Commit a4c35a50 authored by Seth Forshee's avatar Seth Forshee

Smack: Handle labels consistently in untrusted mounts

The SMACK64, SMACK64EXEC, and SMACK64MMAP labels are all handled
differently in untrusted mounts. This is confusing and
potentically problematic. Change this to handle them all the same
way that SMACK64 is currently handled; that is, read the label
from disk and check it at use time. For SMACK64 and SMACK64MMAP
access is denied if the label does not match smk_root. To be
consistent with suid, a SMACK64EXEC label which does not match
smk_root will still allow execution of the file but will not run
with the label supplied in the xattr.
Signed-off-by: default avatarSeth Forshee <seth.forshee@canonical.com>
Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
parent 9977ba76
...@@ -921,6 +921,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) ...@@ -921,6 +921,7 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm)
struct inode *inode = file_inode(bprm->file); struct inode *inode = file_inode(bprm->file);
struct task_smack *bsp = bprm->cred->security; struct task_smack *bsp = bprm->cred->security;
struct inode_smack *isp; struct inode_smack *isp;
struct superblock_smack *sbsp;
int rc; int rc;
if (bprm->cred_prepared) if (bprm->cred_prepared)
...@@ -930,6 +931,11 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) ...@@ -930,6 +931,11 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm)
if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task) if (isp->smk_task == NULL || isp->smk_task == bsp->smk_task)
return 0; return 0;
sbsp = inode->i_sb->s_security;
if ((sbsp->smk_flags & SMK_SB_UNTRUSTED) &&
isp->smk_task != sbsp->smk_root)
return 0;
if (bprm->unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) { if (bprm->unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
struct task_struct *tracer; struct task_struct *tracer;
rc = 0; rc = 0;
...@@ -1733,6 +1739,7 @@ static int smack_mmap_file(struct file *file, ...@@ -1733,6 +1739,7 @@ static int smack_mmap_file(struct file *file,
struct task_smack *tsp; struct task_smack *tsp;
struct smack_known *okp; struct smack_known *okp;
struct inode_smack *isp; struct inode_smack *isp;
struct superblock_smack *sbsp;
int may; int may;
int mmay; int mmay;
int tmay; int tmay;
...@@ -1744,6 +1751,10 @@ static int smack_mmap_file(struct file *file, ...@@ -1744,6 +1751,10 @@ static int smack_mmap_file(struct file *file,
isp = file_inode(file)->i_security; isp = file_inode(file)->i_security;
if (isp->smk_mmap == NULL) if (isp->smk_mmap == NULL)
return 0; return 0;
sbsp = file_inode(file)->i_sb->s_security;
if (sbsp->smk_flags & SMK_SB_UNTRUSTED &&
isp->smk_mmap != sbsp->smk_root)
return -EACCES;
mkp = isp->smk_mmap; mkp = isp->smk_mmap;
tsp = current_security(); tsp = current_security();
...@@ -3532,16 +3543,14 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) ...@@ -3532,16 +3543,14 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode)
if (rc >= 0) if (rc >= 0)
transflag = SMK_INODE_TRANSMUTE; transflag = SMK_INODE_TRANSMUTE;
} }
if (!(sbsp->smk_flags & SMK_SB_UNTRUSTED)) { /*
/* * Don't let the exec or mmap label be "*" or "@".
* Don't let the exec or mmap label be "*" or "@". */
*/ skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp);
skp = smk_fetch(XATTR_NAME_SMACKEXEC, inode, dp); if (IS_ERR(skp) || skp == &smack_known_star ||
if (IS_ERR(skp) || skp == &smack_known_star || skp == &smack_known_web)
skp == &smack_known_web) skp = NULL;
skp = NULL; isp->smk_task = skp;
isp->smk_task = skp;
}
skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp); skp = smk_fetch(XATTR_NAME_SMACKMMAP, inode, dp);
if (IS_ERR(skp) || skp == &smack_known_star || if (IS_ERR(skp) || skp == &smack_known_star ||
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment