Commit d9250dea authored by KaiGai Kohei's avatar KaiGai Kohei Committed by James Morris
Browse files

SELinux: add boundary support and thread context assignment 



The purpose of this patch is to assign per-thread security context
under a constraint. It enables multi-threaded server application
to kick a request handler with its fair security context, and
helps some of userspace object managers to handle user's request.

When we assign a per-thread security context, it must not have wider
permissions than the original one. Because a multi-threaded process
shares a single local memory, an arbitary per-thread security context
also means another thread can easily refer violated information.

The constraint on a per-thread security context requires a new domain
has to be equal or weaker than its original one, when it tries to assign
a per-thread security context.

Bounds relationship between two types is a way to ensure a domain can
never have wider permission than its bounds. We can define it in two
explicit or implicit ways.

The first way is using new TYPEBOUNDS statement. It enables to define
a boundary of types explicitly. The other one expand the concept of
existing named based hierarchy. If we defines a type with "." separated
name like "httpd_t.php", toolchain implicitly set its bounds on "httpd_t".

This feature requires a new policy version.
The 24th version (POLICYDB_VERSION_BOUNDARY) enables to ship them into
kernel space, and the following patch enables to handle it.

Signed-off-by: default avatarKaiGai Kohei <kaigai@ak.jp.nec.com>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent da31894e

security/selinux/avc.c

+1 −1
Original line number Diff line number Diff line
@@ -136,7 +136,7 @@ static inline int avc_hash(u32 ssid, u32 tsid, u16 tclass) 
 * @tclass: target security class

 * @av: access vector

 */

static void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av)

void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av)

{

	const char **common_pts = NULL;

	u32 common_base = 0;

security/selinux/hooks.c

+12 −3
Original line number Diff line number Diff line
@@ -5226,8 +5226,12 @@ static int selinux_setprocattr(struct task_struct *p, 


		if (sid == 0)

			return -EINVAL;



		/* Only allow single threaded processes to change context */

		/*

		 * SELinux allows to change context in the following case only.

		 *  - Single threaded processes.

		 *  - Multi threaded processes intend to change its context into

		 *    more restricted domain (defined by TYPEBOUNDS statement).

		 */

		if (atomic_read(&p->mm->mm_users) != 1) {

			struct task_struct *g, *t;

			struct mm_struct *mm = p->mm;
@@ -5235,11 +5239,16 @@ static int selinux_setprocattr(struct task_struct *p, 
			do_each_thread(g, t) {

				if (t->mm == mm && t != p) {

					read_unlock(&tasklist_lock);

					return -EPERM;

					error = security_bounded_transition(tsec->sid, sid);

					if (!error)

						goto boundary_ok;



					return error;

				}

			} while_each_thread(g, t);

			read_unlock(&tasklist_lock);

		}

boundary_ok:



		/* Check permissions for the transition. */

		error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,

security/selinux/include/avc.h

+4 −0
Original line number Diff line number Diff line
@@ -12,6 +12,7 @@ 
#include <linux/kdev_t.h>

#include <linux/spinlock.h>

#include <linux/init.h>

#include <linux/audit.h>

#include <linux/in6.h>

#include <linux/path.h>

#include <asm/system.h>
@@ -126,6 +127,9 @@ int avc_add_callback(int (*callback)(u32 event, u32 ssid, u32 tsid, 
		     u32 events, u32 ssid, u32 tsid,

		     u16 tclass, u32 perms);



/* Shows permission in human readable form */

void avc_dump_av(struct audit_buffer *ab, u16 tclass, u32 av);



/* Exported to selinuxfs */

int avc_get_hash_stats(char *page);

extern unsigned int avc_cache_threshold;

security/selinux/include/security.h

+14 −1
Original line number Diff line number Diff line
@@ -27,13 +27,14 @@ 
#define POLICYDB_VERSION_RANGETRANS	21

#define POLICYDB_VERSION_POLCAP		22

#define POLICYDB_VERSION_PERMISSIVE	23

#define POLICYDB_VERSION_BOUNDARY	24



/* Range of policy versions we understand*/

#define POLICYDB_VERSION_MIN   POLICYDB_VERSION_BASE

#ifdef CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX

#define POLICYDB_VERSION_MAX	CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX_VALUE

#else

#define POLICYDB_VERSION_MAX	POLICYDB_VERSION_PERMISSIVE

#define POLICYDB_VERSION_MAX	POLICYDB_VERSION_BOUNDARY

#endif



#define CONTEXT_MNT	0x01
@@ -62,6 +63,16 @@ enum { 
extern int selinux_policycap_netpeer;

extern int selinux_policycap_openperm;



/*

 * type_datum properties

 * available at the kernel policy version >= POLICYDB_VERSION_BOUNDARY

 */

#define TYPEDATUM_PROPERTY_PRIMARY	0x0001

#define TYPEDATUM_PROPERTY_ATTRIBUTE	0x0002



/* limitation of boundary depth  */

#define POLICYDB_BOUNDS_MAXDEPTH	4



int security_load_policy(void *data, size_t len);



int security_policycap_supported(unsigned int req_cap);
@@ -117,6 +128,8 @@ int security_node_sid(u16 domain, void *addr, u32 addrlen, 
int security_validate_transition(u32 oldsid, u32 newsid, u32 tasksid,

				 u16 tclass);



int security_bounded_transition(u32 oldsid, u32 newsid);



int security_sid_mls_copy(u32 sid, u32 mls_sid, u32 *new_sid);



int security_net_peersid_resolve(u32 nlbl_sid, u32 nlbl_type,

security/selinux/ss/policydb.c

+191 −14
Original line number Diff line number Diff line
@@ -30,6 +30,7 @@ 
#include <linux/slab.h>

#include <linux/string.h>

#include <linux/errno.h>

#include <linux/audit.h>

#include "security.h"



#include "policydb.h"
@@ -116,7 +117,12 @@ static struct policydb_compat_info policydb_compat[] = { 
		.version	= POLICYDB_VERSION_PERMISSIVE,

		.sym_num	= SYM_NUM,

		.ocon_num	= OCON_NUM,

	}

	},

	{

		.version	= POLICYDB_VERSION_BOUNDARY,

		.sym_num	= SYM_NUM,

		.ocon_num	= OCON_NUM,

	},

};



static struct policydb_compat_info *policydb_lookup_compat(int version)
@@ -254,7 +260,9 @@ static int role_index(void *key, void *datum, void *datap) 


	role = datum;

	p = datap;

	if (!role->value || role->value > p->p_roles.nprim)

	if (!role->value

	    || role->value > p->p_roles.nprim

	    || role->bounds > p->p_roles.nprim)

		return -EINVAL;

	p->p_role_val_to_name[role->value - 1] = key;

	p->role_val_to_struct[role->value - 1] = role;
@@ -270,9 +278,12 @@ static int type_index(void *key, void *datum, void *datap) 
	p = datap;



	if (typdatum->primary) {

		if (!typdatum->value || typdatum->value > p->p_types.nprim)

		if (!typdatum->value

		    || typdatum->value > p->p_types.nprim

		    || typdatum->bounds > p->p_types.nprim)

			return -EINVAL;

		p->p_type_val_to_name[typdatum->value - 1] = key;

		p->type_val_to_struct[typdatum->value - 1] = typdatum;

	}



	return 0;
@@ -285,7 +296,9 @@ static int user_index(void *key, void *datum, void *datap) 


	usrdatum = datum;

	p = datap;

	if (!usrdatum->value || usrdatum->value > p->p_users.nprim)

	if (!usrdatum->value

	    || usrdatum->value > p->p_users.nprim

	    || usrdatum->bounds > p->p_users.nprim)

		return -EINVAL;

	p->p_user_val_to_name[usrdatum->value - 1] = key;

	p->user_val_to_struct[usrdatum->value - 1] = usrdatum;
@@ -438,6 +451,14 @@ static int policydb_index_others(struct policydb *p) 
		goto out;

	}



	p->type_val_to_struct =

		kmalloc(p->p_types.nprim * sizeof(*(p->type_val_to_struct)),

			GFP_KERNEL);

	if (!p->type_val_to_struct) {

		rc = -ENOMEM;

		goto out;

	}



	if (cond_init_bool_indexes(p)) {

		rc = -ENOMEM;

		goto out;
@@ -625,6 +646,7 @@ void policydb_destroy(struct policydb *p) 
	kfree(p->class_val_to_struct);

	kfree(p->role_val_to_struct);

	kfree(p->user_val_to_struct);

	kfree(p->type_val_to_struct);



	avtab_destroy(&p->te_avtab);
@@ -1176,8 +1198,8 @@ static int role_read(struct policydb *p, struct hashtab *h, void *fp) 
{

	char *key = NULL;

	struct role_datum *role;

	int rc;

	__le32 buf[2];

	int rc, to_read = 2;

	__le32 buf[3];

	u32 len;



	role = kzalloc(sizeof(*role), GFP_KERNEL);
@@ -1186,12 +1208,17 @@ static int role_read(struct policydb *p, struct hashtab *h, void *fp) 
		goto out;

	}



	rc = next_entry(buf, fp, sizeof buf);

	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)

		to_read = 3;



	rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);

	if (rc < 0)

		goto bad;



	len = le32_to_cpu(buf[0]);

	role->value = le32_to_cpu(buf[1]);

	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)

		role->bounds = le32_to_cpu(buf[2]);



	key = kmalloc(len + 1, GFP_KERNEL);

	if (!key) {
@@ -1236,8 +1263,8 @@ static int type_read(struct policydb *p, struct hashtab *h, void *fp) 
{

	char *key = NULL;

	struct type_datum *typdatum;

	int rc;

	__le32 buf[3];

	int rc, to_read = 3;

	__le32 buf[4];

	u32 len;



	typdatum = kzalloc(sizeof(*typdatum), GFP_KERNEL);
@@ -1246,13 +1273,27 @@ static int type_read(struct policydb *p, struct hashtab *h, void *fp) 
		return rc;

	}



	rc = next_entry(buf, fp, sizeof buf);

	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)

		to_read = 4;



	rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);

	if (rc < 0)

		goto bad;



	len = le32_to_cpu(buf[0]);

	typdatum->value = le32_to_cpu(buf[1]);

	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY) {

		u32 prop = le32_to_cpu(buf[2]);



		if (prop & TYPEDATUM_PROPERTY_PRIMARY)

			typdatum->primary = 1;

		if (prop & TYPEDATUM_PROPERTY_ATTRIBUTE)

			typdatum->attribute = 1;



		typdatum->bounds = le32_to_cpu(buf[3]);

	} else {

		typdatum->primary = le32_to_cpu(buf[2]);

	}



	key = kmalloc(len + 1, GFP_KERNEL);

	if (!key) {
@@ -1309,8 +1350,8 @@ static int user_read(struct policydb *p, struct hashtab *h, void *fp) 
{

	char *key = NULL;

	struct user_datum *usrdatum;

	int rc;

	__le32 buf[2];

	int rc, to_read = 2;

	__le32 buf[3];

	u32 len;



	usrdatum = kzalloc(sizeof(*usrdatum), GFP_KERNEL);
@@ -1319,12 +1360,17 @@ static int user_read(struct policydb *p, struct hashtab *h, void *fp) 
		goto out;

	}



	rc = next_entry(buf, fp, sizeof buf);

	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)

		to_read = 3;



	rc = next_entry(buf, fp, sizeof(buf[0]) * to_read);

	if (rc < 0)

		goto bad;



	len = le32_to_cpu(buf[0]);

	usrdatum->value = le32_to_cpu(buf[1]);

	if (p->policyvers >= POLICYDB_VERSION_BOUNDARY)

		usrdatum->bounds = le32_to_cpu(buf[2]);



	key = kmalloc(len + 1, GFP_KERNEL);

	if (!key) {
@@ -1465,6 +1511,133 @@ static int (*read_f[SYM_NUM]) (struct policydb *p, struct hashtab *h, void *fp) 
	cat_read,

};



static int user_bounds_sanity_check(void *key, void *datum, void *datap)

{

	struct user_datum *upper, *user;

	struct policydb *p = datap;

	int depth = 0;



	upper = user = datum;

	while (upper->bounds) {

		struct ebitmap_node *node;

		unsigned long bit;



		if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {

			printk(KERN_ERR "SELinux: user %s: "

			       "too deep or looped boundary",

			       (char *) key);

			return -EINVAL;

		}



		upper = p->user_val_to_struct[upper->bounds - 1];

		ebitmap_for_each_positive_bit(&user->roles, node, bit) {

			if (ebitmap_get_bit(&upper->roles, bit))

				continue;



			printk(KERN_ERR

			       "SELinux: boundary violated policy: "

			       "user=%s role=%s bounds=%s\n",

			       p->p_user_val_to_name[user->value - 1],

			       p->p_role_val_to_name[bit],

			       p->p_user_val_to_name[upper->value - 1]);



			return -EINVAL;

		}

	}



	return 0;

}



static int role_bounds_sanity_check(void *key, void *datum, void *datap)

{

	struct role_datum *upper, *role;

	struct policydb *p = datap;

	int depth = 0;



	upper = role = datum;

	while (upper->bounds) {

		struct ebitmap_node *node;

		unsigned long bit;



		if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {

			printk(KERN_ERR "SELinux: role %s: "

			       "too deep or looped bounds\n",

			       (char *) key);

			return -EINVAL;

		}



		upper = p->role_val_to_struct[upper->bounds - 1];

		ebitmap_for_each_positive_bit(&role->types, node, bit) {

			if (ebitmap_get_bit(&upper->types, bit))

				continue;



			printk(KERN_ERR

			       "SELinux: boundary violated policy: "

			       "role=%s type=%s bounds=%s\n",

			       p->p_role_val_to_name[role->value - 1],

			       p->p_type_val_to_name[bit],

			       p->p_role_val_to_name[upper->value - 1]);



			return -EINVAL;

		}

	}



	return 0;

}



static int type_bounds_sanity_check(void *key, void *datum, void *datap)

{

	struct type_datum *upper, *type;

	struct policydb *p = datap;

	int depth = 0;



	upper = type = datum;

	while (upper->bounds) {

		if (++depth == POLICYDB_BOUNDS_MAXDEPTH) {

			printk(KERN_ERR "SELinux: type %s: "

			       "too deep or looped boundary\n",

			       (char *) key);

			return -EINVAL;

		}



		upper = p->type_val_to_struct[upper->bounds - 1];

		if (upper->attribute) {

			printk(KERN_ERR "SELinux: type %s: "

			       "bounded by attribute %s",

			       (char *) key,

			       p->p_type_val_to_name[upper->value - 1]);

			return -EINVAL;

		}

	}



	return 0;

}



static int policydb_bounds_sanity_check(struct policydb *p)

{

	int rc;



	if (p->policyvers < POLICYDB_VERSION_BOUNDARY)

		return 0;



	rc = hashtab_map(p->p_users.table,

			 user_bounds_sanity_check, p);

	if (rc)

		return rc;



	rc = hashtab_map(p->p_roles.table,

			 role_bounds_sanity_check, p);

	if (rc)

		return rc;



	rc = hashtab_map(p->p_types.table,

			 type_bounds_sanity_check, p);

	if (rc)

		return rc;



	return 0;

}



extern int ss_initialized;



/*
@@ -1961,6 +2134,10 @@ int policydb_read(struct policydb *p, void *fp) 
				goto bad;

	}



	rc = policydb_bounds_sanity_check(p);

	if (rc)

		goto bad;



	rc = 0;

out:

	return rc;

CRA Git | Maintained and supported by SUSTech CRA and CCSE