From: Paul Moore <paul@paul-moore.com>
To: "Christian Göttsche" <cgzones@googlemail.com>
Cc: selinux@vger.kernel.org,
Stephen Smalley <stephen.smalley.work@gmail.com>,
Eric Paris <eparis@parisplace.org>,
"David S. Miller" <davem@davemloft.net>,
Ondrej Mosnacek <omosnace@redhat.com>,
Jeremy Kerr <jk@codeconstruct.com.au>,
Xiong Zhenwu <xiong.zhenwu@zte.com.cn>,
Tyler Hicks <tyhicks@linux.microsoft.com>,
linux-kernel@vger.kernel.org, selinux-refpolicy@vger.kernel.org
Subject: Re: [RFC PATCH] selinux: split no transition execve check
Date: Wed, 26 Jan 2022 17:51:16 -0500 [thread overview]
Message-ID: <CAHC9VhTCf4L9rif-+7gTK64JoUiDv28DFwS1vUsvzv8rG+JCuQ@mail.gmail.com> (raw)
In-Reply-To: <20220125145931.56831-1-cgzones@googlemail.com>
On Tue, Jan 25, 2022 at 9:59 AM Christian Göttsche
<cgzones@googlemail.com> wrote:
>
> In case a setuid or setgid binary is mislabeled with a generic context,
> either via a policy mistake or a move by the distribution package,
> executing it will be checked by the file permission execute_no_trans on
> the generic file context (e.g. bin_t). The setuid(2)/setgid(2) syscall
> within will then be checked against the unchanged caller process
> context, which might have been granted the capability permission setuid/
> setgid to initially drop privileges. To avoid that scenario split the
> execute_no_trans permission in case of a setuid/setgid binary into a new
> permission execute_sxid_no_trans.
>
> For backward compatibility this behavior is contained in a new policy
> capability.
>
> Signed-off-by: Christian Göttsche <cgzones@googlemail.com>
> ---
> security/selinux/hooks.c | 9 ++++++++-
> security/selinux/include/classmap.h | 2 +-
> security/selinux/include/policycap.h | 1 +
> security/selinux/include/policycap_names.h | 3 ++-
> security/selinux/include/security.h | 8 ++++++++
> 5 files changed, 20 insertions(+), 3 deletions(-)
Adding the refpolicy list to this thread as their opinion seems
particularly relevant to this discussion.
FWIW, this looks reasonable to me but I would like to hear what others
have to say.
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 5b6895e4fc29..b825fee39a70 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -2348,9 +2348,16 @@ static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
> ad.u.file = bprm->file;
>
> if (new_tsec->sid == old_tsec->sid) {
> + u32 perm;
> +
> + if (selinux_policycap_execute_sxid_no_trans() && is_sxid(inode->i_mode))
> + perm = FILE__EXECUTE_SXID_NO_TRANS;
> + else
> + perm = FILE__EXECUTE_NO_TRANS;
> +
> rc = avc_has_perm(&selinux_state,
> old_tsec->sid, isec->sid,
> - SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
> + SECCLASS_FILE, perm, &ad);
> if (rc)
> return rc;
> } else {
> diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
> index 35aac62a662e..53a1eeeb86fb 100644
> --- a/security/selinux/include/classmap.h
> +++ b/security/selinux/include/classmap.h
> @@ -65,7 +65,7 @@ struct security_class_mapping secclass_map[] = {
> "quotaget", "watch", NULL } },
> { "file",
> { COMMON_FILE_PERMS,
> - "execute_no_trans", "entrypoint", NULL } },
> + "execute_no_trans", "entrypoint", "execute_sxid_no_trans", NULL } },
> { "dir",
> { COMMON_FILE_PERMS, "add_name", "remove_name",
> "reparent", "search", "rmdir", NULL } },
> diff --git a/security/selinux/include/policycap.h b/security/selinux/include/policycap.h
> index 2ec038efbb03..23929dc3e1db 100644
> --- a/security/selinux/include/policycap.h
> +++ b/security/selinux/include/policycap.h
> @@ -11,6 +11,7 @@ enum {
> POLICYDB_CAPABILITY_CGROUPSECLABEL,
> POLICYDB_CAPABILITY_NNP_NOSUID_TRANSITION,
> POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS,
> + POLICYDB_CAPABILITY_EXECUTE_SXID_NO_TRANS,
> __POLICYDB_CAPABILITY_MAX
> };
> #define POLICYDB_CAPABILITY_MAX (__POLICYDB_CAPABILITY_MAX - 1)
> diff --git a/security/selinux/include/policycap_names.h b/security/selinux/include/policycap_names.h
> index b89289f092c9..4c014c2cf352 100644
> --- a/security/selinux/include/policycap_names.h
> +++ b/security/selinux/include/policycap_names.h
> @@ -12,7 +12,8 @@ const char *selinux_policycap_names[__POLICYDB_CAPABILITY_MAX] = {
> "always_check_network",
> "cgroup_seclabel",
> "nnp_nosuid_transition",
> - "genfs_seclabel_symlinks"
> + "genfs_seclabel_symlinks",
> + "execute_sxid_no_trans",
> };
>
> #endif /* _SELINUX_POLICYCAP_NAMES_H_ */
> diff --git a/security/selinux/include/security.h b/security/selinux/include/security.h
> index ac0ece01305a..ab95241b6b7b 100644
> --- a/security/selinux/include/security.h
> +++ b/security/selinux/include/security.h
> @@ -219,6 +219,14 @@ static inline bool selinux_policycap_genfs_seclabel_symlinks(void)
> return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_GENFS_SECLABEL_SYMLINKS]);
> }
>
> +static inline bool selinux_policycap_execute_sxid_no_trans(void)
> +{
> + struct selinux_state *state = &selinux_state;
> +
> + return READ_ONCE(state->policycap[POLICYDB_CAPABILITY_EXECUTE_SXID_NO_TRANS]);
> +}
> +
> +
> struct selinux_policy_convert_data;
>
> struct selinux_load_state {
> --
> 2.34.1
>
--
paul-moore.com
next parent reply other threads:[~2022-01-26 22:51 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20220125145931.56831-1-cgzones@googlemail.com>
2022-01-26 22:51 ` Paul Moore [this message]
2022-01-27 13:42 ` [RFC PATCH] selinux: split no transition execve check Chris PeBenito
2022-01-28 1:47 ` Paul Moore
2023-07-22 15:13 ` Christian Göttsche
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=CAHC9VhTCf4L9rif-+7gTK64JoUiDv28DFwS1vUsvzv8rG+JCuQ@mail.gmail.com \
--to=paul@paul-moore.com \
--cc=cgzones@googlemail.com \
--cc=davem@davemloft.net \
--cc=eparis@parisplace.org \
--cc=jk@codeconstruct.com.au \
--cc=linux-kernel@vger.kernel.org \
--cc=omosnace@redhat.com \
--cc=selinux-refpolicy@vger.kernel.org \
--cc=selinux@vger.kernel.org \
--cc=stephen.smalley.work@gmail.com \
--cc=tyhicks@linux.microsoft.com \
--cc=xiong.zhenwu@zte.com.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).