From patchwork Wed Oct 18 10:50:29 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Michael_Wei=C3=9F?= X-Patchwork-Id: 154815 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:2908:b0:403:3b70:6f57 with SMTP id ib8csp4703291vqb; Wed, 18 Oct 2023 03:57:16 -0700 (PDT) X-Google-Smtp-Source: AGHT+IFB/0Z8c/0RdFn2heBzn1C984AVwNO7yuxdEGwEKnP8OhcsNkhz28nEgmchn8Ldf3W1Ph3y X-Received: by 2002:a05:6a20:d80d:b0:15d:f804:6907 with SMTP id iv13-20020a056a20d80d00b0015df8046907mr4796238pzb.0.1697626636608; Wed, 18 Oct 2023 03:57:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1697626636; cv=none; d=google.com; s=arc-20160816; b=vSBkU5zSZKIkZWkWkBGC/O2FBL1pouWPMW1F9V7HyjVgJ/0iDbFapQz56YX3jYJ+ja COnyB2T0N188sD80YwQ44DwrNetnxE+1/B11L74KNcS1/eL3xvZiq96BACi/zj31A+8I XbObqe49gn2HsmJ+fYDeS1zaFM/5tmIhq0m45IrAITkcj3516g+k2vKw4GqYTmDous9h 14+o7/nUUjxdizuiTVITNREgtfX8IJACxT0tr65jH4L/JZ5s6ZAtZ8vBN6W4XJqYjxad wWG2F7UpThm2e3u9N6K5n/Tpd9lRt0zZoE2tn0aVkomRUxYOyDj1KlCgAr7nek+8SIkJ AT6Q== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:ui-outboundreport:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=cIOTMO6yC7WdeCt0aKqWADZaSZCE3fJU0LTeLb0YV08=; fh=c4ql7d5QsFreQmYQr7ycbAsMayBEmNUOv2nmR/PVp9M=; b=QNDY1WBPlv0+SIML4RVwkgFSao8TKm5uPNhCti1aBJIEXzqszvxYLA5Th19W4gS15x o6CQkGgh5uWIpjt1LsqlawH5Jbfe8DtlUqOKdNxlUcYdN6zvrcUUqPppGfxLc8M9iNi4 bsmJfgF5dsiafpxtCpi1jcXr4vUZVM3ZE/jwQdW/2dpcQvnxOa2PQ2aqmB2QOunPhC9c 0VBiOCVVAXuq/ft+SHFG3lOiKlKUjJXV8fhYRlOGdyyLHpl/muIjjgclSVGS2p2Hql7y wn4lcmIi9ZUyDlMUEffQd00Ji9esXMroJEU8u18O1/3zBGON8D3FLsTrZmAT2RnUEuZr VnFA== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=aisec.fraunhofer.de Received: from snail.vger.email (snail.vger.email. [2620:137:e000::3:7]) by mx.google.com with ESMTPS id j8-20020a170903024800b001c9b15bf939si3900535plh.358.2023.10.18.03.57.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 18 Oct 2023 03:57:16 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=aisec.fraunhofer.de Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by snail.vger.email (Postfix) with ESMTP id 965FB8051B7A; Wed, 18 Oct 2023 03:57:15 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at snail.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229846AbjJRK5J (ORCPT + 24 others); Wed, 18 Oct 2023 06:57:09 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40424 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229984AbjJRK5E (ORCPT ); Wed, 18 Oct 2023 06:57:04 -0400 Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.131]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DCEEB92; Wed, 18 Oct 2023 03:57:01 -0700 (PDT) Received: from weisslap.aisec.fraunhofer.de ([91.67.186.133]) by mrelayeu.kundenserver.de (mreue012 [212.227.15.167]) with ESMTPSA (Nemesis) id 1MpCz1-1rJY4G0S1H-00qmy3; Wed, 18 Oct 2023 12:51:03 +0200 From: =?utf-8?q?Michael_Wei=C3=9F?= To: Alexander Mikhalitsyn , Christian Brauner , Alexei Starovoitov , Paul Moore Cc: Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Quentin Monnet , Alexander Viro , Miklos Szeredi , Amir Goldstein , "Serge E. Hallyn" , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, gyroidos@aisec.fraunhofer.de, =?utf-8?q?Mich?= =?utf-8?q?ael_Wei=C3=9F?= Subject: [RFC PATCH v2 10/14] lsm: Add security_sb_alloc_userns() hook Date: Wed, 18 Oct 2023 12:50:29 +0200 Message-Id: <20231018105033.13669-11-michael.weiss@aisec.fraunhofer.de> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20231018105033.13669-1-michael.weiss@aisec.fraunhofer.de> References: <20231018105033.13669-1-michael.weiss@aisec.fraunhofer.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:1r5RyqGAN9dy40dCcTVA8P+ZdQrnAWjyMfT7NWw+AjP5k7SdSAx KK6ojyZeqMoIKXoNN5B05l8hRYYrpxg2YsWGs0W0oVR5FlK/vd0aZOYdG0AL/l+CQ5iGm5e O0YnfYkhugXo/lJhVr+PA2rOcH47EsknuLQQnKrXL07VgH3KwnC4ufExd7KzXs9PeBLvufI ET/oTA9gKppKW3e2BLdgQ== UI-OutboundReport: notjunk:1;M01:P0:7me07hlkTME=;sNgRW1+b87bFkPd2ci/jNOKxrY/ E3OsrEQIpRvOmvjffQg2b9fa3t3DZkvTrHLDkqf3oYKKFUgeSxdR5qG18aSrsBOK1Pa00KKbL /UQcWTQ/nuYrv0QvLDl50sf086WdgoBfJ2/URhBwnTv3KRQ7t1il7cgJceSozFxcemIogxidQ LL3M7TsNkb7ASSMhpnDNiMHiNTkCb1yiA82Nrq/W/9+yDZxO2s49HocioaBiV1xOGuEPUMONT 5U3G+4fXY7tdTs13VnJmVlLF92Z5idVgVqYYm/5QZ5uKKT4maSQSfG00nf94lEsDFTiPIkn+S ZtHGKa+F96ZkdZjnU8HvdbGCQebFMQIM08okjd5W441mzGfzGU9FrScSOsOeecy9/uxvBGh3a o1NprWiXBUNBGiz81EQMjrmU3nCGoIFu9sjU7jb+HlsX6va7+AhzTp2gZDMHaOv+v2LTx7PCv JFP3BiK90WUmdBc1poLC6wEhfDmVzclkLzJ30wAC089UquOrE90adQwCB5QcDQMN9ffOqWgcd PiH00bjbtVzeuknhKCGGOYCVepoOa32lfVdtoXIlqaQOaa2WHt55aPihU/lIfuAdkTHb4HR4E b2I/CdlUPHHEg1y5An6i9eeJ/e4H4K0lGCHxR9Dw2sTu0iJFz7I06zTgsrXPoVkEopPu0r/48 hY7IU5/UR9hiCk9hCcwQ8C/RkZiX0ZtNwi9crKi+5zomHZoKB22oZlbH/Cx00W6i9rUJAetZe KJ+cOaHVobJZdbTDq8FHjFDCH1XKnYFYP+kv+m289poYuRD09l91FbFx4B2n4y0zC4jKHAndJ Twfv3u/b7Mwi6HYZXKp8uVign0Z2zewzMYSYzTlx4nMib1DuCWW8mNEDVEuw6HK7uKorvcUhW sfBrRi+IYWzODCABGVCbEVEkHzTs9PrJrERU= X-Spam-Status: No, score=-1.2 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_BLOCKED,RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL, SPF_HELO_NONE,SPF_SOFTFAIL autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Wed, 18 Oct 2023 03:57:15 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1780090547795061603 X-GMAIL-MSGID: 1780090547795061603 Provide a new lsm hook which may be used to allow access to device nodes for super blocks created in unprivileged namespaces if some sort of device guard to control access is implemented. By default this will return -EPERM if no lsm implements the hook. A first lsm to use this will be the lately converted cgroup_device module. Signed-off-by: Michael Weiß --- include/linux/lsm_hook_defs.h | 1 + include/linux/security.h | 5 +++++ security/security.c | 26 ++++++++++++++++++++++++++ 3 files changed, 32 insertions(+) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index f4fa01182910..0f734a0a5ebc 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -278,6 +278,7 @@ LSM_HOOK(int, 0, inode_getsecctx, struct inode *inode, void **ctx, LSM_HOOK(int, 0, dev_permission, umode_t mode, dev_t dev, int mask) LSM_HOOK(int, -EPERM, inode_mknod_nscap, struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) +LSM_HOOK(int, -EPERM, sb_alloc_userns, struct super_block *sb) #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE) LSM_HOOK(int, 0, post_notification, const struct cred *w_cred, diff --git a/include/linux/security.h b/include/linux/security.h index bad6992877f4..0f66be1ed1ed 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -487,6 +487,7 @@ int security_locked_down(enum lockdown_reason what); int security_dev_permission(umode_t mode, dev_t dev, int mask); int security_inode_mknod_nscap(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev); +int security_sb_alloc_userns(struct super_block *sb); #else /* CONFIG_SECURITY */ static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data) @@ -1408,6 +1409,10 @@ static inline int security_inode_mknod_nscap(struct inode *dir, { return -EPERM; } +static inline int security_sb_alloc_userns(struct super_block *sb) +{ + return -EPERM; +} #endif /* CONFIG_SECURITY */ #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE) diff --git a/security/security.c b/security/security.c index 7708374b6d7e..9d5d4ec28e62 100644 --- a/security/security.c +++ b/security/security.c @@ -4065,6 +4065,32 @@ int security_inode_mknod_nscap(struct inode *dir, struct dentry *dentry, } EXPORT_SYMBOL(security_inode_mknod_nscap); +/** + * security_sb_alloc_userns() - Grand access to device nodes on sb in userns + * + * If device access is provided elsewere, this hook will grand access to device nodes + * on the allocated sb for unprivileged user namespaces. + * + * Return: Returns 0 on success, error on failure. + */ +int security_sb_alloc_userns(struct super_block *sb) +{ + int thisrc; + int rc = LSM_RET_DEFAULT(sb_alloc_userns); + struct security_hook_list *hp; + + hlist_for_each_entry(hp, &security_hook_heads.sb_alloc_userns, list) { + thisrc = hp->hook.sb_alloc_userns(sb); + if (thisrc != LSM_RET_DEFAULT(sb_alloc_userns)) { + rc = thisrc; + if (thisrc != 0) + break; + } + } + return rc; +} +EXPORT_SYMBOL(security_sb_alloc_userns); + #ifdef CONFIG_WATCH_QUEUE /** * security_post_notification() - Check if a watch notification can be posted