Re: dynamic context transitions

[Luke Kenneth Casson Leighton <lkcl@lkcl.net>]

i hope people don't mind me pointing out what may appear to be obvious:

q: how do you stop an attacker circumventing a program with this
seteuid-like dynamic context transition capability, such that the
attacker can make the program transition anywhere anytime to an
arbitrarily chosen domain?

answer: by restricting the domains to which the transition may occur.

q: how would you do that?

answer: by providing something similar to domain_auto_trans() which is
instead adding a level of indirection.  so, instead of the newly
proposed function (let's call it selinux_change_domain) specifying the
new domain as its argument, you instead specify an intermediate handle.

so you'd have in the policy:

dynamic_handle "samba_as_root" samba_root_t
dynamic_handle "samba_as_user" samba_user_t

dynamic_auto_trans(samba_t, "samba_as_root")
dynamic_auto_trans(samba_root_t, "samba_as_user")

then, inside smbd, you call, at the appropriate point:

	selinux_change_domain("samba_as_user")

then, the job of the selinux_change_domain() function is to not only
check that you have permission to make dynamic transitions, but
also that you are in the samba_root_t domain - and to do a lookup
onto the dynamic_handle to find out what domain to transition to.


otherwise, you run the risk of a circumvented program being able to
transition to unconfined_t - or anything that they damn well choose.

i trust that this has been considered in the design of the new dynamic
transition function?

l.


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.