linux-kernel - Re: [PATCH 2/2] Version 11 (2.6.24-rc2) Smack: Simplified Mandatory Access Control Kernel

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Sat, 10 Nov 2007 22:33:36 -0800 (PST)
From:	Casey Schaufler <casey@...aufler-ca.com>
To:	Eric Paris <eparis@...isplace.org>, casey@...aufler-ca.com
Cc:	akpm@...l.org, torvalds@...l.org, method@...icmethod.com,
	linux-kernel@...r.kernel.org, linux-security-module@...r.kernel.org
Subject: Re: [PATCH 2/2] Version 11 (2.6.24-rc2) Smack: Simplified Mandatory Access Control Kernel


--- Eric Paris <eparis@...isplace.org> wrote:

> [snip from fs/super.c:vfs_kern_mount() just for reference]
>         if (data) {
>                 secdata = alloc_secdata();
>                 if (!secdata)
>                         goto out_mnt;
> 
>                 error = security_sb_copy_data(type, data, secdata);
>                 if (error)
>                         goto out_free_secdata;
>         }
> 
>         error = type->get_sb(type, flags, name, data, mnt);
>         if (error < 0)
>                 goto out_free_secdata;
>         BUG_ON(!mnt->mnt_sb);
> 
>         error = security_sb_kern_mount(mnt->mnt_sb, secdata);
>         if (error)
>                 goto out_sb;
> [end snip]
> 
> > +/**
> > + * smack_sb_copy_data - copy mount options data for processing
> > + * @type: file system type
> > + * @orig: where to start
> > + * @smackopts
> > + *
> > + * Returns 0 on success or -ENOMEM on error.
> > + *
> > + * Copy the Smack specific mount options out of the mount
> > + * options list.
> > + */
> > +static int smack_sb_copy_data(struct file_system_type *type, void *orig,
> > +                             void *smackopts)
> > +{
> > +       char *cp, *commap, *otheropts, *dp;
> > +
> > +       /* Binary mount data: just copy */
> > +       if (type->fs_flags & FS_BINARY_MOUNTDATA) {
> > +               copy_page(smackopts, orig);
> > +               return 0;
> > +       }
> 
> So given NFS, which may have passed you a nfs_mount_data,
> nfs_parsed_mount_data, or a nfs_clone_mount struct one page is going
> to get coppied back out to the VFS.
> > +
> > +       otheropts = (char *)get_zeroed_page(GFP_KERNEL);
> > +       if (otheropts == NULL)
> > +               return -ENOMEM;
> > +
> > +       for (cp = orig, commap = orig; commap != NULL; cp = commap + 1) {
> > +               if (strstr(cp, SMK_FSDEFAULT) == cp)
> > +                       dp = smackopts;
> > +               else if (strstr(cp, SMK_FSFLOOR) == cp)
> > +                       dp = smackopts;
> > +               else if (strstr(cp, SMK_FSHAT) == cp)
> > +                       dp = smackopts;
> > +               else if (strstr(cp, SMK_FSROOT) == cp)
> > +                       dp = smackopts;
> > +               else
> > +                       dp = otheropts;
> > +
> > +               commap = strchr(cp, ',');
> > +               if (commap != NULL)
> > +                       *commap = '\0';
> > +
> > +               if (*dp != '\0')
> > +                       strcat(dp, ",");
> > +               strcat(dp, cp);
> > +       }
> > +
> > +       strcpy(orig, otheropts);
> > +       free_page((unsigned long)otheropts);
> > +
> > +       return 0;
> > +}
> > +
> > +/**
> > + * smack_sb_kern_mount - Smack specific mount processing
> > + * @sb: the file system superblock
> > + * @data: the smack mount options
> > + *
> > + * Returns 0 on success, an error code on failure
> > + */
> > +static int smack_sb_kern_mount(struct super_block *sb, void *data)
> > +{
> > +       struct dentry *root = sb->s_root;
> > +       struct inode *inode = root->d_inode;
> > +       struct superblock_smack *sp = sb->s_security;
> > +       struct inode_smack *isp;
> > +       char *op;
> > +       char *commap;
> > +       char *nsp;
> > +
> > +       spin_lock(&sp->smk_sblock);
> > +       if (sp->smk_initialized != 0) {
> > +               spin_unlock(&sp->smk_sblock);
> > +               return 0;
> > +       }
> > +       sp->smk_initialized = 1;
> > +       spin_unlock(&sp->smk_sblock);
> > +
> > +       for (op = data; op != NULL; op = commap) {
> 
> Here you walk this page of binary NFS data looking for your stuff.
> And while I assume its unlikely you find anything you like on this
> page and go wrong, its not impossible.
> 
> SELinux tried to solve this problem right here in its equivalent
> function years ago, but it has since been despised by the FS people
> and now i'm trying to make everyone happy.  I'd love you comment on
> how you plan to support NFS and other filesystems which use
> FS_BINARY_MOUNTDATA)

I think I'd best say that I need to look at what you've got so far
and see how best to make use of it, because my current plan is nowhere
near as good as yours.


Casey Schaufler
casey@...aufler-ca.com
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/