Re: [PATCH v2 2/3] Teach SELinux about anonymous inodes
From: Stephen Smalley <hidden>
Date: 2020-03-26 17:37:37
Also in:
kvm, linux-fsdevel, lkml, selinux
On 3/25/20 7:02 PM, Daniel Colascione wrote:
This change uses the anon_inodes and LSM infrastructure introduced in
the previous patch to give SELinux the ability to control
anonymous-inode files that are created using the new _secure()
anon_inodes functions.
A SELinux policy author detects and controls these anonymous inodes by
adding a name-based type_transition rule that assigns a new security
type to anonymous-inode files created in some domain. The name used
for the name-based transition is the name associated with the
anonymous inode for file listings --- e.g., "[userfaultfd]" or
"[perf_event]".
Example:
type uffd_t;
type_transition sysadm_t sysadm_t : file uffd_t "[userfaultfd]";
allow sysadm_t uffd_t:file { create };These should use :anon_inode rather than :file since the class is no longer file.
quoted hunk ↗ jump to hunk
(The next patch in this series is necessary for making userfaultfd support this new interface. The example above is just for exposition.) Signed-off-by: Daniel Colascione <redacted> --- security/selinux/hooks.c | 54 +++++++++++++++++++++++++++++ security/selinux/include/classmap.h | 2 ++ 2 files changed, 56 insertions(+)diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 1659b59fb5d7..b9eb45c2e4e5 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c@@ -2915,6 +2915,59 @@ static int selinux_inode_init_security(struct inode *inode, struct inode *dir, return 0; } +static int selinux_inode_init_security_anon(struct inode *inode, + const struct qstr *name, + const struct file_operations *fops, + const struct inode *context_inode) +{ + const struct task_security_struct *tsec = selinux_cred(current_cred()); + struct common_audit_data ad; + struct inode_security_struct *isec; + int rc; + + if (unlikely(!selinux_state.initialized)) + return 0; + + isec = selinux_inode(inode); + + /* + * We only get here once per ephemeral inode. The inode has + * been initialized via inode_alloc_security but is otherwise + * untouched. + */ + + if (context_inode) { + struct inode_security_struct *context_isec = + selinux_inode(context_inode); + isec->sclass = context_isec->sclass; + isec->sid = context_isec->sid; + } else { + isec->sclass = SECCLASS_ANON_INODE; + rc = security_transition_sid( + &selinux_state, tsec->sid, tsec->sid, + SECCLASS_FILE, name, &isec->sid);
You should use isec->sclass == SECCLASS_ANON_INODE instead of SECCLASS_FILE here.