linux-kernel - Re: [PATCH 6/7] selinux: Ignore security labels on user namespace mounts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 22 Jul 2015 11:14:22 -0500
From:	Seth Forshee <seth.forshee@...onical.com>
To:	Stephen Smalley <sds@...ho.nsa.gov>
Cc:	"Eric W. Biederman" <ebiederm@...ssion.com>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	Paul Moore <paul@...l-moore.com>,
	Eric Paris <eparis@...isplace.org>,
	Serge Hallyn <serge.hallyn@...onical.com>,
	James Morris <james.l.morris@...cle.com>,
	linux-kernel@...r.kernel.org,
	Andy Lutomirski <luto@...capital.net>,
	linux-security-module@...r.kernel.org, selinux@...ho.nsa.gov,
	linux-fsdevel@...r.kernel.org
Subject: Re: [PATCH 6/7] selinux: Ignore security labels on user namespace
 mounts

On Wed, Jul 22, 2015 at 12:02:13PM -0400, Stephen Smalley wrote:
> On 07/16/2015 09:23 AM, Stephen Smalley wrote:
> > On 07/15/2015 03:46 PM, Seth Forshee wrote:
> >> Unprivileged users should not be able to supply security labels
> >> in filesystems, nor should they be able to supply security
> >> contexts in unprivileged mounts. For any mount where s_user_ns is
> >> not init_user_ns, force the use of SECURITY_FS_USE_NONE behavior
> >> and return EPERM if any contexts are supplied in the mount
> >> options.
> >>
> >> Signed-off-by: Seth Forshee <seth.forshee@...onical.com>
> > 
> > I think this is obsoleted by the subsequent discussion, but just for the
> > record: this patch would cause the files in the userns mount to be left
> > with the "unlabeled" label, and therefore under typical policies,
> > completely inaccessible to any process in a confined domain.
> 
> The right way to handle this for SELinux would be to automatically use
> mountpoint labeling (SECURITY_FS_USE_MNTPOINT, normally set by
> specifying a context= mount option), with the sbsec->mntpoint_sid set
> from some related object (e.g. the block device file context, as in your
> patches for Smack).  That will cause SELinux to use that value instead
> of any xattr value from the filesystem and will cause attempts by
> userspace to set the security.selinux xattr to fail on that filesystem.
>  That is how SELinux normally deals with untrusted filesystems, except
> that it is normally specified as a mount option by a trusted mounting
> process, whereas in your case you need to automatically set it.

Excellent, thank you for the advice. I'll start on this when I've
finished with Smack.

Seth
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/