[PATCH v30 20/28] binder: Pass LSM identifier for confirmation
flat view
STALE1767d
From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2021-11-24 02:05:45
Also in:
lkml, selinux
Subsystem:
android drivers, the rest · Maintainers:
Greg Kroah-Hartman, Arve Hjønnevåg, Todd Kjos, Christian Brauner, Carlos Llamas, Alice Ryhl, Linus Torvalds
Revision v30 of 47 in this series.
Revisions (47)
- v1 [diff vs current]
- v1 [diff vs current]
- v1 [diff vs current]
- v1 [diff vs current]
- v1 [diff vs current]
- v2 [diff vs current]
- v3 [diff vs current]
- v3 [diff vs current]
- v4 [diff vs current]
- v5 [diff vs current]
- v5 [diff vs current]
- v7 [diff vs current]
- v8 [diff vs current]
- v10 [diff vs current]
- v10 [diff vs current]
- v11 [diff vs current]
- v11 [diff vs current]
- v12 [diff vs current]
- v12 [diff vs current]
- v12 [diff vs current]
- v13 [diff vs current]
- v14 [diff vs current]
- v15 [diff vs current]
- v16 [diff vs current]
- v17 [diff vs current]
- v18 [diff vs current]
- v19 [diff vs current]
- v20 [diff vs current]
- v21 [diff vs current]
- v22 [diff vs current]
- v22 [diff vs current]
- v24 [diff vs current]
- v25 [diff vs current]
- v26 [diff vs current]
- v27 [diff vs current]
- v28 [diff vs current]
- v29 [diff vs current]
- v30 current
- v31 [diff vs current]
- v32 [diff vs current]
- v33 [diff vs current]
- v34 [diff vs current]
- v34 [diff vs current]
- v35 [diff vs current]
- v36 [diff vs current]
- v37 [diff vs current]
- v38 [diff vs current]
Send an identifier for the security module interface_lsm along with the security context. This allows the receiver to verify that the receiver and the sender agree on which security module's context is being used. If they don't agree the message is rejected. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> --- drivers/android/binder.c | 21 +++++++++++++++++++++ drivers/android/binder_internal.h | 1 + 2 files changed, 22 insertions(+)
diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index caaee7f95514..7172d864579d 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c@@ -2762,6 +2762,7 @@ static void binder_transaction(struct binder_proc *proc, ALIGN(extra_buffers_size, sizeof(void *)) - ALIGN(lsmctx.len, sizeof(u64)); + t->security_interface = lsm_task_ilsm(current); t->security_ctx = (uintptr_t)t->buffer->user_data + buf_offset; err = binder_alloc_copy_to_buffer(&target_proc->alloc, t->buffer, buf_offset,
@@ -4132,6 +4133,26 @@ static int binder_thread_read(struct binder_proc *proc, tr.secctx = t->security_ctx; if (t->security_ctx) { + int to_ilsm = lsm_task_ilsm(current); + int from_ilsm = t->security_interface; + + if (to_ilsm == LSMBLOB_INVALID) + to_ilsm = 0; + if (from_ilsm == LSMBLOB_INVALID) + from_ilsm = 0; + /* + * The sender provided a security context from + * a different security module than the one this + * process wants to report if these don't match. + */ + if (from_ilsm != to_ilsm) { + if (t_from) + binder_thread_dec_tmpref(t_from); + + binder_cleanup_transaction(t, "security context mismatch", + BR_FAILED_REPLY); + return -EINVAL; + } cmd = BR_TRANSACTION_SEC_CTX; trsize = sizeof(tr); }
diff --git a/drivers/android/binder_internal.h b/drivers/android/binder_internal.h
index d6b6b8cb7346..e3a0718ce17c 100644
--- a/drivers/android/binder_internal.h
+++ b/drivers/android/binder_internal.h@@ -545,6 +545,7 @@ struct binder_transaction { long saved_priority; kuid_t sender_euid; struct list_head fd_fixups; + int security_interface; binder_uintptr_t security_ctx; /** * @lock: protects @from, @to_proc, and @to_thread
--
2.31.1