct task_struct *ptp, struct task_struct *ctp,
unsigned int mode)
static int smack_ptrace_may_access(struct task_struct *ctp, unsigned int mode)
{
int rc;
rc = cap_ptrace(ptp, ctp, mode);
rc = cap_ptrace_may_access(ctp, mode);
if (rc != 0)
return rc;
rc = smk_access(ptp->security, ctp->security, MAY_READWRITE);
if (rc != 0 && __capable(ptp, CAP_MAC_OVERRIDE))
rc = smk_access(current->security, ctp->security, MAY_READWRITE);
if (rc != 0 && capable(CAP_MAC_OVERRIDE))
return 0;
return rc;
}
/**
* smack_ptrace_traceme - Smack approval on PTRACE_TRACEME
* @ptp: parent task pointer
*
* Returns 0 if access is OK, an error code otherwise
*
* Do the capability checks, and require read and write.
*/
static int smack_ptrace_traceme(struct task_struct *ptp)
{
int rc;
rc = cap_ptrace_traceme(ptp);
if (rc != 0)
return rc;
rc = smk_access(ptp->security, current->security, MAY_READWRITE);
if (rc != 0 && has_capability(ptp, CAP_MAC_OVERRIDE))
return 0;
return rc;
}
@ -923,7 +942,7 @@ static int smack_file_send_sigiotask(struct task_struct *tsk,
*/
file = container_of(fown, struct file, f_owner);
rc = smk_access(file->f_security, tsk->security, MAY_WRITE);
if (rc != 0 && __capable(tsk, CAP_MAC_OVERRIDE))
if (rc != 0 && has_capability(tsk, CAP_MAC_OVERRIDE))
return 0;
return rc;
}
@ -1164,12 +1183,12 @@ static int smack_task_wait(struct task_struct *p)
* account for the smack labels having gotten to
* be different in the first place.
*
* This breaks the strict subjet/object access
* This breaks the strict subject/object access
* control ideal, taking the object's privilege
* state into account in the decision as well as
* the smack value.
*/
if (capable(CAP_MAC_OVERRIDE) || __capable(p, CAP_MAC_OVERRIDE))
if (capable(CAP_MAC_OVERRIDE) || has_capability(p, CAP_MAC_OVERRIDE))
return 0;
return rc;
@ -2016,9 +2035,6 @@ static int smack_setprocattr(struct task_struct *p, char *name,
{
char *newsmack;
if (!__capable(p, CAP_MAC_ADMIN))
return -EPERM;
/*
* Changing another process' Smack value is too dangerous
* and supports no sane use case.
@ -2026,6 +2042,9 @@ static int smack_setprocattr(struct task_struct *p, char *name,
if (p != current)
return -EPERM;
if (!capable(CAP_MAC_ADMIN))
return -EPERM;
if (value == NULL || size == 0 || size >= SMK_LABELLEN)
return -EINVAL;
@ -2552,7 +2571,8 @@ static void smack_release_secctx(char *secdata, u32 seclen)
struct security_operations smack_ops = {
.name = "smack",
.ptrace = smack_ptrace,
.ptrace_may_access = smack_ptrace_may_access,
.ptrace_traceme = smack_ptrace_traceme,
.capget = cap_capget,
.capset_check = cap_capset_check,
.capset_set = cap_capset_set,
@ -2729,4 +2749,3 @@ static __init int smack_init(void)
* all processes and objects when they are created.
*/
security_initcall(smack_init);