[PATCH v8 22/28] SELinux: Verify LSM display sanity in binder

[Stephen Smalley]

On 8/29/19 7:29 PM, Casey Schaufler wrote:
> Verify that the tasks on the ends of a binder transaction
> use LSM display values that don't cause SELinux contexts
> to be interpreted by another LSM or another LSM's context
> to be interpreted by SELinux. No judgement is made in cases
> that where SELinux contexts are not used in the binder
> transaction.
> 
> Signed-off-by: Casey Schaufler <casey at schaufler-ca.com>
> ---
>   include/linux/security.h |  1 +
>   security/selinux/hooks.c | 34 ++++++++++++++++++++++++++++++++++
>   2 files changed, 35 insertions(+)
> 
> diff --git a/include/linux/security.h b/include/linux/security.h
> index c16aea55be97..7fcc94ec8e04 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -125,6 +125,7 @@ struct lsmblob {
>   	u32     secid[LSMBLOB_ENTRIES];
>   };
>   
> +#define LSMBLOB_FIRST		0	/* First valid LSM slot number */
>   #define LSMBLOB_INVALID		-1	/* Not a valid LSM slot number */
>   #define LSMBLOB_NEEDED		-2	/* Slot requested on initialization */
>   #define LSMBLOB_NOT_NEEDED	-3	/* Slot not requested */
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 352be16a887d..2844f2ab7706 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -2009,6 +2009,28 @@ static inline u32 open_file_to_av(struct file *file)
>   	return av;
>   }
>   
> +/*
> + * Verify that if the "display" LSM is SELinux for either task
> + * that it is for both tasks.
> + */
> +static inline bool compatible_task_displays(struct task_struct *here,
> +					    struct task_struct *there)
> +{
> +	int h = lsm_task_display(here);
> +	int t = lsm_task_display(there);
> +
> +	if (h == t)
> +		return true;
> +
> +	/* unspecified is only ok if SELinux isn't going to be involved */
> +	if (selinux_lsmid.slot == LSMBLOB_FIRST)
> +		return ((h == LSMBLOB_FIRST && t == LSMBLOB_INVALID) ||
> +			(t == LSMBLOB_FIRST && h == LSMBLOB_INVALID));
> +
> +	/* it's ok only if neither display is SELinux */
> +	return (h != selinux_lsmid.slot && t != selinux_lsmid.slot);
> +}
> +
>   /* Hook functions begin here. */
>   
>   static int selinux_binder_set_context_mgr(struct task_struct *mgr)
> @@ -2016,6 +2038,9 @@ static int selinux_binder_set_context_mgr(struct task_struct *mgr)
>   	u32 mysid = current_sid();
>   	u32 mgrsid = task_sid(mgr);
>   
> +	if (!compatible_task_displays(current, mgr))
> +		return -EINVAL;
> +
>   	return avc_has_perm(&selinux_state,
>   			    mysid, mgrsid, SECCLASS_BINDER,
>   			    BINDER__SET_CONTEXT_MGR, NULL);
> @@ -2029,6 +2054,9 @@ static int selinux_binder_transaction(struct task_struct *from,
>   	u32 tosid = task_sid(to);
>   	int rc;
>   
> +	if (!compatible_task_displays(from, to))
> +		return -EINVAL;
> +
>   	if (mysid != fromsid) {
>   		rc = avc_has_perm(&selinux_state,
>   				  mysid, fromsid, SECCLASS_BINDER,
> @@ -2048,6 +2076,9 @@ static int selinux_binder_transfer_binder(struct task_struct *from,
>   	u32 fromsid = task_sid(from);
>   	u32 tosid = task_sid(to);
>   
> +	if (!compatible_task_displays(from, to))
> +		return -EINVAL;
> +
>   	return avc_has_perm(&selinux_state,
>   			    fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
>   			    NULL);
> @@ -2064,6 +2095,9 @@ static int selinux_binder_transfer_file(struct task_struct *from,
>   	struct common_audit_data ad;
>   	int rc;
>   
> +	if (!compatible_task_displays(from, to))
> +		return -EINVAL;
> +
>   	ad.type = LSM_AUDIT_DATA_PATH;
>   	ad.u.path = file->f_path;
>   
> 

The only hook that approximates where/when you want to do this check is 
security_binder_transaction(), so you don't need to insert the check 
into the other hooks.  Further, the check is only needed if the server 
has requested peer contexts, which is indicated by the flag bit 
target_node->txn_security_ctx, so if you amended the hook interface to 
also pass that flag value, then you could avoid the check except in that 
situation.

As soon as any other LSM implements the binder hooks, it will also 
likely want an equivalent check, so sooner or later you'll probably want 
to take the logic to the framework and not just the security module.