iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

selinux: Fix selinux_sb_mnt_opts_compat()

Browse Source 
selinux_sb_mnt_opts_compat() is called under the sb_lock spinlock and
shouldn't be performing any memory allocations.  Fix this by parsing the
sids at the same time we're chopping up the security mount options
string and then using the pre-parsed sids when doing the comparison.

Fixes: cc274ae776 ("selinux: fix sleeping function called from invalid context")
Fixes: 69c4a42d72 ("lsm,selinux: add new hook to compare new mount to an existing mount")
Signed-off-by: Scott Mayhew <smayhew@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Scott Mayhew 2022-01-31 13:57:36 -05:00 committed by Paul Moore
parent ecff30575b
commit b8b87fd954
1 changed files with 41 additions and 34 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

69
security/selinux/hooks.c
View File

@ -341,6 +341,10 @@ static void inode_free_security(struct inode *inode)
struct selinux_mnt_opts { struct selinux_mnt_opts {
const char *fscontext, *context, *rootcontext, *defcontext; const char *fscontext, *context, *rootcontext, *defcontext;
u32 fscontext_sid;
u32 context_sid;
u32 rootcontext_sid;
u32 defcontext_sid;
}; };
static void selinux_free_mnt_opts(void *mnt_opts) static void selinux_free_mnt_opts(void *mnt_opts)
@ -597,15 +601,14 @@ static int bad_option(struct superblock_security_struct *sbsec, char flag,
return 0; return 0;
} }
static int parse_sid(struct super_block *sb, const char *s, u32 *sid, static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
gfp_t gfp)
{ {
int rc = security_context_str_to_sid(&selinux_state, s, int rc = security_context_str_to_sid(&selinux_state, s,
sid, gfp); sid, GFP_KERNEL);
if (rc) if (rc)
pr_warn("SELinux: security_context_str_to_sid" pr_warn("SELinux: security_context_str_to_sid"
"(%s) failed for (dev %s, type %s) errno=%d\n", "(%s) failed for (dev %s, type %s) errno=%d\n",
s, sb->s_id, sb->s_type->name, rc); s, sb ? sb->s_id : "?", sb ? sb->s_type->name : "?", rc);
return rc; return rc;
} }
@ -672,8 +675,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
*/ */
if (opts) { if (opts) {
if (opts->fscontext) { if (opts->fscontext) {
rc = parse_sid(sb, opts->fscontext, &fscontext_sid, rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
GFP_KERNEL);
if (rc) if (rc)
goto out; goto out;
if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
@ -682,8 +684,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
sbsec->flags |= FSCONTEXT_MNT; sbsec->flags |= FSCONTEXT_MNT;
} }
if (opts->context) { if (opts->context) {
rc = parse_sid(sb, opts->context, &context_sid, rc = parse_sid(sb, opts->context, &context_sid);
GFP_KERNEL);
if (rc) if (rc)
goto out; goto out;
if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
@ -692,8 +693,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
sbsec->flags |= CONTEXT_MNT; sbsec->flags |= CONTEXT_MNT;
} }
if (opts->rootcontext) { if (opts->rootcontext) {
rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid, rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
GFP_KERNEL);
if (rc) if (rc)
goto out; goto out;
if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
@ -702,8 +702,7 @@ static int selinux_set_mnt_opts(struct super_block *sb,
sbsec->flags |= ROOTCONTEXT_MNT; sbsec->flags |= ROOTCONTEXT_MNT;
} }
if (opts->defcontext) { if (opts->defcontext) {
rc = parse_sid(sb, opts->defcontext, &defcontext_sid, rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
GFP_KERNEL);
if (rc) if (rc)
goto out; goto out;
if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
@ -995,21 +994,29 @@ static int selinux_add_opt(int token, const char *s, void **mnt_opts)
if (opts->context || opts->defcontext) if (opts->context || opts->defcontext)
goto err; goto err;
opts->context = s; opts->context = s;
if (selinux_initialized(&selinux_state))
parse_sid(NULL, s, &opts->context_sid);
break; break;
case Opt_fscontext: case Opt_fscontext:
if (opts->fscontext) if (opts->fscontext)
goto err; goto err;
opts->fscontext = s; opts->fscontext = s;
if (selinux_initialized(&selinux_state))
parse_sid(NULL, s, &opts->fscontext_sid);
break; break;
case Opt_rootcontext: case Opt_rootcontext:
if (opts->rootcontext) if (opts->rootcontext)
goto err; goto err;
opts->rootcontext = s; opts->rootcontext = s;
if (selinux_initialized(&selinux_state))
parse_sid(NULL, s, &opts->rootcontext_sid);
break; break;
case Opt_defcontext: case Opt_defcontext:
if (opts->context || opts->defcontext) if (opts->context || opts->defcontext)
goto err; goto err;
opts->defcontext = s; opts->defcontext = s;
if (selinux_initialized(&selinux_state))
parse_sid(NULL, s, &opts->defcontext_sid);
break; break;
} }
@ -2647,8 +2654,6 @@ static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
{ {
struct selinux_mnt_opts *opts = mnt_opts; struct selinux_mnt_opts *opts = mnt_opts;
struct superblock_security_struct *sbsec = selinux_superblock(sb); struct superblock_security_struct *sbsec = selinux_superblock(sb);
u32 sid;
int rc;
/* /*
* Superblock not initialized (i.e. no options) - reject if any * Superblock not initialized (i.e. no options) - reject if any
@ -2665,34 +2670,36 @@ static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
return (sbsec->flags & SE_MNTMASK) ? 1 : 0; return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
if (opts->fscontext) { if (opts->fscontext) {
rc = parse_sid(sb, opts->fscontext, &sid, GFP_NOWAIT); if (opts->fscontext_sid == SECSID_NULL)
if (rc)
return 1; return 1;
if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid)) else if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
opts->fscontext_sid))
return 1; return 1;
} }
if (opts->context) { if (opts->context) {
rc = parse_sid(sb, opts->context, &sid, GFP_NOWAIT); if (opts->context_sid == SECSID_NULL)
if (rc)
return 1; return 1;
if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid)) else if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
opts->context_sid))
return 1; return 1;
} }
if (opts->rootcontext) { if (opts->rootcontext) {
if (opts->rootcontext_sid == SECSID_NULL)
return 1;
else {
struct inode_security_struct *root_isec; struct inode_security_struct *root_isec;
root_isec = backing_inode_security(sb->s_root); root_isec = backing_inode_security(sb->s_root);
rc = parse_sid(sb, opts->rootcontext, &sid, GFP_NOWAIT); if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
if (rc) opts->rootcontext_sid))
return 1;
if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
return 1; return 1;
} }
}
if (opts->defcontext) { if (opts->defcontext) {
rc = parse_sid(sb, opts->defcontext, &sid, GFP_NOWAIT); if (opts->defcontext_sid == SECSID_NULL)
if (rc)
return 1; return 1;
if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid)) else if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
opts->defcontext_sid))
return 1; return 1;
} }
return 0; return 0;
@ -2712,14 +2719,14 @@ static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
return 0; return 0;
if (opts->fscontext) { if (opts->fscontext) {
rc = parse_sid(sb, opts->fscontext, &sid, GFP_KERNEL); rc = parse_sid(sb, opts->fscontext, &sid);
if (rc) if (rc)
return rc; return rc;
if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid)) if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
goto out_bad_option; goto out_bad_option;
} }
if (opts->context) { if (opts->context) {
rc = parse_sid(sb, opts->context, &sid, GFP_KERNEL); rc = parse_sid(sb, opts->context, &sid);
if (rc) if (rc)
return rc; return rc;
if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid)) if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
@ -2728,14 +2735,14 @@ static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
if (opts->rootcontext) { if (opts->rootcontext) {
struct inode_security_struct *root_isec; struct inode_security_struct *root_isec;
root_isec = backing_inode_security(sb->s_root); root_isec = backing_inode_security(sb->s_root);
rc = parse_sid(sb, opts->rootcontext, &sid, GFP_KERNEL); rc = parse_sid(sb, opts->rootcontext, &sid);
if (rc) if (rc)
return rc; return rc;
if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid)) if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
goto out_bad_option; goto out_bad_option;
} }
if (opts->defcontext) { if (opts->defcontext) {
rc = parse_sid(sb, opts->defcontext, &sid, GFP_KERNEL); rc = parse_sid(sb, opts->defcontext, &sid);
if (rc) if (rc)
return rc; return rc;
if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid)) if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))