linux-kernel - Re: [PATCH 1/1] Smack:- Use overlay inode label in smack_inode_copy

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <97e11c67-c432-e973-4eec-d3c2c5d78522@schaufler-ca.com>
Date:   Mon, 20 Sep 2021 07:55:03 -0700
From:   Casey Schaufler <casey@...aufler-ca.com>
To:     vishal.goel@...sung.com,
        "linux-security-module@...r.kernel.org" 
        <linux-security-module@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Cc:     AMIT SAHRAWAT <a.sahrawat@...sung.com>,
        Vaneet Narang <v.narang@...sung.com>,
        Casey Schaufler <casey@...aufler-ca.com>
Subject: Re: [PATCH 1/1] Smack:- Use overlay inode label in
 smack_inode_copy_up()


On 9/20/2021 1:08 AM, Vishal Goel wrote:
>
> Hi,
>
>  
>
> Please find below the test binary code and steps to reproduce:-
>
Excellent. I'll verify the correction, and if all seems sane, include it
for 5.16. Thank you.

>  void main()
> {
>         int fd,pid;
>         char cmd[50];
>
>         pid = getpid();
>         sprintf(cmd,"cat /proc/%d/attr/current",pid);
>         system(cmd);
>         fd = open("/test_dir/smack_test/tmp/test_file", O_CREAT | O_RDWR, S_IWUSR | S_IRUSR);
>
>         if(fd != -1) {
>                 close(fd);
>         }
> }
>
> *Steps:-*
>
> ####### Check default smack labels on files/directories present in the image
> ~$ chsmack /test_dir/smack_test/                                                                                                                                                         
> /test_dir/smack_test/ access="!"
>
> ~$ chsmack /test_dir/smack_test/tmp/                                                                                                                                                  
> /test_dir/smack_test/tmp/ access="_"
>
>  
>
>
> ####### Flash the image on target/board and reboot
>
> sh-3.2# mount | grep overlay                                                                                                                                                              
> overlay on / type overlay (rw,relatime,lowerdir=/,upperdir=/opt/overlay/upperdir,workdir=/opt/overlay/workdir)
>
>  
>
> ####### Check the smack labels
>
> sh-3.2# chsmack /test_dir/smack_test/
> /test_dir/smack_test/ access="!"
> sh-3.2# chsmack /test_dir/smack_test/tmp
> /test_dir/smack_test/tmp access="_"                      ====> Same label is present
>
>  
>
> ####### Run test binary to create a new file under "/test_dir/smack_test/tmp" directory
>
> During inode creation, smack_inode_copy_up() function is called for each of the directory present in path.
> After that "smack_inode_init_security()" is called for initializing the corresponding overlay inode entry.
> During initialization of "tmp", parent inode label is used which is "!" in this case.
>
>  
>
> sh-3.2# ./test_bin
> Test_Label                                                        ===> Process label
>  
>
> ####### Reboot the target/board
>
> sh-3.2# chsmack /test_dir/smack_test/                                                                                                                                                         
> /test_dir/smack_test/ access="!"
>
> sh-3.2# chsmack /test_dir/smack_test/tmp/                                                                                                                                                  
> /test_dir/smack_test/tmp/ access="!"                    ====> Label has been changed from "!" to "_"
>
>  
>
> Thanks & Regards
>
> Vishal Goel
>
> --------- *Original Message* ---------
>
> *Sender* : Casey Schaufler <casey@...aufler-ca.com>
>
> *Date* : 2021-09-18 01:32 (GMT+9)
>
> *Title* : Re: [PATCH 1/1] Smack:- Use overlay inode label in smack_inode_copy_up()
>
>  
>
> On 9/17/2021 12:38 AM, Vishal Goel wrote:
> > Currently in "smack_inode_copy_up()" function, process label is
> > changed with the label on parent inode. Due to which,
> > process is assigned directory label and whatever file or directory
> > created by the process are also getting directory label
> > which is wrong label.
> >
> > Changes has been done to use label of overlay inode instead
> > of parent inode.
>
> Do you have a test case for this change?
>
> >
> > Signed-off-by: Vishal Goel <vishal.goel@...sung.com>
> > ---
> >  security/smack/smack_lsm.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> > index cacbe7518..91e50e5cb 100644
> > --- a/security/smack/smack_lsm.c
> > +++ b/security/smack/smack_lsm.c
> > @@ -4634,7 +4634,7 @@ static int smack_inode_copy_up(struct dentry *dentry, struct cred **new)
> >  	/*
> >  	 * Get label from overlay inode and set it in create_sid
> >  	 */
> > -	isp = smack_inode(d_inode(dentry->d_parent));
> > +	isp = smack_inode(d_inode(dentry));
> >  	skp = isp->smk_inode;
> >  	tsp->smk_task = skp;
> >  	*new = new_creds;
>