| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAGXu5jJ045iaDfoW+2dXU+U-KhfnNH1WX5ngUW9dHyS5Yn3EGg@mail.gmail.com>
Date: Sat, 27 May 2017 18:04:14 -0700
From: Kees Cook <keescook@...omium.org>
To: Tetsuo Handa <penguin-kernel@...ove.sakura.ne.jp>
Cc: linux-security-module <linux-security-module@...r.kernel.org>,
LKML <linux-kernel@...r.kernel.org>,
"kernel-hardening@...ts.openwall.com"
<kernel-hardening@...ts.openwall.com>,
Casey Schaufler <casey@...aufler-ca.com>,
Christoph Hellwig <hch@...radead.org>,
Igor Stoppa <igor.stoppa@...wei.com>,
James Morris <james.l.morris@...cle.com>,
Paul Moore <paul@...l-moore.com>,
Stephen Smalley <sds@...ho.nsa.gov>
Subject: Re: [PATCH] LSM: Convert security_hook_heads into explicit array of
struct list_head
On Sat, May 27, 2017 at 4:17 AM, Tetsuo Handa
<penguin-kernel@...ove.sakura.ne.jp> wrote:
> Commit 3dfc9b02864b19f4 ("LSM: Initialize security_hook_heads upon
> registration.") treats "struct security_hook_heads" as an implicit array
> of "struct list_head" so that we can eliminate code for static
> initialization. Although we haven't encountered compilers which do not
> treat sizeof(security_hook_heads) != sizeof(struct list_head) *
> (sizeof(security_hook_heads) / sizeof(struct list_head)), Casey does not
> like the assumption that a structure of N elements can be assumed to be
> the same as an array of N elements.
>
> Now that Kees found that randstruct complains such casting
>
> security/security.c: In function 'security_init':
> security/security.c:59:20: note: found mismatched op0 struct pointer types: 'struct list_head' and 'struct security_hook_heads'
>
> struct list_head *list = (struct list_head *) &security_hook_heads;
>
> and Christoph thinks that we should fix it rather than make randstruct
> whitelist it, this patch fixes it.
>
> It would be possible to revert commit 3dfc9b02864b19f4, but this patch
> converts security_hook_heads into an explicit array of struct list_head
> by introducing an enum, due to reasons explained below.
Like Casey, I had confused this patch with the other(?) that resulted
in dropped type checking. This just switches from named list_heads to
indexed list_heads, which is fine now that the BUG_ON exists to
sanity-check the index being used.
> In MM subsystem, a sealable memory allocator patch was proposed, and
> the LSM hooks ("struct security_hook_heads security_hook_heads" and
> "struct security_hook_list ...[]") will benefit from this allocator via
> protection using set_memory_ro()/set_memory_rw(), and that allocator
> will remove CONFIG_SECURITY_WRITABLE_HOOKS config option. Thus, we will
> likely be moving to that direction.
It's unlikely that smalloc will allow unsealing after initialization,
so the SELinux disabling case will remain, IIUC.
> This means that these structures will be allocated at run time using
> this allocator, and therefore the address of these structures will be
> determined at run time rather than compile time.
>
> But currently, LSM_HOOK_INIT() macro depends on the address of
> security_hook_heads being known at compile time. If we use an enum
> so that LSM_HOOK_INIT() macro does not need to know absolute address of
> security_hook_heads, it will help us to use that allocator for LSM hooks.
>
> As a result of introducing an enum, security_hook_heads becomes a local
> variable, making it easier to allocate security_hook_heads at run time.
>
> Signed-off-by: Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>
> Cc: Kees Cook <keescook@...omium.org>
> Cc: Paul Moore <paul@...l-moore.com>
> Cc: Stephen Smalley <sds@...ho.nsa.gov>
> Cc: Casey Schaufler <casey@...aufler-ca.com>
> Cc: James Morris <james.l.morris@...cle.com>
> Cc: Igor Stoppa <igor.stoppa@...wei.com>
> Cc: Christoph Hellwig <hch@...radead.org>
> ---
> include/linux/lsm_hooks.h | 412 +++++++++++++++++++++++-----------------------
> security/security.c | 38 +++--
> 2 files changed, 229 insertions(+), 221 deletions(-)
>
> diff --git a/security/security.c b/security/security.c
> index 38316bb..bd3c07e 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -179,7 +182,8 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count,
> do { \
> struct security_hook_list *P; \
> \
> - list_for_each_entry(P, &security_hook_heads.FUNC, list) \
> + list_for_each_entry(P, &security_hook_heads \
> + [LSM_##FUNC], list) \
Can this be unsplit so the [...] remains next to security_hook_heads?
> P->hook.FUNC(__VA_ARGS__); \
> } while (0)
>
> @@ -188,7 +192,8 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count,
> do { \
> struct security_hook_list *P; \
> \
> - list_for_each_entry(P, &security_hook_heads.FUNC, list) { \
> + list_for_each_entry(P, &security_hook_heads \
> + [LSM_##FUNC], list) { \
Same
> RC = P->hook.FUNC(__VA_ARGS__); \
> if (RC != 0) \
> break; \
> @@ -1587,8 +1595,8 @@ int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
> * For speed optimization, we explicitly break the loop rather than
> * using the macro
> */
> - list_for_each_entry(hp, &security_hook_heads.xfrm_state_pol_flow_match,
> - list) {
> + list_for_each_entry(hp, &security_hook_heads
> + [LSM_xfrm_state_pol_flow_match], list) {
Same
> rc = hp->hook.xfrm_state_pol_flow_match(x, xp, fl);
> break;
> }
> --
> 1.8.3.1
>
Otherwise, yeah, I can be convinced to take this. :) Thanks for
persisting with this, I think it makes sense now.
-Kees
--
Kees Cook
Pixel Security
Powered by blists - more mailing lists