linux-kernel - Re: [PATCH v2 1/2] security: Add hook to invalidate inode security labels

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAHc6FU78E-aTZP9gw51iO3e277AZ1UA7R-_Qw8Bwe=idJ=qmbg@mail.gmail.com>
Date:	Mon, 5 Oct 2015 23:56:12 +0200
From:	Andreas Gruenbacher <agruenba@...hat.com>
To:	Stephen Smalley <sds@...ho.nsa.gov>
Cc:	LKML <linux-kernel@...r.kernel.org>,
	linux-fsdevel <linux-fsdevel@...r.kernel.org>,
	Alexander Viro <viro@...iv.linux.org.uk>,
	Christoph Hellwig <hch@...radead.org>,
	Paul Moore <paul@...l-moore.com>,
	Eric Paris <eparis@...isplace.org>, selinux@...ho.nsa.gov
Subject: Re: [PATCH v2 1/2] security: Add hook to invalidate inode security labels

On Mon, Oct 5, 2015 at 5:08 PM, Stephen Smalley <sds@...ho.nsa.gov> wrote:
> Not fond of these magic initialized values.

That should be a solvable problem.

> Is it always safe to call inode_doinit() from all callers of
> inode_has_perm()?

As long as inode_has_perm is only used in contexts in which a file
permission check / acl check would be possible, I don't see why not.

> What about the cases where isec->sid is used without going through
> inode_has_perm()?

inode_has_perm seems to be called frequently and invalid labels seem
to be reload quickly, so this change may make SELinux work well enough
to be useful on top of gfs2 or similar. More checks would of course be
better. The ideal case would be to always reload invalid labels, but
that currently won't be possible because we don't have dentries
everywhere.

I can't tell if this is this good enough to provide a useful level of
protection. In any case, without a patch like this, on gfs2 and
similar file systems, SELinux currently doesn't work at all.

How we can make progress with this problem?

Thanks,
Andreas
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/