linux-stable.git/security/selinux, branch linux-4.9.y

selinux: fix inode_doinit_with_dentry() LABEL_INVALID error handling

2022-08-25T09:09:22+00:00

commit 200ea5a2292dc444a818b096ae6a32ba3caa51b9 upstream.

A previous fix, commit 83370b31a915 ("selinux: fix error initialization
in inode_doinit_with_dentry()"), changed how failures were handled
before a SELinux policy was loaded.  Unfortunately that patch was
potentially problematic for two reasons: it set the isec->initialized
state without holding a lock, and it didn't set the inode's SELinux
label to the "default" for the particular filesystem.  The later can
be a problem if/when a later attempt to revalidate the inode fails
and SELinux reverts to the existing inode label.

This patch should restore the default inode labeling that existed
before the original fix, without affecting the LABEL_INVALID marking
such that revalidation will still be attempted in the future.

Fixes: 83370b31a915 ("selinux: fix error initialization in inode_doinit_with_dentry()")
Reported-by: Sven Schnelle 
Tested-by: Sven Schnelle 
Reviewed-by: Ondrej Mosnacek 
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

selinux: fix error initialization in inode_doinit_with_dentry()

2022-08-25T09:09:21+00:00

commit 83370b31a915493231e5b9addc72e4bef69f8d31 upstream.

Mark the inode security label as invalid if we cannot find
a dentry so that we will retry later rather than marking it
initialized with the unlabeled SID.

Fixes: 9287aed2ad1f ("selinux: Convert isec->lock into a spinlock")
Signed-off-by: Tianyue Ren 
[PM: minor comment tweaks]
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

selinux: Convert isec->lock into a spinlock

2022-08-25T09:09:21+00:00

commit 9287aed2ad1ff1bde5eb190bcd6dccd5f1cf47d3 upstream.

Convert isec->lock from a mutex into a spinlock.  Instead of holding
the lock while sleeping in inode_doinit_with_dentry, set
isec->initialized to LABEL_PENDING and release the lock.  Then, when
the sid has been determined, re-acquire the lock.  If isec->initialized
is still set to LABEL_PENDING, set isec->sid; otherwise, the sid has
been set by another task (LABEL_INITIALIZED) or invalidated
(LABEL_INVALID) in the meantime.

This fixes a deadlock on gfs2 where

 * one task is in inode_doinit_with_dentry -> gfs2_getxattr, holds
   isec->lock, and tries to acquire the inode's glock, and

 * another task is in do_xmote -> inode_go_inval ->
   selinux_inode_invalidate_secctx, holds the inode's glock, and
   tries to acquire isec->lock.

Signed-off-by: Andreas Gruenbacher 
[PM: minor tweaks to keep checkpatch.pl happy]
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

selinux: Clean up initialization of isec->sclass

2022-08-25T09:09:21+00:00

commit 13457d073c29da92001f6ee809075eaa8757fb96 upstream.

Now that isec->initialized == LABEL_INITIALIZED implies that
isec->sclass is valid, skip such inodes immediately in
inode_doinit_with_dentry.

For the remaining inodes, initialize isec->sclass at the beginning of
inode_doinit_with_dentry to simplify the code.

Signed-off-by: Andreas Gruenbacher 
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

proc: Pass file mode to proc_pid_make_inode

2022-08-25T09:09:21+00:00

commit db978da8fa1d0819b210c137d31a339149b88875 upstream.

Pass the file mode of the proc inode to be created to
proc_pid_make_inode.  In proc_pid_make_inode, initialize inode->i_mode
before calling security_task_to_inode.  This allows selinux to set
isec->sclass right away without introducing "half-initialized" inode
security structs.

Signed-off-by: Andreas Gruenbacher 
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

selinux: Minor cleanups

2022-08-25T09:09:21+00:00

commit 420591128cb206201dc444c2d42fb6f299b2ecd0 upstream.

Fix the comment for function __inode_security_revalidate, which returns
an integer.

Use the LABEL_* constants consistently for isec->initialized.

Signed-off-by: Andreas Gruenbacher 
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

security,selinux,smack: kill security_task_wait hook

2022-07-29T15:05:44+00:00

commit 3a2f5a59a695a73e0cde9a61e0feae5fa730e936 upstream.

As reported by yangshukui, a permission denial from security_task_wait()
can lead to a soft lockup in zap_pid_ns_processes() since it only expects
sys_wait4() to return 0 or -ECHILD. Further, security_task_wait() can
in general lead to zombies; in the absence of some way to automatically
reparent a child process upon a denial, the hook is not useful.  Remove
the security hook and its implementations in SELinux and Smack.  Smack
already removed its check from its hook.

Reported-by: yangshukui 
Signed-off-by: Stephen Smalley 
Acked-by: Casey Schaufler 
Acked-by: Oleg Nesterov 
Signed-off-by: Paul Moore 
Signed-off-by: Alexander Grund 
Signed-off-by: Greg Kroah-Hartman

selinux: use correct type for context length

2022-04-20T07:06:38+00:00

[ Upstream commit b97df7c098c531010e445da88d02b7bf7bf59ef6 ]

security_sid_to_context() expects a pointer to an u32 as the address
where to store the length of the computed context.

Reported by sparse:

    security/selinux/xfrm.c:359:39: warning: incorrect type in arg 4
                                    (different signedness)
    security/selinux/xfrm.c:359:39:    expected unsigned int
                                       [usertype] *scontext_len
    security/selinux/xfrm.c:359:39:    got int *

Signed-off-by: Christian Göttsche 
[PM: wrapped commit description]
Signed-off-by: Paul Moore 
Signed-off-by: Sasha Levin

selinux: initialize proto variable in selinux_ip_postroute_compat()

2022-01-05T11:31:24+00:00

commit 732bc2ff080c447f8524f40c970c481f5da6eed3 upstream.

Clang static analysis reports this warning

hooks.c:5765:6: warning: 4th function call argument is an uninitialized
                value
        if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

selinux_parse_skb() can return ok without setting proto.  The later call
to selinux_xfrm_postroute_last() does an early check of proto and can
return ok if the garbage proto value matches.  So initialize proto.

Cc: stable@vger.kernel.org
Fixes: eef9b41622f2 ("selinux: cleanup selinux_xfrm_sock_rcv_skb() and selinux_xfrm_postroute_last()")
Signed-off-by: Tom Rix 
[PM: typo/spelling and checkpatch.pl description fixes]
Signed-off-by: Paul Moore 
Signed-off-by: Greg Kroah-Hartman

binder: use cred instead of task for selinux checks

2021-11-26T10:48:17+00:00

commit 52f88693378a58094c538662ba652aff0253c4fe upstream.

Since binder was integrated with selinux, it has passed
'struct task_struct' associated with the binder_proc
to represent the source and target of transactions.
The conversion of task to SID was then done in the hook
implementations. It turns out that there are race conditions
which can result in an incorrect security context being used.

Fix by using the 'struct cred' saved during binder_open and pass
it to the selinux subsystem.

Cc: stable@vger.kernel.org # 5.14 (need backport for earlier stables)
Fixes: 79af73079d75 ("Add security hooks to binder and implement the hooks for SELinux.")
Suggested-by: Jann Horn 
Signed-off-by: Todd Kjos 
Acked-by: Casey Schaufler 
Signed-off-by: Paul Moore 
Signed-off-by: Greg Kroah-Hartman