[PATCH v3 1/2] LSM: SafeSetID: gate setgid transitions
Casey Schaufler
casey at schaufler-ca.com
Thu Feb 28 19:12:20 UTC 2019
On 2/28/2019 11:06 AM, mortonm at chromium.org wrote:
> From: Micah Morton <mortonm at chromium.org>
>
> This patch generalizes the 'task_fix_setuid' LSM hook to enable hooking
> setgid transitions as well as setuid transitions. The hook is renamed to
> 'task_fix_setid'. The patch introduces calls to this hook from the
> setgid functions in kernel/sys.c. This will allow the SafeSetID LSM to
> govern setgid transitions in addition to setuid transitions. This patch
> also makes sure the setgid functions in kernel/sys.c call
> security_capable_setid rather than the ordinary security_capable
> function, so that the security_capable hook in the SafeSetID LSM knows
> it is being invoked from a setid function.
>
> Signed-off-by: Micah Morton <mortonm at chromium.org>
Acked-by: Casey Schaufler <casey at schaufler-ca.com>
> ---
> Changes since the last patch: Combine the 'task_fix_setuid' and
> 'task_fix_setgid' hooks into one hook called 'task_fix_setid'.
Thank you.
>
> Documentation/admin-guide/LSM/SafeSetID.rst | 2 +-
> include/linux/lsm_hooks.h | 8 ++---
> include/linux/security.h | 36 ++++++++++++++-------
> kernel/sys.c | 35 ++++++++++++++------
> security/commoncap.c | 20 +++++++-----
> security/safesetid/lsm.c | 12 +++----
> security/security.c | 4 +--
> 7 files changed, 74 insertions(+), 43 deletions(-)
>
> diff --git a/Documentation/admin-guide/LSM/SafeSetID.rst b/Documentation/admin-guide/LSM/SafeSetID.rst
> index 212434ef65ad..670a6544fd39 100644
> --- a/Documentation/admin-guide/LSM/SafeSetID.rst
> +++ b/Documentation/admin-guide/LSM/SafeSetID.rst
> @@ -88,7 +88,7 @@ other system interactions, including use of pid namespaces and device creation.
> Use an existing LSM
> -------------------
> None of the other in-tree LSMs have the capability to gate setid transitions, or
> -even employ the security_task_fix_setuid hook at all. SELinux says of that hook:
> +even employ the security_task_fix_setid hook at all. SELinux says of that hook:
> "Since setuid only affects the current process, and since the SELinux controls
> are not based on the Linux identity attributes, SELinux does not need to control
> this operation."
> diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> index 22fc786d723a..47fd04410fde 100644
> --- a/include/linux/lsm_hooks.h
> +++ b/include/linux/lsm_hooks.h
> @@ -594,14 +594,14 @@
> * @size length of the file contents.
> * @id kernel read file identifier
> * Return 0 if permission is granted.
> - * @task_fix_setuid:
> + * @task_fix_setid:
> * Update the module's state after setting one or more of the user
> * identity attributes of the current process. The @flags parameter
> * indicates which of the set*uid system calls invoked this hook. If
> * @new is the set of credentials that will be installed. Modifications
> * should be made to this rather than to @current->cred.
> * @old is the set of credentials that are being replaces
> - * @flags contains one of the LSM_SETID_* values.
> + * @flags contains one of the LSM_SET*ID_* values.
> * Return 0 on success.
> * @task_setpgid:
> * Check permission before setting the process group identifier of the
> @@ -1594,7 +1594,7 @@ union security_list_options {
> int (*kernel_read_file)(struct file *file, enum kernel_read_file_id id);
> int (*kernel_post_read_file)(struct file *file, char *buf, loff_t size,
> enum kernel_read_file_id id);
> - int (*task_fix_setuid)(struct cred *new, const struct cred *old,
> + int (*task_fix_setid)(struct cred *new, const struct cred *old,
> int flags);
> int (*task_setpgid)(struct task_struct *p, pid_t pgid);
> int (*task_getpgid)(struct task_struct *p);
> @@ -1886,7 +1886,7 @@ struct security_hook_heads {
> struct hlist_head kernel_read_file;
> struct hlist_head kernel_post_read_file;
> struct hlist_head kernel_module_request;
> - struct hlist_head task_fix_setuid;
> + struct hlist_head task_fix_setid;
> struct hlist_head task_setpgid;
> struct hlist_head task_getpgid;
> struct hlist_head task_getsid;
> diff --git a/include/linux/security.h b/include/linux/security.h
> index 13537a49ae97..76df3e22fed1 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -95,7 +95,7 @@ extern int cap_inode_getsecurity(struct inode *inode, const char *name,
> extern int cap_mmap_addr(unsigned long addr);
> extern int cap_mmap_file(struct file *file, unsigned long reqprot,
> unsigned long prot, unsigned long flags);
> -extern int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags);
> +extern int cap_task_fix_setid(struct cred *new, const struct cred *old, int flags);
> extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
> unsigned long arg4, unsigned long arg5);
> extern int cap_task_setscheduler(struct task_struct *p);
> @@ -128,17 +128,29 @@ extern unsigned long dac_mmap_min_addr;
> /*
> * Values used in the task_security_ops calls
> */
> -/* setuid or setgid, id0 == uid or gid */
> -#define LSM_SETID_ID 1
> +/* setuid, id0 == uid */
> +#define LSM_SETUID_ID 1
>
> -/* setreuid or setregid, id0 == real, id1 == eff */
> -#define LSM_SETID_RE 2
> +/* setreuid, id0 == real, id1 == eff */
> +#define LSM_SETUID_RE 2
>
> -/* setresuid or setresgid, id0 == real, id1 == eff, uid2 == saved */
> -#define LSM_SETID_RES 4
> +/* setresuid, id0 == real, id1 == eff, uid2 == saved */
> +#define LSM_SETUID_RES 4
>
> -/* setfsuid or setfsgid, id0 == fsuid or fsgid */
> -#define LSM_SETID_FS 8
> +/* setfsuid, id0 == fsgid */
> +#define LSM_SETUID_FS 8
> +
> +/* setgid, id0 == gid */
> +#define LSM_SETGID_ID 16
> +
> +/* setregid, id0 == real, id1 == eff */
> +#define LSM_SETGID_RE 32
> +
> +/* setresgid, id0 == real, id1 == eff, uid2 == saved */
> +#define LSM_SETGID_RES 64
> +
> +/* setfsgid, id0 == fsgid */
> +#define LSM_SETGID_FS 128
>
> /* Flags for security_task_prlimit(). */
> #define LSM_PRLIMIT_READ 1
> @@ -324,7 +336,7 @@ int security_kernel_load_data(enum kernel_load_data_id id);
> int security_kernel_read_file(struct file *file, enum kernel_read_file_id id);
> int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,
> enum kernel_read_file_id id);
> -int security_task_fix_setuid(struct cred *new, const struct cred *old,
> +int security_task_fix_setid(struct cred *new, const struct cred *old,
> int flags);
> int security_task_setpgid(struct task_struct *p, pid_t pgid);
> int security_task_getpgid(struct task_struct *p);
> @@ -923,11 +935,11 @@ static inline int security_kernel_post_read_file(struct file *file,
> return 0;
> }
>
> -static inline int security_task_fix_setuid(struct cred *new,
> +static inline int security_task_fix_setid(struct cred *new,
> const struct cred *old,
> int flags)
> {
> - return cap_task_fix_setuid(new, old, flags);
> + return cap_task_fix_setid(new, old, flags);
> }
>
> static inline int security_task_setpgid(struct task_struct *p, pid_t pgid)
> diff --git a/kernel/sys.c b/kernel/sys.c
> index c5f875048aef..615b44939238 100644
> --- a/kernel/sys.c
> +++ b/kernel/sys.c
> @@ -372,7 +372,7 @@ long __sys_setregid(gid_t rgid, gid_t egid)
> if (rgid != (gid_t) -1) {
> if (gid_eq(old->gid, krgid) ||
> gid_eq(old->egid, krgid) ||
> - ns_capable(old->user_ns, CAP_SETGID))
> + ns_capable_setid(old->user_ns, CAP_SETGID))
> new->gid = krgid;
> else
> goto error;
> @@ -381,7 +381,7 @@ long __sys_setregid(gid_t rgid, gid_t egid)
> if (gid_eq(old->gid, kegid) ||
> gid_eq(old->egid, kegid) ||
> gid_eq(old->sgid, kegid) ||
> - ns_capable(old->user_ns, CAP_SETGID))
> + ns_capable_setid(old->user_ns, CAP_SETGID))
> new->egid = kegid;
> else
> goto error;
> @@ -392,6 +392,10 @@ long __sys_setregid(gid_t rgid, gid_t egid)
> new->sgid = new->egid;
> new->fsgid = new->egid;
>
> + retval = security_task_fix_setid(new, old, LSM_SETGID_RE);
> + if (retval < 0)
> + goto error;
> +
> return commit_creds(new);
>
> error:
> @@ -427,13 +431,17 @@ long __sys_setgid(gid_t gid)
> old = current_cred();
>
> retval = -EPERM;
> - if (ns_capable(old->user_ns, CAP_SETGID))
> + if (ns_capable_setid(old->user_ns, CAP_SETGID))
> new->gid = new->egid = new->sgid = new->fsgid = kgid;
> else if (gid_eq(kgid, old->gid) || gid_eq(kgid, old->sgid))
> new->egid = new->fsgid = kgid;
> else
> goto error;
>
> + retval = security_task_fix_setid(new, old, LSM_SETGID_ID);
> + if (retval < 0)
> + goto error;
> +
> return commit_creds(new);
>
> error:
> @@ -539,7 +547,7 @@ long __sys_setreuid(uid_t ruid, uid_t euid)
> new->suid = new->euid;
> new->fsuid = new->euid;
>
> - retval = security_task_fix_setuid(new, old, LSM_SETID_RE);
> + retval = security_task_fix_setid(new, old, LSM_SETUID_RE);
> if (retval < 0)
> goto error;
>
> @@ -597,7 +605,7 @@ long __sys_setuid(uid_t uid)
>
> new->fsuid = new->euid = kuid;
>
> - retval = security_task_fix_setuid(new, old, LSM_SETID_ID);
> + retval = security_task_fix_setid(new, old, LSM_SETUID_ID);
> if (retval < 0)
> goto error;
>
> @@ -672,7 +680,7 @@ long __sys_setresuid(uid_t ruid, uid_t euid, uid_t suid)
> new->suid = ksuid;
> new->fsuid = new->euid;
>
> - retval = security_task_fix_setuid(new, old, LSM_SETID_RES);
> + retval = security_task_fix_setid(new, old, LSM_SETUID_RES);
> if (retval < 0)
> goto error;
>
> @@ -735,7 +743,7 @@ long __sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
> old = current_cred();
>
> retval = -EPERM;
> - if (!ns_capable(old->user_ns, CAP_SETGID)) {
> + if (!ns_capable_setid(old->user_ns, CAP_SETGID)) {
> if (rgid != (gid_t) -1 && !gid_eq(krgid, old->gid) &&
> !gid_eq(krgid, old->egid) && !gid_eq(krgid, old->sgid))
> goto error;
> @@ -755,6 +763,10 @@ long __sys_setresgid(gid_t rgid, gid_t egid, gid_t sgid)
> new->sgid = ksgid;
> new->fsgid = new->egid;
>
> + retval = security_task_fix_setid(new, old, LSM_SETGID_RES);
> + if (retval < 0)
> + goto error;
> +
> return commit_creds(new);
>
> error:
> @@ -817,7 +829,7 @@ long __sys_setfsuid(uid_t uid)
> ns_capable_setid(old->user_ns, CAP_SETUID)) {
> if (!uid_eq(kuid, old->fsuid)) {
> new->fsuid = kuid;
> - if (security_task_fix_setuid(new, old, LSM_SETID_FS) == 0)
> + if (security_task_fix_setid(new, old, LSM_SETUID_FS) == 0)
> goto change_okay;
> }
> }
> @@ -858,10 +870,13 @@ long __sys_setfsgid(gid_t gid)
>
> if (gid_eq(kgid, old->gid) || gid_eq(kgid, old->egid) ||
> gid_eq(kgid, old->sgid) || gid_eq(kgid, old->fsgid) ||
> - ns_capable(old->user_ns, CAP_SETGID)) {
> + ns_capable_setid(old->user_ns, CAP_SETGID)) {
> if (!gid_eq(kgid, old->fsgid)) {
> new->fsgid = kgid;
> - goto change_okay;
> + if (security_task_fix_setid(new,
> + old,
> + LSM_SETGID_FS) == 0)
> + goto change_okay;
> }
> }
>
> diff --git a/security/commoncap.c b/security/commoncap.c
> index f1d117c3d8ae..f79d5b949a2f 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -1026,27 +1026,27 @@ static inline void cap_emulate_setxuid(struct cred *new, const struct cred *old)
> }
>
> /**
> - * cap_task_fix_setuid - Fix up the results of setuid() call
> + * cap_task_fix_setid - Fix up the results of setid() call
> * @new: The proposed credentials
> * @old: The current task's current credentials
> * @flags: Indications of what has changed
> *
> - * Fix up the results of setuid() call before the credential changes are
> + * Fix up the results of setid() call before the credential changes are
> * actually applied, returning 0 to grant the changes, -ve to deny them.
> */
> -int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
> +int cap_task_fix_setid(struct cred *new, const struct cred *old, int flags)
> {
> switch (flags) {
> - case LSM_SETID_RE:
> - case LSM_SETID_ID:
> - case LSM_SETID_RES:
> + case LSM_SETUID_RE:
> + case LSM_SETUID_ID:
> + case LSM_SETUID_RES:
> /* juggle the capabilities to follow [RES]UID changes unless
> * otherwise suppressed */
> if (!issecure(SECURE_NO_SETUID_FIXUP))
> cap_emulate_setxuid(new, old);
> break;
>
> - case LSM_SETID_FS:
> + case LSM_SETUID_FS:
> /* juggle the capabilties to follow FSUID changes, unless
> * otherwise suppressed
> *
> @@ -1066,6 +1066,10 @@ int cap_task_fix_setuid(struct cred *new, const struct cred *old, int flags)
> }
> break;
>
> + case LSM_SETGID_RE:
> + case LSM_SETGID_ID:
> + case LSM_SETGID_RES:
> + case LSM_SETGID_FS:
> default:
> return -EINVAL;
> }
> @@ -1355,7 +1359,7 @@ struct security_hook_list capability_hooks[] __lsm_ro_after_init = {
> LSM_HOOK_INIT(inode_getsecurity, cap_inode_getsecurity),
> LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),
> LSM_HOOK_INIT(mmap_file, cap_mmap_file),
> - LSM_HOOK_INIT(task_fix_setuid, cap_task_fix_setuid),
> + LSM_HOOK_INIT(task_fix_setid, cap_task_fix_setid),
> LSM_HOOK_INIT(task_prctl, cap_task_prctl),
> LSM_HOOK_INIT(task_setscheduler, cap_task_setscheduler),
> LSM_HOOK_INIT(task_setioprio, cap_task_setioprio),
> diff --git a/security/safesetid/lsm.c b/security/safesetid/lsm.c
> index cecd38e2ac80..5deffa92f25f 100644
> --- a/security/safesetid/lsm.c
> +++ b/security/safesetid/lsm.c
> @@ -120,7 +120,7 @@ static int check_uid_transition(kuid_t parent, kuid_t child)
> * set*uid to user under new cred struct, or the UID transition is allowed (by
> * Linux set*uid rules) even without CAP_SETUID.
> */
> -static int safesetid_task_fix_setuid(struct cred *new,
> +static int safesetid_task_fix_setid(struct cred *new,
> const struct cred *old,
> int flags)
> {
> @@ -130,7 +130,7 @@ static int safesetid_task_fix_setuid(struct cred *new,
> return 0;
>
> switch (flags) {
> - case LSM_SETID_RE:
> + case LSM_SETUID_RE:
> /*
> * Users for which setuid restrictions exist can only set the
> * real UID to the real UID or the effective UID, unless an
> @@ -152,7 +152,7 @@ static int safesetid_task_fix_setuid(struct cred *new,
> return check_uid_transition(old->euid, new->euid);
> }
> break;
> - case LSM_SETID_ID:
> + case LSM_SETUID_ID:
> /*
> * Users for which setuid restrictions exist cannot change the
> * real UID or saved set-UID unless an explicit whitelist
> @@ -163,7 +163,7 @@ static int safesetid_task_fix_setuid(struct cred *new,
> if (!uid_eq(old->suid, new->suid))
> return check_uid_transition(old->suid, new->suid);
> break;
> - case LSM_SETID_RES:
> + case LSM_SETUID_RES:
> /*
> * Users for which setuid restrictions exist cannot change the
> * real UID, effective UID, or saved set-UID to anything but
> @@ -187,7 +187,7 @@ static int safesetid_task_fix_setuid(struct cred *new,
> return check_uid_transition(old->suid, new->suid);
> }
> break;
> - case LSM_SETID_FS:
> + case LSM_SETUID_FS:
> /*
> * Users for which setuid restrictions exist cannot change the
> * filesystem UID to anything but one of: the current real UID,
> @@ -256,7 +256,7 @@ void flush_safesetid_whitelist_entries(void)
> }
>
> static struct security_hook_list safesetid_security_hooks[] = {
> - LSM_HOOK_INIT(task_fix_setuid, safesetid_task_fix_setuid),
> + LSM_HOOK_INIT(task_fix_setid, safesetid_task_fix_setid),
> LSM_HOOK_INIT(capable, safesetid_security_capable)
> };
>
> diff --git a/security/security.c b/security/security.c
> index ed9b8cbf21cf..450784fd1d2b 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -1568,10 +1568,10 @@ int security_kernel_load_data(enum kernel_load_data_id id)
> }
> EXPORT_SYMBOL_GPL(security_kernel_load_data);
>
> -int security_task_fix_setuid(struct cred *new, const struct cred *old,
> +int security_task_fix_setid(struct cred *new, const struct cred *old,
> int flags)
> {
> - return call_int_hook(task_fix_setuid, 0, new, old, flags);
> + return call_int_hook(task_fix_setid, 0, new, old, flags);
> }
>
> int security_task_setpgid(struct task_struct *p, pid_t pgid)
More information about the Linux-security-module-archive
mailing list