2019-06-04 08:11:33 +00:00
|
|
|
/* SPDX-License-Identifier: GPL-2.0-only */
|
2005-04-16 22:20:36 +00:00
|
|
|
/*
|
|
|
|
* NSA Security-Enhanced Linux (SELinux) security module
|
|
|
|
*
|
|
|
|
* This file contains the SELinux security data structures for kernel objects.
|
|
|
|
*
|
2017-08-17 17:32:36 +00:00
|
|
|
* Author(s): Stephen Smalley, <sds@tycho.nsa.gov>
|
2008-04-22 21:46:10 +00:00
|
|
|
* Chris Vance, <cvance@nai.com>
|
|
|
|
* Wayne Salamon, <wsalamon@nai.com>
|
|
|
|
* James Morris <jmorris@redhat.com>
|
2005-04-16 22:20:36 +00:00
|
|
|
*
|
|
|
|
* Copyright (C) 2001,2002 Networks Associates Technology, Inc.
|
|
|
|
* Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
|
2017-05-19 12:48:56 +00:00
|
|
|
* Copyright (C) 2016 Mellanox Technologies
|
2005-04-16 22:20:36 +00:00
|
|
|
*/
|
|
|
|
#ifndef _SELINUX_OBJSEC_H_
|
|
|
|
#define _SELINUX_OBJSEC_H_
|
|
|
|
|
|
|
|
#include <linux/list.h>
|
|
|
|
#include <linux/sched.h>
|
|
|
|
#include <linux/fs.h>
|
|
|
|
#include <linux/binfmts.h>
|
|
|
|
#include <linux/in.h>
|
2006-11-17 22:38:53 +00:00
|
|
|
#include <linux/spinlock.h>
|
2018-11-12 17:30:56 +00:00
|
|
|
#include <linux/lsm_hooks.h>
|
2018-09-22 00:19:45 +00:00
|
|
|
#include <linux/msg.h>
|
2014-09-10 21:09:57 +00:00
|
|
|
#include <net/net_namespace.h>
|
2005-04-16 22:20:36 +00:00
|
|
|
#include "flask.h"
|
|
|
|
#include "avc.h"
|
|
|
|
|
|
|
|
struct task_security_struct {
|
2008-04-22 21:46:10 +00:00
|
|
|
u32 osid; /* SID prior to last execve */
|
|
|
|
u32 sid; /* current SID */
|
|
|
|
u32 exec_sid; /* exec SID */
|
|
|
|
u32 create_sid; /* fscreate SID */
|
|
|
|
u32 keycreate_sid; /* keycreate SID */
|
|
|
|
u32 sockcreate_sid; /* fscreate SID */
|
2019-12-13 20:28:38 +00:00
|
|
|
} __randomize_layout;
|
2005-04-16 22:20:36 +00:00
|
|
|
|
2015-12-24 16:09:40 +00:00
|
|
|
enum label_initialized {
|
2016-03-28 19:16:53 +00:00
|
|
|
LABEL_INVALID, /* invalid or not initialized */
|
selinux: Convert isec->lock into a spinlock
Convert isec->lock from a mutex into a spinlock. Instead of holding
the lock while sleeping in inode_doinit_with_dentry, set
isec->initialized to LABEL_PENDING and release the lock. Then, when
the sid has been determined, re-acquire the lock. If isec->initialized
is still set to LABEL_PENDING, set isec->sid; otherwise, the sid has
been set by another task (LABEL_INITIALIZED) or invalidated
(LABEL_INVALID) in the meantime.
This fixes a deadlock on gfs2 where
* one task is in inode_doinit_with_dentry -> gfs2_getxattr, holds
isec->lock, and tries to acquire the inode's glock, and
* another task is in do_xmote -> inode_go_inval ->
selinux_inode_invalidate_secctx, holds the inode's glock, and
tries to acquire isec->lock.
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
[PM: minor tweaks to keep checkpatch.pl happy]
Signed-off-by: Paul Moore <paul@paul-moore.com>
2016-11-15 10:06:40 +00:00
|
|
|
LABEL_INITIALIZED, /* initialized */
|
|
|
|
LABEL_PENDING
|
2015-12-24 16:09:40 +00:00
|
|
|
};
|
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
struct inode_security_struct {
|
2008-04-22 21:46:10 +00:00
|
|
|
struct inode *inode; /* back pointer to inode object */
|
2018-09-22 00:19:29 +00:00
|
|
|
struct list_head list; /* list of inode_security_struct */
|
2008-04-22 21:46:10 +00:00
|
|
|
u32 task_sid; /* SID of creating task */
|
|
|
|
u32 sid; /* SID of this object */
|
|
|
|
u16 sclass; /* security class of this object */
|
|
|
|
unsigned char initialized; /* initialization flag */
|
selinux: Convert isec->lock into a spinlock
Convert isec->lock from a mutex into a spinlock. Instead of holding
the lock while sleeping in inode_doinit_with_dentry, set
isec->initialized to LABEL_PENDING and release the lock. Then, when
the sid has been determined, re-acquire the lock. If isec->initialized
is still set to LABEL_PENDING, set isec->sid; otherwise, the sid has
been set by another task (LABEL_INITIALIZED) or invalidated
(LABEL_INVALID) in the meantime.
This fixes a deadlock on gfs2 where
* one task is in inode_doinit_with_dentry -> gfs2_getxattr, holds
isec->lock, and tries to acquire the inode's glock, and
* another task is in do_xmote -> inode_go_inval ->
selinux_inode_invalidate_secctx, holds the inode's glock, and
tries to acquire isec->lock.
Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
[PM: minor tweaks to keep checkpatch.pl happy]
Signed-off-by: Paul Moore <paul@paul-moore.com>
2016-11-15 10:06:40 +00:00
|
|
|
spinlock_t lock;
|
2005-04-16 22:20:36 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
struct file_security_struct {
|
2008-04-22 21:46:10 +00:00
|
|
|
u32 sid; /* SID of open file description */
|
|
|
|
u32 fown_sid; /* SID of file owner (for SIGIO) */
|
|
|
|
u32 isid; /* SID of inode at the time of file open */
|
|
|
|
u32 pseqno; /* Policy seqno at the time of file open */
|
2005-04-16 22:20:36 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
struct superblock_security_struct {
|
2006-07-10 11:43:53 +00:00
|
|
|
u32 sid; /* SID of file system superblock */
|
2005-04-16 22:20:36 +00:00
|
|
|
u32 def_sid; /* default SID for labeling */
|
2006-07-10 11:43:53 +00:00
|
|
|
u32 mntpoint_sid; /* SECURITY_FS_USE_MNTPOINT context for files */
|
2012-10-10 14:38:47 +00:00
|
|
|
unsigned short behavior; /* labeling behavior */
|
2012-10-09 20:20:08 +00:00
|
|
|
unsigned short flags; /* which mount options were specified */
|
2006-09-26 06:32:02 +00:00
|
|
|
struct mutex lock;
|
2005-04-16 22:20:36 +00:00
|
|
|
struct list_head isec_head;
|
|
|
|
spinlock_t isec_lock;
|
|
|
|
};
|
|
|
|
|
|
|
|
struct msg_security_struct {
|
2008-04-22 21:46:10 +00:00
|
|
|
u32 sid; /* SID of message */
|
2005-04-16 22:20:36 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
struct ipc_security_struct {
|
|
|
|
u16 sclass; /* security class of this object */
|
2008-04-22 21:46:10 +00:00
|
|
|
u32 sid; /* SID of IPC resource */
|
2005-04-16 22:20:36 +00:00
|
|
|
};
|
|
|
|
|
|
|
|
struct netif_security_struct {
|
2014-09-10 21:09:57 +00:00
|
|
|
struct net *ns; /* network namespace */
|
2008-01-29 13:38:08 +00:00
|
|
|
int ifindex; /* device index */
|
|
|
|
u32 sid; /* SID for this interface */
|
2005-04-16 22:20:36 +00:00
|
|
|
};
|
|
|
|
|
2008-01-29 13:38:13 +00:00
|
|
|
struct netnode_security_struct {
|
|
|
|
union {
|
|
|
|
__be32 ipv4; /* IPv4 node address */
|
|
|
|
struct in6_addr ipv6; /* IPv6 node address */
|
|
|
|
} addr;
|
|
|
|
u32 sid; /* SID for this node */
|
|
|
|
u16 family; /* address family */
|
|
|
|
};
|
|
|
|
|
2008-04-10 14:48:14 +00:00
|
|
|
struct netport_security_struct {
|
|
|
|
u32 sid; /* SID for this node */
|
|
|
|
u16 port; /* port number */
|
|
|
|
u8 protocol; /* transport protocol */
|
|
|
|
};
|
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
struct sk_security_struct {
|
2008-01-29 13:38:23 +00:00
|
|
|
#ifdef CONFIG_NETLABEL
|
2006-08-05 06:17:57 +00:00
|
|
|
enum { /* NetLabel state */
|
|
|
|
NLBL_UNSET = 0,
|
|
|
|
NLBL_REQUIRE,
|
|
|
|
NLBL_LABELED,
|
2008-10-10 14:16:32 +00:00
|
|
|
NLBL_REQSKB,
|
2008-10-10 14:16:33 +00:00
|
|
|
NLBL_CONNLABELED,
|
2006-08-05 06:17:57 +00:00
|
|
|
} nlbl_state;
|
2008-10-10 14:16:33 +00:00
|
|
|
struct netlbl_lsm_secattr *nlbl_secattr; /* NetLabel sec attributes */
|
2006-08-05 06:17:57 +00:00
|
|
|
#endif
|
2008-10-10 14:16:33 +00:00
|
|
|
u32 sid; /* SID of this object */
|
|
|
|
u32 peer_sid; /* SID of peer */
|
|
|
|
u16 sclass; /* sock security class */
|
2018-02-13 20:57:18 +00:00
|
|
|
enum { /* SCTP association state */
|
|
|
|
SCTP_ASSOC_UNSET = 0,
|
|
|
|
SCTP_ASSOC_SET,
|
|
|
|
} sctp_assoc_state;
|
2005-04-16 22:20:36 +00:00
|
|
|
};
|
|
|
|
|
2013-01-14 07:12:19 +00:00
|
|
|
struct tun_security_struct {
|
|
|
|
u32 sid; /* SID for the tun device sockets */
|
|
|
|
};
|
|
|
|
|
2006-06-22 21:47:17 +00:00
|
|
|
struct key_security_struct {
|
2008-04-22 21:46:10 +00:00
|
|
|
u32 sid; /* SID of key */
|
2006-06-22 21:47:17 +00:00
|
|
|
};
|
|
|
|
|
2017-05-19 12:48:56 +00:00
|
|
|
struct ib_security_struct {
|
|
|
|
u32 sid; /* SID of the queue pair or MAD agent */
|
|
|
|
};
|
|
|
|
|
2017-05-19 12:48:59 +00:00
|
|
|
struct pkey_security_struct {
|
|
|
|
u64 subnet_prefix; /* Port subnet prefix */
|
|
|
|
u16 pkey; /* PKey number */
|
|
|
|
u32 sid; /* SID of pkey */
|
|
|
|
};
|
|
|
|
|
2017-10-18 20:00:25 +00:00
|
|
|
struct bpf_security_struct {
|
perf_event: Add support for LSM and SELinux checks
In current mainline, the degree of access to perf_event_open(2) system
call depends on the perf_event_paranoid sysctl. This has a number of
limitations:
1. The sysctl is only a single value. Many types of accesses are controlled
based on the single value thus making the control very limited and
coarse grained.
2. The sysctl is global, so if the sysctl is changed, then that means
all processes get access to perf_event_open(2) opening the door to
security issues.
This patch adds LSM and SELinux access checking which will be used in
Android to access perf_event_open(2) for the purposes of attaching BPF
programs to tracepoints, perf profiling and other operations from
userspace. These operations are intended for production systems.
5 new LSM hooks are added:
1. perf_event_open: This controls access during the perf_event_open(2)
syscall itself. The hook is called from all the places that the
perf_event_paranoid sysctl is checked to keep it consistent with the
systctl. The hook gets passed a 'type' argument which controls CPU,
kernel and tracepoint accesses (in this context, CPU, kernel and
tracepoint have the same semantics as the perf_event_paranoid sysctl).
Additionally, I added an 'open' type which is similar to
perf_event_paranoid sysctl == 3 patch carried in Android and several other
distros but was rejected in mainline [1] in 2016.
2. perf_event_alloc: This allocates a new security object for the event
which stores the current SID within the event. It will be useful when
the perf event's FD is passed through IPC to another process which may
try to read the FD. Appropriate security checks will limit access.
3. perf_event_free: Called when the event is closed.
4. perf_event_read: Called from the read(2) and mmap(2) syscalls for the event.
5. perf_event_write: Called from the ioctl(2) syscalls for the event.
[1] https://lwn.net/Articles/696240/
Since Peter had suggest LSM hooks in 2016 [1], I am adding his
Suggested-by tag below.
To use this patch, we set the perf_event_paranoid sysctl to -1 and then
apply selinux checking as appropriate (default deny everything, and then
add policy rules to give access to domains that need it). In the future
we can remove the perf_event_paranoid sysctl altogether.
Suggested-by: Peter Zijlstra <peterz@infradead.org>
Co-developed-by: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Joel Fernandes (Google) <joel@joelfernandes.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Acked-by: James Morris <jmorris@namei.org>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: rostedt@goodmis.org
Cc: Yonghong Song <yhs@fb.com>
Cc: Kees Cook <keescook@chromium.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: jeffv@google.com
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: primiano@google.com
Cc: Song Liu <songliubraving@fb.com>
Cc: rsavitski@google.com
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Matthew Garrett <matthewgarrett@google.com>
Link: https://lkml.kernel.org/r/20191014170308.70668-1-joel@joelfernandes.org
2019-10-14 17:03:08 +00:00
|
|
|
u32 sid; /* SID of bpf obj creator */
|
|
|
|
};
|
|
|
|
|
|
|
|
struct perf_event_security_struct {
|
|
|
|
u32 sid; /* SID of perf_event obj creator */
|
2017-10-18 20:00:25 +00:00
|
|
|
};
|
|
|
|
|
2018-11-12 17:30:56 +00:00
|
|
|
extern struct lsm_blob_sizes selinux_blob_sizes;
|
2018-09-22 00:17:16 +00:00
|
|
|
static inline struct task_security_struct *selinux_cred(const struct cred *cred)
|
|
|
|
{
|
2018-11-12 17:30:56 +00:00
|
|
|
return cred->security + selinux_blob_sizes.lbs_cred;
|
2018-09-22 00:17:16 +00:00
|
|
|
}
|
|
|
|
|
2018-09-22 00:22:32 +00:00
|
|
|
static inline struct file_security_struct *selinux_file(const struct file *file)
|
|
|
|
{
|
2018-11-12 20:02:49 +00:00
|
|
|
return file->f_security + selinux_blob_sizes.lbs_file;
|
2018-09-22 00:22:32 +00:00
|
|
|
}
|
|
|
|
|
2018-09-22 00:19:11 +00:00
|
|
|
static inline struct inode_security_struct *selinux_inode(
|
|
|
|
const struct inode *inode)
|
|
|
|
{
|
2018-09-22 00:19:29 +00:00
|
|
|
if (unlikely(!inode->i_security))
|
|
|
|
return NULL;
|
|
|
|
return inode->i_security + selinux_blob_sizes.lbs_inode;
|
2018-09-22 00:19:11 +00:00
|
|
|
}
|
|
|
|
|
2018-09-22 00:19:45 +00:00
|
|
|
static inline struct msg_security_struct *selinux_msg_msg(
|
|
|
|
const struct msg_msg *msg_msg)
|
|
|
|
{
|
2018-11-20 19:55:02 +00:00
|
|
|
return msg_msg->security + selinux_blob_sizes.lbs_msg_msg;
|
2018-09-22 00:19:45 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline struct ipc_security_struct *selinux_ipc(
|
|
|
|
const struct kern_ipc_perm *ipc)
|
|
|
|
{
|
2018-11-20 19:55:02 +00:00
|
|
|
return ipc->security + selinux_blob_sizes.lbs_ipc;
|
2018-09-22 00:19:45 +00:00
|
|
|
}
|
|
|
|
|
2019-09-04 14:32:48 +00:00
|
|
|
/*
|
|
|
|
* get the subjective security ID of the current task
|
|
|
|
*/
|
|
|
|
static inline u32 current_sid(void)
|
|
|
|
{
|
|
|
|
const struct task_security_struct *tsec = selinux_cred(current_cred());
|
|
|
|
|
|
|
|
return tsec->sid;
|
|
|
|
}
|
|
|
|
|
2021-04-22 15:41:15 +00:00
|
|
|
static inline struct superblock_security_struct *selinux_superblock(
|
|
|
|
const struct super_block *superblock)
|
|
|
|
{
|
|
|
|
return superblock->s_security + selinux_blob_sizes.lbs_superblock;
|
|
|
|
}
|
|
|
|
|
2005-04-16 22:20:36 +00:00
|
|
|
#endif /* _SELINUX_OBJSEC_H_ */
|