[PATCH v26 20/25] LSM: Verify LSM display sanity in binder
STALE1957d
REVIEWED: 8 (6M)
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2021-05-13 20:30:27
Also in:
lkml, selinux
Subsystem:
security subsystem, the rest · Maintainers:
Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds
Revision v26 of 47 in this series; 4 review trailers (1 from subsystem maintainers).
Revisions (47)
- v1 [diff vs current]
- v1 [diff vs current]
- v1 [diff vs current]
- v1 [diff vs current]
- v1 [diff vs current]
- v2 [diff vs current]
- v3 [diff vs current]
- v3 [diff vs current]
- v4 [diff vs current]
- v5 [diff vs current]
- v5 [diff vs current]
- v7 [diff vs current]
- v8 [diff vs current]
- v10 [diff vs current]
- v10 [diff vs current]
- v11 [diff vs current]
- v11 [diff vs current]
- v12 [diff vs current]
- v12 [diff vs current]
- v12 [diff vs current]
- v13 [diff vs current]
- v14 [diff vs current]
- v15 [diff vs current]
- v16 [diff vs current]
- v17 [diff vs current]
- v18 [diff vs current]
- v19 [diff vs current]
- v20 [diff vs current]
- v21 [diff vs current]
- v22 [diff vs current]
- v22 [diff vs current]
- v24 [diff vs current]
- v25 [diff vs current]
- v26 current
- v27 [diff vs current]
- v28 [diff vs current]
- v29 [diff vs current]
- v30 [diff vs current]
- v31 [diff vs current]
- v32 [diff vs current]
- v33 [diff vs current]
- v34 [diff vs current]
- v34 [diff vs current]
- v35 [diff vs current]
- v36 [diff vs current]
- v37 [diff vs current]
- v38 [diff vs current]
Verify that the tasks on the ends of a binder transaction use the same "interface_lsm" security module. This prevents confusion of security "contexts". Reviewed-by: Kees Cook <redacted> Reviewed-by: John Johansen <john.johansen@canonical.com> Acked-by: Stephen Smalley <redacted> Acked-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- security/security.c | 29 +++++++++++++++++++++++++++++ 1 file changed, 29 insertions(+)
diff --git a/security/security.c b/security/security.c
index 1e441c3491b5..d1e9a54e22b4 100644
--- a/security/security.c
+++ b/security/security.c@@ -857,9 +857,38 @@ int security_binder_set_context_mgr(struct task_struct *mgr) return call_int_hook(binder_set_context_mgr, 0, mgr); } +/** + * security_binder_transaction - Binder driver transaction check + * @from: source of the transaction + * @to: destination of the transaction + * + * Verify that the tasks have the same LSM "display", then + * call the security module hooks. + * + * Returns -EINVAL if the displays don't match, or the + * result of the security module checks. + */ int security_binder_transaction(struct task_struct *from, struct task_struct *to) { + int from_ilsm = lsm_task_ilsm(from); + int to_ilsm = lsm_task_ilsm(to); + + /* + * If the ilsm is LSMBLOB_INVALID the first module that has + * an entry is used. This will be in the 0 slot. + * + * This is currently only required if the server has requested + * peer contexts, but it would be unwieldly to have too much of + * the binder driver detail here. + */ + if (from_ilsm == LSMBLOB_INVALID) + from_ilsm = 0; + if (to_ilsm == LSMBLOB_INVALID) + to_ilsm = 0; + if (from_ilsm != to_ilsm) + return -EINVAL; + return call_int_hook(binder_transaction, 0, from, to); }
--
2.29.2