From patchwork Wed Oct 18 10:50:30 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: =?utf-8?q?Michael_Wei=C3=9F?= X-Patchwork-Id: 154808 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:612c:2908:b0:403:3b70:6f57 with SMTP id ib8csp4701379vqb; Wed, 18 Oct 2023 03:52:16 -0700 (PDT) X-Google-Smtp-Source: AGHT+IGcDQZlYSLmSSu33TzJ3qaLkD1H8Cj1aZCPmUw4x8WqE32bdaIkdHXXkxYQXLoa00WZcdOd X-Received: by 2002:a05:6e02:1d8a:b0:34e:2a69:883c with SMTP id h10-20020a056e021d8a00b0034e2a69883cmr5802703ila.1.1697626336246; Wed, 18 Oct 2023 03:52:16 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1697626336; cv=none; d=google.com; s=arc-20160816; b=Tx1E+l1725GtXumB79lYegHlXLhbWATqiSAwx2dDiZwp7dIiYIB4UWUChWoaayIFTB Xo90D5/F8s9rr8LLp8vuAaVRflEwln8ikRoqEAJSeG9CXVfucCAMD1khlgQzisqekqRb 6mfw7HDFA56T0EUwp9bJR1o5Sziol2ALRAIJEgK+nU9sMYbdNUtVr0fSWTbvC3GbnKwT o22C91XixEcE2b0FoSHTwP4vyegSntMNDN0D6Xzq3yg4XFHpuQZBtghny+NZ4QkoYKI7 kYydH3llhOJASMW2p4TK4CwCmIN+PDr20CrNg0NCR5AdC7TMqq1RDVknkq5Yoi6i0LYR nWmQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:ui-outboundreport:content-transfer-encoding :mime-version:references:in-reply-to:message-id:date:subject:cc:to :from; bh=JK4xGcnayFbI5sxwc/4vs/SiYIfxPr/AFIou6AXHkss=; fh=c4ql7d5QsFreQmYQr7ycbAsMayBEmNUOv2nmR/PVp9M=; b=K33ohTGdH+mCl37NjqrRXWeKHwA5iQWNmK9q86mqbehWVr97097fthX6OqJnTtDe9c Y5cCWkUDDe8wXuxSpWoWReP1iOGYV4N2CK8UM+bcCaV63y7/WPTlsB4Yqympte9vHMon iJqJ94lJObc5NjU7Wu8/db8npr+6JrZAvA7UUh4rONyr1HDQgqkdKrNItlhTIXRQtNrG WP9WI1E16Kg3wRKlVjEl72feXGfNVlqsYXhG6StcajWEH7DRmT85Jipy1u7EVQnHZx0z CWcYFDubtJKwWryPsWNvnqBipf79DwzgT5h/uzF/wvEv3LbBm1OvqgTYH+I0nRG5Fat2 7QtQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=aisec.fraunhofer.de Received: from snail.vger.email (snail.vger.email. [2620:137:e000::3:7]) by mx.google.com with ESMTPS id by37-20020a056a0205a500b0059b64b153f6si2215581pgb.845.2023.10.18.03.52.15 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 18 Oct 2023 03:52:16 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) client-ip=2620:137:e000::3:7; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::3:7 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=fail (p=NONE sp=NONE dis=NONE) header.from=aisec.fraunhofer.de Received: from out1.vger.email (depot.vger.email [IPv6:2620:137:e000::3:0]) by snail.vger.email (Postfix) with ESMTP id 3176A81393D3; Wed, 18 Oct 2023 03:52:15 -0700 (PDT) X-Virus-Status: Clean X-Virus-Scanned: clamav-milter 0.103.10 at snail.vger.email Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235174AbjJRKwI (ORCPT + 24 others); Wed, 18 Oct 2023 06:52:08 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48992 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230526AbjJRKvc (ORCPT ); Wed, 18 Oct 2023 06:51:32 -0400 Received: from mout.kundenserver.de (mout.kundenserver.de [212.227.126.135]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8809F101; Wed, 18 Oct 2023 03:51:28 -0700 (PDT) Received: from weisslap.aisec.fraunhofer.de ([91.67.186.133]) by mrelayeu.kundenserver.de (mreue012 [212.227.15.167]) with ESMTPSA (Nemesis) id 1N8EdM-1rfLHD3yTI-014Buu; Wed, 18 Oct 2023 12:51:04 +0200 From: =?utf-8?q?Michael_Wei=C3=9F?= To: Alexander Mikhalitsyn , Christian Brauner , Alexei Starovoitov , Paul Moore Cc: Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Quentin Monnet , Alexander Viro , Miklos Szeredi , Amir Goldstein , "Serge E. Hallyn" , bpf@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, gyroidos@aisec.fraunhofer.de, =?utf-8?q?Mich?= =?utf-8?q?ael_Wei=C3=9F?= Subject: [RFC PATCH v2 11/14] vfs: Wire up security hooks for lsm-based device guard in userns Date: Wed, 18 Oct 2023 12:50:30 +0200 Message-Id: <20231018105033.13669-12-michael.weiss@aisec.fraunhofer.de> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20231018105033.13669-1-michael.weiss@aisec.fraunhofer.de> References: <20231018105033.13669-1-michael.weiss@aisec.fraunhofer.de> MIME-Version: 1.0 X-Provags-ID: V03:K1:QKuNcHsyjzZeVFhJge7r9EgZaJUd1hSQUNm5KrdnKw9WPc7MzKn oARcftJeCxBau0k8RbuFVQsbaKvoER/ApOI5iziIof3ikARFUAYuQ/e3CpGm2DvTbMneYjZ 3mAX2olG5AbqRXD86FY2w3uJ7IS/uhVx/WgvP8bUqG6rm8A9UyrXr2PJ8PYZ5hkTbfiuPsc R65uN8EIxjOlPB7Uel4gg== UI-OutboundReport: notjunk:1;M01:P0:UsmMmelH1QY=;Te31CKQmgxElaICDoMa60Hv9NZr V7G+LrLIi9tu0IPzzq2E4kLeXGgyZnPSxd4kOwZQGmR+qzhpNrEKSesPDqB/jdYVUzYevhqkU JasgoppivfgdH7GD47iRzHYMH+Ba3JEcNFoIcXGt313SnBMDRQMv32dBKGVzbx4kGSP9WhOFV nwfvj9+HHXgmUCEBukfuf9VNUDl2rdO7i83v1xmJl4Cg9O3MI3sANH3Ff7LjbbjJQwtshK7S4 q7Nco8SVY99bn3hIKBxk5TiEMWUYRB53apBZ8cT7RwjaN5LYFnIWdnOrUkGUPETqffBVymt+F xePopQ1rUUR+6t1U4kzi8E8LDVtjqQhSVTsf3lLxYMuRChNAnEMvLLLViyVCWQcOKiTrPj2NU vhV85ztJkAkDnQwv5oI3uPKPeDnDjKMmnYQfE9y9ZX8wKKzG9TKcGbe7EAi3jWyMoaqXZRuzk JbyzfpiiTzcnWM5QJugsTt+qPJoTEQvuPpVYy1JJT2/faj9V35B4fEJzZgQ1LkAld78JVwcD2 4tH4DE7joCdgoNdPIQsHTNIjfpMHrPjGs5uk4R8l6PWmKxwhdF8GYifopLp8HnrUcznBxqRmH jAbig9gTzAfKD/KLTCxrE2ORxhfyVvmaOw2oG028cicY/hXniY5taOu29c+l20ZiBHOkYr7QW zZmjytwe7FKRBT7p8jD9C90WMRXXDBn+UtKTiUATgzZhlxK2mGxvGXy4Ox94qvEDhpXQbaWam Ua3y7egjlnbF0P/3ji4700ALzjAYV5ZjlY++leIpVqA6Z5EZ18DL2XQCTrwjygDe9rcqNhCxm a/KNT4V6WtGUrp86t4Q/tXpHjkl/1iWtd/0bJUE8V/nGKq/Hf+3nm/4n0FitxEAER+klCFsL2 DZRdVItQ32YjjNA== X-Spam-Status: No, score=-1.2 required=5.0 tests=BAYES_00,RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H5,RCVD_IN_MSPIKE_WL,SPF_HELO_NONE,SPF_SOFTFAIL autolearn=no autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-Greylist: Sender passed SPF test, not delayed by milter-greylist-4.6.4 (snail.vger.email [0.0.0.0]); Wed, 18 Oct 2023 03:52:15 -0700 (PDT) X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1780090232905595940 X-GMAIL-MSGID: 1780090232905595940 Wire up security_inode_mknod_capns() in fs/namei.c. If implemented and access is granted by an lsm, check ns_capable() instead of the global CAP_MKNOD. Wire up security_sb_alloc_userns() in fs/super.c. If implemented and access is granted by an lsm, the created super block will allow access to device nodes also if it was created in a non-inital userns. Signed-off-by: Michael Weiß --- fs/namei.c | 16 +++++++++++++++- fs/super.c | 6 +++++- 2 files changed, 20 insertions(+), 2 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index f601fcbdc4d2..1f68d160e2c0 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -3949,6 +3949,20 @@ inline struct dentry *user_path_create(int dfd, const char __user *pathname, } EXPORT_SYMBOL(user_path_create); +static bool mknod_capable(struct inode *dir, struct dentry *dentry, + umode_t mode, dev_t dev) +{ + /* + * In case of a security hook implementation check mknod in user + * namespace. Otherwise just check global capability. + */ + int error = security_inode_mknod_nscap(dir, dentry, mode, dev); + if (!error) + return ns_capable(current_user_ns(), CAP_MKNOD); + else + return capable(CAP_MKNOD); +} + /** * vfs_mknod - create device node or file * @idmap: idmap of the mount the inode was found from @@ -3975,7 +3989,7 @@ int vfs_mknod(struct mnt_idmap *idmap, struct inode *dir, return error; if ((S_ISCHR(mode) || S_ISBLK(mode)) && !is_whiteout && - !capable(CAP_MKNOD)) + !mknod_capable(dir, dentry, mode, dev)) return -EPERM; if (!dir->i_op->mknod) diff --git a/fs/super.c b/fs/super.c index 2d762ce67f6e..bb01db6d9986 100644 --- a/fs/super.c +++ b/fs/super.c @@ -362,7 +362,11 @@ static struct super_block *alloc_super(struct file_system_type *type, int flags, } s->s_bdi = &noop_backing_dev_info; s->s_flags = flags; - if (s->s_user_ns != &init_user_ns) + /* + * We still have to think about this here. Several concerns exist + * about the security model, especially about malicious fuse. + */ + if (s->s_user_ns != &init_user_ns && security_sb_alloc_userns(s)) s->s_iflags |= SB_I_NODEV; INIT_HLIST_NODE(&s->s_instances); INIT_HLIST_BL_HEAD(&s->s_roots);