From patchwork Sat Feb 3 10:52:54 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tetsuo Handa X-Patchwork-Id: 196243 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:9bc1:b0:106:209c:c626 with SMTP id op1csp956236dyc; Sat, 3 Feb 2024 02:54:36 -0800 (PST) X-Google-Smtp-Source: AGHT+IG7mG4tOInGR11SrK6HuME4UDsAqzhvvbmMVY1bhR9mQ4DA3JO9dnfrrp8AuAkkHPr/rAr2 X-Received: by 2002:a05:6a00:670c:b0:6e0:2fa2:5280 with SMTP id hm12-20020a056a00670c00b006e02fa25280mr381260pfb.7.1706957676115; Sat, 03 Feb 2024 02:54:36 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1706957676; cv=pass; d=google.com; s=arc-20160816; b=JOfwAD3JqH4ynssqA4JVJJ8KLHeUAJ+CSwQl75bjG3CXUrNfphzSDpK5uzmasBWstF imgJ5XPscCIaSNVH10Jkdiw+slS2OqOIpmJyx1zr4+xxrLKZ4iB1QlL/UTCTCtC02fnr 8MM2M7tscpRVzAyOjymvLnsoFckzprqbZo4oWVNafQw+zOZbttMk/Y6++xOp+xwqzXIp zoPfHYfy7Atj8jo19pKVBLxGD017UNKIh0FXuJd6uXos2QBoovrPo6Mmu9Z95tL2KsDx E+Oq3KmaZ6KjIxmh5ju/g8e+DRgsY7heK/lJRykc21mYkVjl+d95JbBnTITH863E01G4 5gLQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:in-reply-to:references:cc:to:from :content-language:subject:user-agent:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:date:message-id; bh=eyzkI9KRM4oFmcnSoKD7+j+7OX1cpzdu3vTzRqgPdkI=; fh=mWfKK1N/B27kkRlvoV59PHuZBCewWIsj2V5yvZ5Cc0g=; b=gWUbfM3LaJOQhAjG3vAr71yD+gUrPVYJkUDx51H3IJM+QJqhgU76yk0FKaqk5t4jsZ TaSNqVs+1iAZ1LGIhQoudVut58Ttcfh0jLFMsjTDMh4lLYM2JS0Rpq0wPkDr5zFKw71h CMCplAtiWeb+fyWX+9XKNRigP3j27oyGvFy+fV/rHs18z9bVXfpMO9ty776LNSdGiCSK GUpRo44Op8lhJ5GF3eutXm52ipiqTmwy9yuhKdBx7q56Mi4KkFtgSbHX3poFW+g+RZg+ pp0ZkgPYrdTWGSppVHTXzgP3lSbjZy2MsL5SspNM86XNBMdY93Q6128ucCu9L6G1pB0c k/sQ==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; arc=pass (i=1 spf=pass spfdomain=i-love.sakura.ne.jp); spf=pass (google.com: domain of linux-kernel+bounces-51033-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-51033-ouuuleilei=gmail.com@vger.kernel.org" X-Forwarded-Encrypted: i=1; AJvYcCWm5huawaTuTO1GB6DdumvhZsrCSWsJXuRaNVVPw+pG46DudvR1JM8cwjmrVWW/+onCTaDGbzJd4jqMscTfWefuBZMQ4A== Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [2604:1380:45e3:2400::1]) by mx.google.com with ESMTPS id j7-20020a634a47000000b005cdfd6f30a0si3016443pgl.748.2024.02.03.02.54.35 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Feb 2024 02:54:36 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-51033-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1; Authentication-Results: mx.google.com; arc=pass (i=1 spf=pass spfdomain=i-love.sakura.ne.jp); spf=pass (google.com: domain of linux-kernel+bounces-51033-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-51033-ouuuleilei=gmail.com@vger.kernel.org" Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 947F128A948 for ; Sat, 3 Feb 2024 10:54:08 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id B3A525DF2C; Sat, 3 Feb 2024 10:53:30 +0000 (UTC) Received: from www262.sakura.ne.jp (www262.sakura.ne.jp [202.181.97.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 812955D8E1; Sat, 3 Feb 2024 10:53:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.181.97.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706957608; cv=none; b=X3rif85nL3IVFtHRp87PVVxzs/gZs0CwOs93SWyzVibBMgOUV5g85UzN3sljMPvP5PA6Q1/modZ5+VOm+D2wVDMyL2bH7+tZIRoXEKIl8K3EAnCy9f0nhiexJ0YyCrZs5xzAMn9UyjpK2FhnppJHzwO5y2PJnZXDf0qylvZudtg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706957608; c=relaxed/simple; bh=mh230nw9C+CMlZ+KBHNN6+L7nuVm0C8xivOOp+Zjens=; h=Message-ID:Date:MIME-Version:Subject:From:To:Cc:References: In-Reply-To:Content-Type; b=dfkiCIAQHMdFFU+MpRNUYmvHgvwOSkBLgro9mGeETtt/8KnPvUpqWlTwKlLUT5/mzCGmlLyzFMIvx5VDoaNLt1+tDXdi5H6k/aLt3U9KidGLKmRoDnnqkmmrDEmG1FMY9P9N4fqRj1OijFLAXkoK9vHvs0CVvoGlElEY2IJ3HEw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=I-love.SAKURA.ne.jp; spf=pass smtp.mailfrom=I-love.SAKURA.ne.jp; arc=none smtp.client-ip=202.181.97.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=I-love.SAKURA.ne.jp Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=I-love.SAKURA.ne.jp Received: from fsav120.sakura.ne.jp (fsav120.sakura.ne.jp [27.133.134.247]) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTP id 413Aqsi8052538; Sat, 3 Feb 2024 19:52:55 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Received: from www262.sakura.ne.jp (202.181.97.72) by fsav120.sakura.ne.jp (F-Secure/fsigk_smtp/550/fsav120.sakura.ne.jp); Sat, 03 Feb 2024 19:52:54 +0900 (JST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/fsav120.sakura.ne.jp) Received: from [192.168.1.6] (M106072142033.v4.enabler.ne.jp [106.72.142.33]) (authenticated bits=0) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTPSA id 413AqOqw052397 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NO); Sat, 3 Feb 2024 19:52:54 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Message-ID: <999a4733-c554-43ca-a6e9-998c939fbeb8@I-love.SAKURA.ne.jp> Date: Sat, 3 Feb 2024 19:52:54 +0900 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: [PATCH v2 1/3] LSM: add security_execve_abort() hook Content-Language: en-US From: Tetsuo Handa To: Linus Torvalds , Eric Biederman , Kees Cook , Alexander Viro , Christian Brauner , Jan Kara , Paul Moore , James Morris , "Serge E. Hallyn" Cc: linux-security-module , linux-fsdevel , LKML References: <8fafb8e1-b6be-4d08-945f-b464e3a396c8@I-love.SAKURA.ne.jp> In-Reply-To: <8fafb8e1-b6be-4d08-945f-b464e3a396c8@I-love.SAKURA.ne.jp> X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1789874852279051764 X-GMAIL-MSGID: 1789874852279051764 A regression caused by commit 978ffcbf00d8 ("execve: open the executable file before doing anything else") has been fixed by commit 4759ff71f23e ("exec: Check __FMODE_EXEC instead of in_execve for LSMs") and commit 3eab830189d9 ("uselib: remove use of __FMODE_EXEC"). While fixing this regression, Linus commented that we want to remove current->in_execve flag. The current->in_execve flag was introduced by commit f9ce1f1cda8b ("Add in_execve flag into task_struct.") when TOMOYO LSM was merged, and the reason was explained in commit f7433243770c ("LSM adapter functions."). In short, TOMOYO's design is not compatible with COW credential model introduced in Linux 2.6.29, and the current->in_execve flag was added for emulating security_bprm_free() hook which has been removed by introduction of COW credential model. security_task_alloc()/security_task_free() hooks have been removed by commit f1752eec6145 ("CRED: Detach the credentials from task_struct"), and these hooks have been revived by commit 1a2a4d06e1e9 ("security: create task_free security callback") and commit e4e55b47ed9a ("LSM: Revive security_task_alloc() hook and per "struct task_struct" security blob."). But security_bprm_free() hook did not revive until now. Now that Linus wants TOMOYO to stop carrying state across two independent execve() calls, and TOMOYO can stop carrying state if a hook for restoring previous state upon failed execve() call were provided, this patch revives the hook. Since security_bprm_committing_creds() and security_bprm_committed_creds() hooks are called when an execve() request succeeded, we don't need to call security_bprm_free() hook when an execve() request succeeded. Therefore, this patch adds security_execve_abort() hook which is called only when an execve() request failed after successful prepare_bprm_creds() call. Signed-off-by: Tetsuo Handa Reviewed-by: Kees Cook --- fs/exec.c | 1 + include/linux/lsm_hook_defs.h | 1 + include/linux/security.h | 5 +++++ security/security.c | 11 +++++++++++ 4 files changed, 18 insertions(+) diff --git a/fs/exec.c b/fs/exec.c index af4fbb61cd53..d6d35a06fd08 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1521,6 +1521,7 @@ static void free_bprm(struct linux_binprm *bprm) if (bprm->cred) { mutex_unlock(¤t->signal->cred_guard_mutex); abort_creds(bprm->cred); + security_execve_abort(); } do_close_execat(bprm->file); if (bprm->executable) diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index 76458b6d53da..fd100ab71a33 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -54,6 +54,7 @@ LSM_HOOK(int, 0, bprm_creds_from_file, struct linux_binprm *bprm, const struct f LSM_HOOK(int, 0, bprm_check_security, struct linux_binprm *bprm) LSM_HOOK(void, LSM_RET_VOID, bprm_committing_creds, const struct linux_binprm *bprm) LSM_HOOK(void, LSM_RET_VOID, bprm_committed_creds, const struct linux_binprm *bprm) +LSM_HOOK(void, LSM_RET_VOID, execve_abort, void) LSM_HOOK(int, 0, fs_context_submount, struct fs_context *fc, struct super_block *reference) LSM_HOOK(int, 0, fs_context_dup, struct fs_context *fc, struct fs_context *src_sc) diff --git a/include/linux/security.h b/include/linux/security.h index d0eb20f90b26..31532b30c4f0 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -299,6 +299,7 @@ int security_bprm_creds_from_file(struct linux_binprm *bprm, const struct file * int security_bprm_check(struct linux_binprm *bprm); void security_bprm_committing_creds(const struct linux_binprm *bprm); void security_bprm_committed_creds(const struct linux_binprm *bprm); +void security_execve_abort(void); int security_fs_context_submount(struct fs_context *fc, struct super_block *reference); int security_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc); int security_fs_context_parse_param(struct fs_context *fc, struct fs_parameter *param); @@ -648,6 +649,10 @@ static inline void security_bprm_committed_creds(const struct linux_binprm *bprm { } +static inline void security_execve_abort(void) +{ +} + static inline int security_fs_context_submount(struct fs_context *fc, struct super_block *reference) { diff --git a/security/security.c b/security/security.c index 3aaad75c9ce8..10adc4d3c5e0 100644 --- a/security/security.c +++ b/security/security.c @@ -1223,6 +1223,17 @@ void security_bprm_committed_creds(const struct linux_binprm *bprm) call_void_hook(bprm_committed_creds, bprm); } +/** + * security_execve_abort() - Notify that exec() has failed + * + * This hook is for undoing changes which cannot be discarded by + * abort_creds(). + */ +void security_execve_abort(void) +{ + call_void_hook(execve_abort); +} + /** * security_fs_context_submount() - Initialise fc->security * @fc: new filesystem context From patchwork Sat Feb 3 10:53:17 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tetsuo Handa X-Patchwork-Id: 196245 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:9bc1:b0:106:209c:c626 with SMTP id op1csp968688dyc; Sat, 3 Feb 2024 03:27:47 -0800 (PST) X-Google-Smtp-Source: AGHT+IFWjQf/qi9hy/GBgu+rw44jPtN4Z5IGlWGlaoKQP5LzoUFfBYHMUd/Axj9rXY/ZN2Fhy61S X-Received: by 2002:a17:90a:8a88:b0:290:4b14:3638 with SMTP id x8-20020a17090a8a8800b002904b143638mr1679153pjn.12.1706959666868; Sat, 03 Feb 2024 03:27:46 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1706959666; cv=pass; d=google.com; s=arc-20160816; b=qE0Lc8HcOmHeaK/mSV3HzMlZwK1bQ6RN0KMp4Sr4DcjFnP3N1Y8K10XXedms9czid5 ln2K+eXc54udVDQGnDMKsjQfvCg5BB+EuNPF/Ran8JiWXYmC7an8FLbfoqT744Q20c7Y LHLgZnnMsS1k4Qe9z2XYeZt743t+dIjKXqOWzU1U+X5nHOnJuT6v1Lj+WeOEkwWLKOL8 Ef/8egwUhwV+9aSlq85k6zwxjAdM0nxy8IceUhpMUyTwwOnGJMqUg4hX65/orXhfu7Ot EanNJMEU2Vc7gm/pGc/yHvgVWfMvVUtB27LeOPD6LBWERfDntP43+CLDb9RFquDls3YT EYWw== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:in-reply-to:references:cc:to:from :content-language:subject:user-agent:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:date:message-id; bh=K0leJ6Kg3818PgmLqi0IpvKfy8hFpOL/WDhm29pZJnw=; fh=Sdtu4TQioXpFWIJYyOUaBjFpyVttZfEGlcUyKVxDBQc=; b=gqQno2RpXehheR6NTu5gP4na3JOCmsbjFjdtj1McGjc9Lci/zyRyoGK+d/kc/3XgKl b3lzosPDn5LHtQGCw0t5V+HwgBzSkWE5M9A2Une4ZmY2WlzJXKWB9BHCHJfk6x+XYOZ9 NlKiOb3pb5FyntEbX5ZTfzdRS1broXhHgr7JUcFHUHTLhyvcnz0O1wR/Q3qiHJrASRxj tOuKBDwqjGfYYbt3djVG+Ge6ppHM35C7yE02vJtT29Q0me7rE2f945UUx6tl3FvBFG5v SfqNSXkMf0ETvKZVpIeMwXY7YFagGmygMCGXZM6uyXM/vdaULL/6srgYfn+gT58p5B5M GEkw==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; arc=pass (i=1 spf=pass spfdomain=i-love.sakura.ne.jp); spf=pass (google.com: domain of linux-kernel+bounces-51034-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-51034-ouuuleilei=gmail.com@vger.kernel.org" X-Forwarded-Encrypted: i=1; AJvYcCUqee/MQCYhpSiGuQhSeXHPf8zOEsrVCjY09ddD/uTRHDYfw4uiZnmM37/F+pM1vdHfNT6DiDPL+VR3mgG3frf255INSA== Received: from sy.mirrors.kernel.org (sy.mirrors.kernel.org. [2604:1380:40f1:3f00::1]) by mx.google.com with ESMTPS id ce14-20020a17090aff0e00b00290bb3c8792si1419457pjb.124.2024.02.03.03.27.46 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Feb 2024 03:27:46 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-51034-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) client-ip=2604:1380:40f1:3f00::1; Authentication-Results: mx.google.com; arc=pass (i=1 spf=pass spfdomain=i-love.sakura.ne.jp); spf=pass (google.com: domain of linux-kernel+bounces-51034-ouuuleilei=gmail.com@vger.kernel.org designates 2604:1380:40f1:3f00::1 as permitted sender) smtp.mailfrom="linux-kernel+bounces-51034-ouuuleilei=gmail.com@vger.kernel.org" Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sy.mirrors.kernel.org (Postfix) with ESMTPS id 5180EB23077 for ; Sat, 3 Feb 2024 10:54:29 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 37B5D5DF34; Sat, 3 Feb 2024 10:53:52 +0000 (UTC) Received: from www262.sakura.ne.jp (www262.sakura.ne.jp [202.181.97.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A211D5DF32; Sat, 3 Feb 2024 10:53:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.181.97.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706957622; cv=none; b=p7lT6xOcHihbtjLXyU0OvFkpwHkeMy5lokkv6QC6uHJ+A3GROr+yr0dRZOGCWo2fLvk0oIsMPcUG4CEIOjdEPbrDvERNLHN5F6zS6WmBndN7Xi6JX2ipDOhJ+1VMQT9w8mARdPTPVOqipTH+br28UQSbcCw/isuyL3sby4e1PcI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706957622; c=relaxed/simple; bh=8vqCj4OOBOrarMSM5zpD/UThJa847S4p6+egpVHsUbg=; h=Message-ID:Date:MIME-Version:Subject:From:To:Cc:References: In-Reply-To:Content-Type; b=tGHukq/WiLRf0CK56O5OlotMR6NA6/bbfDVomDHlzeZFy8yQKJzn8HiKcZVocd9xd161NfICqvkD1SZ4yzzun9cR+FveBuP5/tZh1NQJ3vucycUEl/j6xdG2oHB1YOmDi+eKot60eDHYEdLVyERCT1AMMLzgvKXyGq9dOFuIH+Y= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=I-love.SAKURA.ne.jp; spf=pass smtp.mailfrom=I-love.SAKURA.ne.jp; arc=none smtp.client-ip=202.181.97.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=I-love.SAKURA.ne.jp Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=I-love.SAKURA.ne.jp Received: from fsav413.sakura.ne.jp (fsav413.sakura.ne.jp [133.242.250.112]) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTP id 413ArIfe052647; Sat, 3 Feb 2024 19:53:18 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Received: from www262.sakura.ne.jp (202.181.97.72) by fsav413.sakura.ne.jp (F-Secure/fsigk_smtp/550/fsav413.sakura.ne.jp); Sat, 03 Feb 2024 19:53:18 +0900 (JST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/fsav413.sakura.ne.jp) Received: from [192.168.1.6] (M106072142033.v4.enabler.ne.jp [106.72.142.33]) (authenticated bits=0) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTPSA id 413AqOqx052397 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NO); Sat, 3 Feb 2024 19:53:17 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Message-ID: <2a901d27-dba5-4ff4-9e47-373c54965253@I-love.SAKURA.ne.jp> Date: Sat, 3 Feb 2024 19:53:17 +0900 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: [PATCH v2 2/3] tomoyo: replace current->in_execve flag with security_execve_abort() hook Content-Language: en-US From: Tetsuo Handa To: Linus Torvalds , Eric Biederman , Kees Cook , Alexander Viro , Christian Brauner , Jan Kara , Paul Moore , James Morris , "Serge E. Hallyn" Cc: linux-security-module , linux-fsdevel , LKML References: <8fafb8e1-b6be-4d08-945f-b464e3a396c8@I-love.SAKURA.ne.jp> In-Reply-To: <8fafb8e1-b6be-4d08-945f-b464e3a396c8@I-love.SAKURA.ne.jp> X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1789876939564191248 X-GMAIL-MSGID: 1789876939564191248 TOMOYO was using current->in_execve flag in order to restore previous state when previous execve() request failed. Since security_execve_abort() hook was added, switch to use it. Signed-off-by: Tetsuo Handa Reviewed-by: Kees Cook --- security/tomoyo/tomoyo.c | 22 ++++++---------------- 1 file changed, 6 insertions(+), 16 deletions(-) diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c index 04a92c3d65d4..9da11aaffeb9 100644 --- a/security/tomoyo/tomoyo.c +++ b/security/tomoyo/tomoyo.c @@ -18,34 +18,24 @@ struct tomoyo_domain_info *tomoyo_domain(void) { struct tomoyo_task *s = tomoyo_task(current); - if (s->old_domain_info && !current->in_execve) { - atomic_dec(&s->old_domain_info->users); - s->old_domain_info = NULL; - } return s->domain_info; } /** - * tomoyo_cred_prepare - Target for security_prepare_creds(). - * - * @new: Pointer to "struct cred". - * @old: Pointer to "struct cred". - * @gfp: Memory allocation flags. + * tomoyo_execve_abort - Target for security_execve_abort(). * - * Returns 0. + * @bprm: void */ -static int tomoyo_cred_prepare(struct cred *new, const struct cred *old, - gfp_t gfp) +static void tomoyo_execve_abort(void) { - /* Restore old_domain_info saved by previous execve() request. */ + /* Restore old_domain_info saved by execve() request. */ struct tomoyo_task *s = tomoyo_task(current); - if (s->old_domain_info && !current->in_execve) { + if (s->old_domain_info) { atomic_dec(&s->domain_info->users); s->domain_info = s->old_domain_info; s->old_domain_info = NULL; } - return 0; } /** @@ -554,8 +544,8 @@ static const struct lsm_id tomoyo_lsmid = { * registering TOMOYO. */ static struct security_hook_list tomoyo_hooks[] __ro_after_init = { - LSM_HOOK_INIT(cred_prepare, tomoyo_cred_prepare), LSM_HOOK_INIT(bprm_committed_creds, tomoyo_bprm_committed_creds), + LSM_HOOK_INIT(execve_abort, tomoyo_execve_abort), LSM_HOOK_INIT(task_alloc, tomoyo_task_alloc), LSM_HOOK_INIT(task_free, tomoyo_task_free), #ifndef CONFIG_SECURITY_TOMOYO_OMIT_USERSPACE_LOADER From patchwork Sat Feb 3 10:53:39 2024 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Tetsuo Handa X-Patchwork-Id: 196244 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a05:7301:9bc1:b0:106:209c:c626 with SMTP id op1csp956317dyc; Sat, 3 Feb 2024 02:54:56 -0800 (PST) X-Google-Smtp-Source: AGHT+IF/qKTJX1OWaXygGfgKbN3bcigPN7QKkc1Y5fJJu8ZD0gyYO5apoT9L6tal1N568OG7Hca9 X-Received: by 2002:a17:90a:4a85:b0:296:44f1:e19e with SMTP id f5-20020a17090a4a8500b0029644f1e19emr3201541pjh.22.1706957696339; Sat, 03 Feb 2024 02:54:56 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1706957696; cv=pass; d=google.com; s=arc-20160816; b=l3N7BhyMKuhTU7nZRjQzf5UBlieKZEKRi1VCJzcXJjPcZzGY+DEmHgf2XD88yhwYW9 5pumGEEf3NKRaCDve3ruen2g4n6gI769c9/TGqIn/+kYHkMYgGCC3TS//8zOVPQ1zqrs j4c5HfNF0qYfOrtTknwzFiQ+pXO+jn0iguo5NfG1A8InwoLmnES5+HStSR0UXO5KK54N 5AeDhmf+H0SWP40cTjCBGXyVZdJhdd87/2oIkHbW/6hAHJfYRHI6xEgz7YuyvBXzDTJh 9bj+ZNLzEZeYr3gJ6ZxGpfXGa/PDDnV0NWFXBxDiMKYCoBjOYD9dztAZ1RJTtOEDdUgi p4YQ== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:in-reply-to:references:cc:to:from :content-language:subject:user-agent:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:date:message-id; bh=P/PY6cDmgJ0N1DoI5AVz2Z9ojvFQmgDsk5JnB4/Msqs=; fh=TlLtNNbfcUYT/9XeQrR21p2bQMG4nBjH4kBBHVyEJXA=; b=bX7tOL0rfZZqfdLJt3qzaCFv7dUK3qbijFI/SCdVp7uSGY4tCXAO1UEUsRtazRq91i kygyyD1VFWbVhqLmXnLKmEWywMf5xT8i/m38rhQp8gbjTiqkN+CsuqE88JtS29aTl36E lUZRagMTlMav89r7naz2QtaxWpO41mzIAVrm4p5rtPAWf/5Ch72EeXqtfdjT4Aiynj9i URATZzSk/XyVWYT8nA6p1jc0l2cZdF/ABMk4rCIUSEeXojg8G3WrJd3etYuX9Fl9gYdI Ui7oVq/xXop2mTGhkUnpcr6a/KufQMDABlSEg+5QDvKE2y4Q1oNTG28Cj3DxwgupL6bz A1cA==; dara=google.com ARC-Authentication-Results: i=2; mx.google.com; arc=pass (i=1 spf=pass spfdomain=i-love.sakura.ne.jp); spf=pass (google.com: domain of linux-kernel+bounces-51035-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-51035-ouuuleilei=gmail.com@vger.kernel.org" X-Forwarded-Encrypted: i=1; AJvYcCVrOxS/wkR+YP6DbwV+HwgvIA9wGUCPf0HwHXFRCEcIXqgRqHDKlv73pzCB0fEt/IkTeS8HcR0opZaTa1i4U0OZh7JVtg== Received: from sv.mirrors.kernel.org (sv.mirrors.kernel.org. [139.178.88.99]) by mx.google.com with ESMTPS id g12-20020a170902740c00b001d909321bffsi3019551pll.295.2024.02.03.02.54.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 03 Feb 2024 02:54:56 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel+bounces-51035-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99; Authentication-Results: mx.google.com; arc=pass (i=1 spf=pass spfdomain=i-love.sakura.ne.jp); spf=pass (google.com: domain of linux-kernel+bounces-51035-ouuuleilei=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) smtp.mailfrom="linux-kernel+bounces-51035-ouuuleilei=gmail.com@vger.kernel.org" Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by sv.mirrors.kernel.org (Postfix) with ESMTPS id 00154286BD0 for ; Sat, 3 Feb 2024 10:54:48 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 31E1F5D720; Sat, 3 Feb 2024 10:54:07 +0000 (UTC) Received: from www262.sakura.ne.jp (www262.sakura.ne.jp [202.181.97.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CCEBF482FF; Sat, 3 Feb 2024 10:54:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.181.97.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706957645; cv=none; b=X9gh7kl8ATI+1tyyBkFkm8c+/hu9IXw7cfH2/6v9ih6c3Ymu+SGfYco/mBu2ntzh6n5mMY6oYkv9twZ79BI/ZdD75rGDxvD5r+xCyZetam/icgNZUeX6/cnRbLtPYuka5A0SvjAH2EdmMTZTmt8RKRRESH+9aq+46o39bdadB2E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1706957645; c=relaxed/simple; bh=F+69FTeIjzSdatJi0VG2CjE/hSQPwZ6HCaeuaIWBHzw=; h=Message-ID:Date:MIME-Version:Subject:From:To:Cc:References: In-Reply-To:Content-Type; b=ANW0UvDLbWFxqo8uZAAYCKtkmlZkTZ05dJbyugP3uDD/hxs0XP77Pkk/FYHC9sMtpAVHim60Wc6cYX0xVTxwsHCK16Whhtb7WQwF6Nyp0mX6YwMLFRGsTBN6fH1gXcWOEa1/SgtY27dwhl80kwVk77Y3DrEzmVTLHRt14IXVuG8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=I-love.SAKURA.ne.jp; spf=pass smtp.mailfrom=I-love.SAKURA.ne.jp; arc=none smtp.client-ip=202.181.97.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=I-love.SAKURA.ne.jp Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=I-love.SAKURA.ne.jp Received: from fsav311.sakura.ne.jp (fsav311.sakura.ne.jp [153.120.85.142]) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTP id 413Arep7052729; Sat, 3 Feb 2024 19:53:40 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Received: from www262.sakura.ne.jp (202.181.97.72) by fsav311.sakura.ne.jp (F-Secure/fsigk_smtp/550/fsav311.sakura.ne.jp); Sat, 03 Feb 2024 19:53:40 +0900 (JST) X-Virus-Status: clean(F-Secure/fsigk_smtp/550/fsav311.sakura.ne.jp) Received: from [192.168.1.6] (M106072142033.v4.enabler.ne.jp [106.72.142.33]) (authenticated bits=0) by www262.sakura.ne.jp (8.15.2/8.15.2) with ESMTPSA id 413AqOr0052397 (version=TLSv1.2 cipher=AES256-GCM-SHA384 bits=256 verify=NO); Sat, 3 Feb 2024 19:53:39 +0900 (JST) (envelope-from penguin-kernel@I-love.SAKURA.ne.jp) Message-ID: Date: Sat, 3 Feb 2024 19:53:39 +0900 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: [PATCH v2 3/3] fs/exec: remove current->in_execve flag Content-Language: en-US From: Tetsuo Handa To: Linus Torvalds , Eric Biederman , Kees Cook , Alexander Viro , Christian Brauner , Jan Kara , Paul Moore , James Morris , "Serge E. Hallyn" Cc: linux-security-module , linux-fsdevel , LKML References: <8fafb8e1-b6be-4d08-945f-b464e3a396c8@I-love.SAKURA.ne.jp> In-Reply-To: <8fafb8e1-b6be-4d08-945f-b464e3a396c8@I-love.SAKURA.ne.jp> X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-THRID: 1789874807713540365 X-GMAIL-MSGID: 1789874873288005633 Addition of security_execve_abort() hook made it possible to remove this flag. Signed-off-by: Tetsuo Handa Reviewed-by: Kees Cook --- fs/exec.c | 3 --- include/linux/sched.h | 3 --- 2 files changed, 6 deletions(-) diff --git a/fs/exec.c b/fs/exec.c index d6d35a06fd08..c197573b2940 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -1865,7 +1865,6 @@ static int bprm_execve(struct linux_binprm *bprm) * where setuid-ness is evaluated. */ check_unsafe_exec(bprm); - current->in_execve = 1; sched_mm_cid_before_execve(current); sched_exec(); @@ -1882,7 +1881,6 @@ static int bprm_execve(struct linux_binprm *bprm) sched_mm_cid_after_execve(current); /* execve succeeded */ current->fs->in_exec = 0; - current->in_execve = 0; rseq_execve(current); user_events_execve(current); acct_update_integrals(current); @@ -1901,7 +1899,6 @@ static int bprm_execve(struct linux_binprm *bprm) sched_mm_cid_after_execve(current); current->fs->in_exec = 0; - current->in_execve = 0; return retval; } diff --git a/include/linux/sched.h b/include/linux/sched.h index ffe8f618ab86..66ada87249b1 100644 --- a/include/linux/sched.h +++ b/include/linux/sched.h @@ -919,9 +919,6 @@ struct task_struct { #ifdef CONFIG_RT_MUTEXES unsigned sched_rt_mutex:1; #endif - - /* Bit to tell TOMOYO we're in execve(): */ - unsigned in_execve:1; unsigned in_iowait:1; #ifndef TIF_RESTORE_SIGMASK unsigned restore_sigmask:1;