summaryrefslogtreecommitdiff
path: root/security
AgeCommit message (Collapse)AuthorFilesLines
2017-06-11apparmor: move exec domain mediation to using labelsJohn Johansen2-259/+678
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: support v7 transition format compatible with label_parseJohn Johansen2-7/+15
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: mediate files when they are receivedJohn Johansen2-0/+7
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: rework file permission to cache file access in file->ctxJohn Johansen1-6/+76
This is a temporary step, towards using the file->ctx for delegation, and also helps speed up file queries, until the permission lookup cache is introduced. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: move path_link mediation to using labelsJohn Johansen3-47/+59
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: refactor path name lookup and permission checks around labelsJohn Johansen3-45/+85
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: update aa_audit_file() to use labelsJohn Johansen3-9/+18
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: move aa_file_perm() to use labelsJohn Johansen3-37/+64
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: allow ptrace checks to be finer grained than just capabilityJohn Johansen3-0/+68
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: move ptrace checks to using labelsJohn Johansen5-80/+58
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: add cross check permission helper macrosJohn Johansen1-1/+41
The cross check permission helper macros will help simplify code that does cross task permission checks like ptrace. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: move resource checks to using labelsJohn Johansen3-42/+80
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: move capability checks to using labelsJohn Johansen5-29/+58
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: update query interface to support label queriesJohn Johansen1-7/+39
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: switch getprocattr to using label_print fns()John Johansen3-37/+27
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: switch from profiles to using labels on contextsJohn Johansen20-529/+686
Begin the actual switch to using domain labels by storing them on the context and converting the label to a singular profile where possible. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: add the base fns() for domain labelsJohn Johansen2-0/+2561
Begin moving apparmor to using broader domain labels, that will allow run time computation of domain type splitting via "stacking" of profiles into a domain label vec. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: revalidate files during execJohn Johansen4-0/+81
Instead of running file revalidation lazily when read/write are called copy selinux and revalidate the file table on exec. This avoids extra mediation overhead in read/write and also prevents file handles being passed through to a grand child unchecked. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: cleanup rename XXX_file_context() to XXX_file_ctx()John Johansen2-11/+16
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: convert aa_change_XXX bool parameters to flagsJohn Johansen5-32/+29
Instead of passing multiple booleans consolidate on a single flags field. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: cleanup remove unused and not fully implemented profile renameJohn Johansen1-37/+2
Remove the partially implemented code, until this can be properly implemented. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: refactor updating profiles to the newest parentJohn Johansen1-4/+31
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: share profile name on replacementJohn Johansen3-9/+72
The profile names are the same, leverage this. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: convert to profile block critical sectionsJohn Johansen8-56/+162
There are still a few places where profile replacement fails to update and a stale profile is used for mediation. Fix this by moving to accessing the current label through a critical section that will always ensure mediation is using the current label regardless of whether the tasks cred has been updated or not. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: move bprm_committing_creds/committed_creds to lsm.cJohn Johansen3-32/+30
There is no reason to have the small stubs that don't use domain private functions in domain.c, instead move them to lsm.c and make them static. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: fix display of ns nameJohn Johansen1-1/+1
The ns name being displayed should go through an ns view lookup. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: fix apparmor_query dataJohn Johansen1-2/+6
The data being queried isn't always the current profile and a lookup relative to the current profile should be done. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: fix policy load/remove semanticsJohn Johansen2-15/+13
The namespace being passed into the replace/remove profiles fns() is not the view, but the namespace specified by the inode from the file hook (if present) or the loading tasks ns, if accessing the top level virtualized load/replace file interface. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: add namespace lookup fns()John Johansen3-4/+73
Currently lookups are restricted to a single ns component in the path. However when namespaces are allowed to have separate views, and scopes this will not be sufficient, as it will be possible to have a multiple component ns path in scope. Add some ns lookup fns() to allow this and use them. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: cleanup __find_child()John Johansen1-8/+8
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: provide information about path buffer size at bootJohn Johansen1-2/+9
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: add profile permission query abilityJohn Johansen1-1/+102
Allow userspace to query a profile about permissions, through the transaction interface that is already used to allow userspace to query about key,value data. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: switch from file_perms to aa_permsJohn Johansen5-48/+29
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: add gerneric permissions struct and support fnsJohn Johansen4-17/+153
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: add fn to test if profile supports a given mediation classJohn Johansen1-0/+10
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: speed up transactional queriesJohn Johansen1-11/+114
The simple_transaction interface is slow. It requires 4 syscalls (open, write, read, close) per query and shares a single lock for each queries. So replace its use with a compatible in multi_transaction interface. It allows for a faster 2 syscall pattern per query. After an initial open, an arbitrary number of writes and reads can be issued. Each write will reset the query with new data that can be read. Reads do not clear the data, and can be issued multiple times, and used with seek, until a new write is performed which will reset the data available and the seek position. Note: this keeps the single lock design, if needed moving to a per file lock will have to come later. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: add label data availability to the feature setJohn Johansen1-0/+10
gsettings mediation needs to be able to determine if apparmor supports label data queries. A label data query can be done to test for support but its failure is indistinguishable from other failures, making it an unreliable indicator. Fix by making support of label data queries available as a flag in the apparmorfs features dir tree. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: add mkdir/rmdir interface to manage policy namespacesJohn Johansen1-1/+94
When setting up namespaces for containers its easier for them to use an fs interface to create the namespace for the containers policy. Allow mkdir/rmdir under the policy/namespaces/ dir to be used to create and remove namespaces. BugLink: http://bugs.launchpad.net/bugs/1611078 Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: add policy revision file interfaceJohn Johansen4-1/+116
Add a policy revision file to find the current revision of a ns's policy. There is a revision file per ns, as well as a virtualized global revision file in the base apparmor fs directory. The global revision file when opened will provide the revision of the opening task namespace. The revision file can be waited on via select/poll to detect apparmor policy changes from the last read revision of the opened file. This means that the revision file must be read after the select/poll other wise update data will remain ready for reading. Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-11apparmor: provide finer control over policy managementJohn Johansen3-23/+35
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-09security/selinux: allow security_sb_clone_mnt_opts to enable/disable native ↵Scott Mayhew2-4/+38
labeling behavior When an NFSv4 client performs a mount operation, it first mounts the NFSv4 root and then does path walk to the exported path and performs a submount on that, cloning the security mount options from the root's superblock to the submount's superblock in the process. Unless the NFS server has an explicit fsid=0 export with the "security_label" option, the NFSv4 root superblock will not have SBLABEL_MNT set, and neither will the submount superblock after cloning the security mount options. As a result, setxattr's of security labels over NFSv4.2 will fail. In a similar fashion, NFSv4.2 mounts mounted with the context= mount option will not show the correct labels because the nfs_server->caps flags of the cloned superblock will still have NFS_CAP_SECURITY_LABEL set. Allowing the NFSv4 client to enable or disable SECURITY_LSM_NATIVE_LABELS behavior will ensure that the SBLABEL_MNT flag has the correct value when the client traverses from an exported path without the "security_label" option to one with the "security_label" option and vice versa. Similarly, checking to see if SECURITY_LSM_NATIVE_LABELS is set upon return from security_sb_clone_mnt_opts() and clearing NFS_CAP_SECURITY_LABEL if necessary will allow the correct labels to be displayed for NFSv4.2 mounts mounted with the context= mount option. Resolves: https://github.com/SELinuxProject/selinux-kernel/issues/35 Signed-off-by: Scott Mayhew <smayhew@redhat.com> Reviewed-by: Stephen Smalley <sds@tycho.nsa.gov> Tested-by: Stephen Smalley <sds@tycho.nsa.gov> Signed-off-by: Paul Moore <paul@paul-moore.com>
2017-06-09selinux: use kmem_cache for ebitmapJunil Lee3-6/+27
The allocated size for each ebitmap_node is 192byte by kzalloc(). Then, ebitmap_node size is fixed, so it's possible to use only 144byte for each object by kmem_cache_zalloc(). It can reduce some dynamic allocation size. Signed-off-by: Junil Lee <junil0814.lee@lge.com> Signed-off-by: Paul Moore <paul@paul-moore.com>
2017-06-09apparmor: rework perm mapping to a slightly broader setJohn Johansen5-53/+133
Signed-off-by: John Johansen <john.johansen@canonical.com>
2017-06-09KEYS: fix refcount_inc() on zeroMark Rutland1-7/+4
If a key's refcount is dropped to zero between key_lookup() peeking at the refcount and subsequently attempting to increment it, refcount_inc() will see a zero refcount. Here, refcount_inc() will WARN_ONCE(), and will *not* increment the refcount, which will remain zero. Once key_lookup() drops key_serial_lock, it is possible for the key to be freed behind our back. This patch uses refcount_inc_not_zero() to perform the peek and increment atomically. Fixes: fff292914d3a2f1e ("security, keys: convert key.usage from atomic_t to refcount_t") Signed-off-by: Mark Rutland <mark.rutland@arm.com> Signed-off-by: David Howells <dhowells@redhat.com> Cc: David Windsor <dwindsor@gmail.com> Cc: Elena Reshetova <elena.reshetova@intel.com> Cc: Hans Liljestrand <ishkamiel@gmail.com> Cc: James Morris <james.l.morris@oracle.com> Cc: Kees Cook <keescook@chromium.org> Cc: Peter Zijlstra <peterz@infradead.org> Signed-off-by: James Morris <james.l.morris@oracle.com>
2017-06-09KEYS: Convert KEYCTL_DH_COMPUTE to use the crypto KPP APIMat Martineau2-103/+171
The initial Diffie-Hellman computation made direct use of the MPI library because the crypto module did not support DH at the time. Now that KPP is implemented, KEYCTL_DH_COMPUTE should use it to get rid of duplicate code and leverage possible hardware acceleration. This fixes an issue whereby the input to the KDF computation would include additional uninitialized memory when the result of the Diffie-Hellman computation was shorter than the input prime number. Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
2017-06-09KEYS: DH: ensure the KDF counter is properly alignedEric Biggers1-13/+3
Accessing a 'u8[4]' through a '__be32 *' violates alignment rules. Just make the counter a __be32 instead. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Stephan Mueller <smueller@chronox.de> Signed-off-by: James Morris <james.l.morris@oracle.com>
2017-06-09KEYS: DH: don't feed uninitialized "otherinfo" into KDFEric Biggers1-1/+1
If userspace called KEYCTL_DH_COMPUTE with kdf_params containing NULL otherinfo but nonzero otherinfolen, the kernel would allocate a buffer for the otherinfo, then feed it into the KDF without initializing it. Fix this by always doing the copy from userspace (which will fail with EFAULT in this scenario). Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Stephan Mueller <smueller@chronox.de> Signed-off-by: James Morris <james.l.morris@oracle.com>
2017-06-09KEYS: DH: forbid using digest_null as the KDF hashEric Biggers1-1/+11
Requesting "digest_null" in the keyctl_kdf_params caused an infinite loop in kdf_ctr() because the "null" hash has a digest size of 0. Fix it by rejecting hash algorithms with a digest size of 0. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Stephan Mueller <smueller@chronox.de> Signed-off-by: James Morris <james.l.morris@oracle.com>
2017-06-09KEYS: sanitize key structs before freeingEric Biggers1-3/+1
While a 'struct key' itself normally does not contain sensitive information, Documentation/security/keys.txt actually encourages this: "Having a payload is not required; and the payload can, in fact, just be a value stored in the struct key itself." In case someone has taken this advice, or will take this advice in the future, zero the key structure before freeing it. We might as well, and as a bonus this could make it a bit more difficult for an adversary to determine which keys have recently been in use. This is safe because the key_jar cache does not use a constructor. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
2017-06-09KEYS: trusted: sanitize all key materialEric Biggers1-28/+22
As the previous patch did for encrypted-keys, zero sensitive any potentially sensitive data related to the "trusted" key type before it is freed. Notably, we were not zeroing the tpm_buf structures in which the actual key is stored for TPM seal and unseal, nor were we zeroing the trusted_key_payload in certain error paths. Cc: Mimi Zohar <zohar@linux.vnet.ibm.com> Cc: David Safford <safford@us.ibm.com> Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <james.l.morris@oracle.com>
generated by cgit v1.2.3 (git 2.39.0) at 2024-09-07 17:50:23 +0300