[PATCH 21/27] SELinux: Verify LSM display sanity in binder
STALE2621d
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2019-07-26 23:40:02
Also in:
selinux
Subsystem:
selinux security module, the rest · Maintainers:
Paul Moore, Stephen Smalley, Linus Torvalds
Revision v5 of 47 in this series.
Revisions (47)
- v1 [diff vs current]
- v1 [diff vs current]
- v1 [diff vs current]
- v1 [diff vs current]
- v1 [diff vs current]
- v2 [diff vs current]
- v3 [diff vs current]
- v4 [diff vs current]
- v5 [diff vs current]
- v5 current
- v7 [diff vs current]
- v8 [diff vs current]
- v10 [diff vs current]
- v10 [diff vs current]
- v11 [diff vs current]
- v11 [diff vs current]
- v11 [diff vs current]
- v11 [diff vs current]
- v12 [diff vs current]
- v12 [diff vs current]
- v13 [diff vs current]
- v14 [diff vs current]
- v15 [diff vs current]
- v16 [diff vs current]
- v17 [diff vs current]
- v18 [diff vs current]
- v19 [diff vs current]
- v20 [diff vs current]
- v21 [diff vs current]
- v22 [diff vs current]
- v22 [diff vs current]
- v24 [diff vs current]
- v25 [diff vs current]
- v26 [diff vs current]
- v27 [diff vs current]
- v28 [diff vs current]
- v29 [diff vs current]
- v30 [diff vs current]
- v31 [diff vs current]
- v32 [diff vs current]
- v33 [diff vs current]
- v34 [diff vs current]
- v34 [diff vs current]
- v35 [diff vs current]
- v36 [diff vs current]
- v37 [diff vs current]
- v38 [diff vs current]
Verify that the tasks on the ends of a binder transaction use LSM display values that don't cause SELinux contexts to be interpreted by another LSM or another LSM's context to be interpreted by SELinux. No judgement is made in cases that where SELinux contexts are not used in the binder transaction. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- security/selinux/hooks.c | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+)
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 352be16a887d..fcad2e3432d2 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c@@ -2009,6 +2009,28 @@ static inline u32 open_file_to_av(struct file *file) return av; } +/* + * Verify that if the "display" LSM is SELinux for either task + * that it is for both tasks. + */ +static inline bool compatible_task_displays(struct task_struct *here, + struct task_struct *there) +{ + int h = lsm_task_display(here); + int t = lsm_task_display(there); + + if (h == t) + return true; + + /* unspecified is only ok if SELinux isn't going to be involved */ + if (selinux_lsmid.slot == 0) + return ((h == 0 && t == LSMBLOB_INVALID) || + (t == 0 && h == LSMBLOB_INVALID)); + + /* it's ok only if neither display is SELinux */ + return (h != selinux_lsmid.slot && t != selinux_lsmid.slot); +} + /* Hook functions begin here. */ static int selinux_binder_set_context_mgr(struct task_struct *mgr)
@@ -2016,6 +2038,9 @@ static int selinux_binder_set_context_mgr(struct task_struct *mgr) u32 mysid = current_sid(); u32 mgrsid = task_sid(mgr); + if (!compatible_task_displays(current, mgr)) + return -EINVAL; + return avc_has_perm(&selinux_state, mysid, mgrsid, SECCLASS_BINDER, BINDER__SET_CONTEXT_MGR, NULL);
@@ -2029,6 +2054,9 @@ static int selinux_binder_transaction(struct task_struct *from, u32 tosid = task_sid(to); int rc; + if (!compatible_task_displays(from, to)) + return -EINVAL; + if (mysid != fromsid) { rc = avc_has_perm(&selinux_state, mysid, fromsid, SECCLASS_BINDER,
@@ -2048,6 +2076,9 @@ static int selinux_binder_transfer_binder(struct task_struct *from, u32 fromsid = task_sid(from); u32 tosid = task_sid(to); + if (!compatible_task_displays(from, to)) + return -EINVAL; + return avc_has_perm(&selinux_state, fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, NULL);
@@ -2064,6 +2095,9 @@ static int selinux_binder_transfer_file(struct task_struct *from, struct common_audit_data ad; int rc; + if (!compatible_task_displays(from, to)) + return -EINVAL; + ad.type = LSM_AUDIT_DATA_PATH; ad.u.path = file->f_path;
--
2.20.1