linux-kernel - Re: [PATCH 04/13] security/selinux: check for LOOKUP_RCU in _follow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150320153930.1f180e06@notabene.brown>
Date:	Fri, 20 Mar 2015 15:39:30 +1100
From:	NeilBrown <neilb@...e.de>
To:	Al Viro <viro@...IV.linux.org.uk>
Cc:	linux-fsdevel@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 04/13] security/selinux: check for LOOKUP_RCU in
 _follow_link.

On Mon, 16 Mar 2015 21:00:35 +0000 Al Viro <viro@...IV.linux.org.uk> wrote:

> On Mon, Mar 16, 2015 at 03:43:19PM +1100, NeilBrown wrote:
> > Some of dentry_has_perm() is not rcu-safe, so if LOOKUP_RCU
> > is set in selinux_inode_follow_link(), give up with
> > -ECHILD.
> > 
> > It is possible that dentry_has_perm could sometimes complete
> > in RCU more, in which case the flag could be propagated further
> > down the stack...
> 
> It bloody well can.  Expand it a bit and you'll see - the nastiness
> comes from avc_audit() doing
>         return slow_avc_audit(ssid, tsid, tclass,
>                               requested, audited, denied, result,
>                               a, 0);
> and passing that 0 to slow_avc_audit().  Pass it MAY_NOT_BLOCK instead
> and it'll bugger off with -ECHILD in blocking case.
> 
> Call chain is dentry_has_perm -> inode_has_perm -> avc_has_perm -> avc_audit.
> Expand those (including avc_audit()) and make slow_avc_audit() get
> flags & LOOKUP_RCU ? MAY_NOT_BLOCK : 0.

There is more to it than that.

avc_has_perm calls avc_has_perm_noaudit which does:

	rcu_read_lock();
	...
	if (unlikely(!node)) {
		node = avc_compute_av(ssid, tsid, tclass, avd);
	} else ...

	...
	rcu_read_unlock();

and avc_compute_av() does

	rcu_read_unlock();
	security_compute_av(ssid, tsid, tclass, avd);
	rcu_read_lock();

(yes: unlock, and then lock).
so avc_has_perm_noaudit needs to bail out of RCU-walk if node turns out to be
NULL.
So I either add another 'flags' arg to that, or replace the current one which
is unused .... or leave it as someone else's problem :-)

NeilBrown

Content of type "application/pgp-signature" skipped