linux-stable.git/security/smack, branch v5.10.78

Smack: Fix wrong semantics in smk_access_entry()

2021-09-18T11:40:18+00:00

[ Upstream commit 6d14f5c7028eea70760df284057fe198ce7778dd ]

In the smk_access_entry() function, if no matching rule is found
in the rust_list, a negative error code will be used to perform bit
operations with the MAY_ enumeration value. This is semantically
wrong. This patch fixes this issue.

Signed-off-by: Tianjia Zhang 
Signed-off-by: Casey Schaufler 
Signed-off-by: Sasha Levin

smackfs: restrict bytes count in smk_set_cipso()

2021-07-19T07:45:03+00:00

commit 49ec114a6e62d8d320037ce71c1aaf9650b3cafd upstream.

Oops, I failed to update subject line.

From 07571157c91b98ce1a4aa70967531e64b78e8346 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa 
Date: Mon, 12 Apr 2021 22:25:06 +0900
Subject: smackfs: restrict bytes count in smk_set_cipso()

Commit 7ef4c19d245f3dc2 ("smackfs: restrict bytes count in smackfs write
functions") missed that count > SMK_CIPSOMAX check applies to only
format == SMK_FIXED24_FMT case.

Reported-by: syzbot 
Signed-off-by: Tetsuo Handa 
Signed-off-by: Casey Schaufler 
Signed-off-by: Greg Kroah-Hartman

smackfs: restrict bytes count in smackfs write functions

2021-03-07T11:34:05+00:00

commit 7ef4c19d245f3dc233fd4be5acea436edd1d83d8 upstream.

syzbot found WARNINGs in several smackfs write operations where
bytes count is passed to memdup_user_nul which exceeds
GFP MAX_ORDER. Check count size if bigger than PAGE_SIZE.

Per smackfs doc, smk_write_net4addr accepts any label or -CIPSO,
smk_write_net6addr accepts any label or -DELETE. I couldn't find
any general rule for other label lengths except SMK_LABELLEN,
SMK_LONGLABEL, SMK_CIPSOMAX which are documented.

Let's constrain, in general, smackfs label lengths for PAGE_SIZE.
Although fuzzer crashes write to smackfs/netlabel on 0x400000 length.

Here is a quick way to reproduce the WARNING:
python -c "print('A' * 0x400000)" > /sys/fs/smackfs/netlabel

Reported-by: syzbot+a71a442385a0b2815497@syzkaller.appspotmail.com
Signed-off-by: Sabyrzhan Tasbolatov 
Signed-off-by: Casey Schaufler 
Signed-off-by: Greg Kroah-Hartman

Smack: Handle io_uring kernel thread privileges

2020-12-30T10:54:02+00:00

[ Upstream commit 942cb357ae7d9249088e3687ee6a00ed2745a0c7 ]

Smack assumes that kernel threads are privileged for smackfs
operations. This was necessary because the credential of the
kernel thread was not related to a user operation. With io_uring
the credential does reflect a user's rights and can be used.

Suggested-by: Jens Axboe 
Acked-by: Jens Axboe 
Acked-by: Eric W. Biederman 
Signed-off-by: Casey Schaufler 
Signed-off-by: Sasha Levin

Merge tag 'Smack-for-5.10' of git://github.com/cschaufler/smack-next

2020-10-13T23:18:51+00:00

Pull smack updates from Casey Schaufler:
 "Two minor fixes and one performance enhancement to Smack. The
  performance improvement is significant and the new code is more like
  its counterpart in SELinux.

   - Two kernel test robot suggested clean-ups.

   - Teach Smack to use the IPv4 netlabel cache. This results in a
     12-14% improvement on TCP benchmarks"

* tag 'Smack-for-5.10' of git://github.com/cschaufler/smack-next:
  Smack: Remove unnecessary variable initialization
  Smack: Fix build when NETWORK_SECMARK is not set
  Smack: Use the netlabel cache
  Smack: Set socket labels only once
  Smack: Consolidate uses of secmark into a function

Smack: Remove unnecessary variable initialization

2020-10-05T21:20:51+00:00

The initialization of rc in smack_from_netlbl() is pointless.

Reported-by: kernel test robot 
Signed-off-by: Casey Schaufler

Smack: Fix build when NETWORK_SECMARK is not set

2020-09-22T21:59:31+00:00

Use proper conditional compilation for the secmark field in
the network skb.

Reported-by: kernel test robot 
Signed-off-by: Casey Schaufler

Smack: Use the netlabel cache

2020-09-11T22:31:31+00:00

Utilize the Netlabel cache mechanism for incoming packet matching.
Refactor the initialization of secattr structures, as it was being
done in two places.

Signed-off-by: Casey Schaufler

Smack: Set socket labels only once

2020-09-11T22:31:30+00:00

Refactor the IP send checks so that the netlabel value
is set only when necessary, not on every send. Some functions
get renamed as the changes made the old name misleading.

Signed-off-by: Casey Schaufler

Smack: Consolidate uses of secmark into a function

2020-09-11T22:31:30+00:00

Add a function smack_from_skb() that returns the Smack label
identified by a network secmark. Replace the explicit uses of
the secmark with this function.

Signed-off-by: Casey Schaufler