From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="CcKHX/cR" Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id BCF5BB7 for ; Tue, 12 Dec 2023 10:00:13 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1702404012; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: in-reply-to:in-reply-to:references:references; bh=Hi+Je7A1ir5Jf7RMpbBJ6wePhajEbToaWXnOvXBTaw4=; b=CcKHX/cR0fzcXX9vzHkwoVoYwD7DZA7IHijdb0/e9Fb3TZDH95p650Fe+cdtZuqQbC2i9A jAal4RwI8vl6A5MGf/7UGkPdIOcBrv4PyjvjYzQ/QIkLhW4KupvCE8nLo427KId8mDrU6q MyGVWf9DAvdOsqa3kVt+MUlJVAkchx0= Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-661--jCBmDXFPJ64k39Nx1nrBQ-1; Tue, 12 Dec 2023 13:00:11 -0500 X-MC-Unique: -jCBmDXFPJ64k39Nx1nrBQ-1 Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-40c2a43b0f3so40595565e9.2 for ; Tue, 12 Dec 2023 10:00:10 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1702404005; x=1703008805; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=Hi+Je7A1ir5Jf7RMpbBJ6wePhajEbToaWXnOvXBTaw4=; b=Yw6k0Duh4bVnUGh82/kgBUwA9qa2HD6a7CfvrPX2kHjLouGolwxoZAnkrOGQwcrz0o R5Du4DD8de+OHvWnGi3TzgwHpRL4ek9ntbkT17ittu+rw3da8HHSqDlCYM2B2QF9SpfQ i049A6Ru+zDuzCOUKKPY3rJ9VBDaCabBT11B54xPAzjNiewEYYygrj+sAGVUJd0Jp7A+ MuCgrDzee+YUjtubousb6qOH2JyPxpZsorq8CJ4b3ZlT/rxTumNpiOQFhoCGb9PZ82CV nu47+6czFB0gdBdJf8ClcwhCPQhx7GZKr2WzxC9KK4SZFHwk0T9xLOgX0BKoN3qrpJsU Q0XQ== X-Gm-Message-State: AOJu0YyaAUE3ws1Sejc+eCtPCoEFpdvHy+DadIHQeMTzcMk9foaFeKTe auR4tBQA040Vkw6piZPhXbhF7wVntdD2xnTBlDLbbqyPxWfxLd40rrIF4po+2a8wIjsXv5eiILr tt9qEURmyPYrgFS3qVDKeNmNpD79t/22EFti6 X-Received: by 2002:a05:600c:22d7:b0:40b:5f03:6f2f with SMTP id 23-20020a05600c22d700b0040b5f036f2fmr2295074wmg.265.1702404004886; Tue, 12 Dec 2023 10:00:04 -0800 (PST) X-Google-Smtp-Source: AGHT+IFSDxTS0Dbwm0yWFWvFpkddTtVCdD25MSkyGCWfgQkzixXvX6A/om8nqxSeqL3MjgQ1Ea26IA== X-Received: by 2002:a05:600c:22d7:b0:40b:5f03:6f2f with SMTP id 23-20020a05600c22d700b0040b5f036f2fmr2295066wmg.265.1702404004421; Tue, 12 Dec 2023 10:00:04 -0800 (PST) Received: from redhat.com ([2.52.23.105]) by smtp.gmail.com with ESMTPSA id c17-20020a05600c0a5100b0040b4fca8620sm19831250wmq.37.2023.12.12.10.00.01 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 12 Dec 2023 10:00:03 -0800 (PST) Date: Tue, 12 Dec 2023 12:59:59 -0500 From: "Michael S. Tsirkin" To: Casey Schaufler Cc: Maxime Coquelin , jasowang@redhat.com, xuanzhuo@linux.alibaba.com, paul@paul-moore.com, jmorris@namei.org, serge@hallyn.com, stephen.smalley.work@gmail.com, eparis@parisplace.org, xieyongji@bytedance.com, virtualization@lists.linux-foundation.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org, david.marchand@redhat.com, lulu@redhat.com Subject: Re: [PATCH v5 4/4] vduse: Add LSM hook to check Virtio device type Message-ID: <20231212124518-mutt-send-email-mst@kernel.org> References: <20231212131712.1816324-1-maxime.coquelin@redhat.com> <20231212131712.1816324-5-maxime.coquelin@redhat.com> Precedence: bulk X-Mailing-List: linux-security-module@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 In-Reply-To: X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=us-ascii Content-Disposition: inline On Tue, Dec 12, 2023 at 08:33:39AM -0800, Casey Schaufler wrote: > On 12/12/2023 5:17 AM, Maxime Coquelin wrote: > > This patch introduces a LSM hook for devices creation, > > destruction (ioctl()) and opening (open()) operations, > > checking the application is allowed to perform these > > operations for the Virtio device type. > > My earlier comments on a vduse specific LSM hook still hold. > I would much prefer to see a device permissions hook(s) that > are useful for devices in general. Not just vduse devices. > I know that there are already some very special purpose LSM > hooks, but the experience with maintaining them is why I don't > want more of them. What exactly does this mean? Devices like tap etc? How do we find them all though? > > > > Signed-off-by: Maxime Coquelin > > --- > > MAINTAINERS | 1 + > > drivers/vdpa/vdpa_user/vduse_dev.c | 13 ++++++++++++ > > include/linux/lsm_hook_defs.h | 2 ++ > > include/linux/security.h | 6 ++++++ > > include/linux/vduse.h | 14 +++++++++++++ > > security/security.c | 15 ++++++++++++++ > > security/selinux/hooks.c | 32 +++++++++++++++++++++++++++++ > > security/selinux/include/classmap.h | 2 ++ > > 8 files changed, 85 insertions(+) > > create mode 100644 include/linux/vduse.h > > > > diff --git a/MAINTAINERS b/MAINTAINERS > > index a0fb0df07b43..4e83b14358d2 100644 > > --- a/MAINTAINERS > > +++ b/MAINTAINERS > > @@ -23040,6 +23040,7 @@ F: drivers/net/virtio_net.c > > F: drivers/vdpa/ > > F: drivers/virtio/ > > F: include/linux/vdpa.h > > +F: include/linux/vduse.h > > F: include/linux/virtio*.h > > F: include/linux/vringh.h > > F: include/uapi/linux/virtio_*.h > > diff --git a/drivers/vdpa/vdpa_user/vduse_dev.c b/drivers/vdpa/vdpa_user/vduse_dev.c > > index fa62825be378..59ab7eb62e20 100644 > > --- a/drivers/vdpa/vdpa_user/vduse_dev.c > > +++ b/drivers/vdpa/vdpa_user/vduse_dev.c > > @@ -8,6 +8,7 @@ > > * > > */ > > > > +#include "linux/security.h" > > #include > > #include > > #include > > @@ -30,6 +31,7 @@ > > #include > > #include > > #include > > +#include > > > > #include "iova_domain.h" > > > > @@ -1442,6 +1444,10 @@ static int vduse_dev_open(struct inode *inode, struct file *file) > > if (dev->connected) > > goto unlock; > > > > + ret = -EPERM; > > + if (security_vduse_perm_check(VDUSE_PERM_OPEN, dev->device_id)) > > + goto unlock; > > + > > ret = 0; > > dev->connected = true; > > file->private_data = dev; > > @@ -1664,6 +1670,9 @@ static int vduse_destroy_dev(char *name) > > if (!dev) > > return -EINVAL; > > > > + if (security_vduse_perm_check(VDUSE_PERM_DESTROY, dev->device_id)) > > + return -EPERM; > > + > > mutex_lock(&dev->lock); > > if (dev->vdev || dev->connected) { > > mutex_unlock(&dev->lock); > > @@ -1828,6 +1837,10 @@ static int vduse_create_dev(struct vduse_dev_config *config, > > int ret; > > struct vduse_dev *dev; > > > > + ret = -EPERM; > > + if (security_vduse_perm_check(VDUSE_PERM_CREATE, config->device_id)) > > + goto err; > > + > > ret = -EEXIST; > > if (vduse_find_dev(config->name)) > > goto err; > > diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h > > index ff217a5ce552..3930ab2ae974 100644 > > --- a/include/linux/lsm_hook_defs.h > > +++ b/include/linux/lsm_hook_defs.h > > @@ -419,3 +419,5 @@ LSM_HOOK(int, 0, uring_override_creds, const struct cred *new) > > LSM_HOOK(int, 0, uring_sqpoll, void) > > LSM_HOOK(int, 0, uring_cmd, struct io_uring_cmd *ioucmd) > > #endif /* CONFIG_IO_URING */ > > + > > +LSM_HOOK(int, 0, vduse_perm_check, enum vduse_op_perm op_perm, u32 device_id) > > diff --git a/include/linux/security.h b/include/linux/security.h > > index 1d1df326c881..2a2054172394 100644 > > --- a/include/linux/security.h > > +++ b/include/linux/security.h > > @@ -32,6 +32,7 @@ > > #include > > #include > > #include > > +#include > > > > struct linux_binprm; > > struct cred; > > @@ -484,6 +485,7 @@ int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen); > > int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); > > int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen); > > int security_locked_down(enum lockdown_reason what); > > +int security_vduse_perm_check(enum vduse_op_perm op_perm, u32 device_id); > > #else /* CONFIG_SECURITY */ > > > > static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data) > > @@ -1395,6 +1397,10 @@ static inline int security_locked_down(enum lockdown_reason what) > > { > > return 0; > > } > > +static inline int security_vduse_perm_check(enum vduse_op_perm op_perm, u32 device_id) > > +{ > > + return 0; > > +} > > #endif /* CONFIG_SECURITY */ > > > > #if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE) > > diff --git a/include/linux/vduse.h b/include/linux/vduse.h > > new file mode 100644 > > index 000000000000..7a20dcc43997 > > --- /dev/null > > +++ b/include/linux/vduse.h > > @@ -0,0 +1,14 @@ > > +/* SPDX-License-Identifier: GPL-2.0 */ > > +#ifndef _LINUX_VDUSE_H > > +#define _LINUX_VDUSE_H > > + > > +/* > > + * The permission required for a VDUSE device operation. > > + */ > > +enum vduse_op_perm { > > + VDUSE_PERM_CREATE, > > + VDUSE_PERM_DESTROY, > > + VDUSE_PERM_OPEN, > > +}; > > + > > +#endif /* _LINUX_VDUSE_H */ > > diff --git a/security/security.c b/security/security.c > > index dcb3e7014f9b..150abf85f97d 100644 > > --- a/security/security.c > > +++ b/security/security.c > > @@ -5337,3 +5337,18 @@ int security_uring_cmd(struct io_uring_cmd *ioucmd) > > return call_int_hook(uring_cmd, 0, ioucmd); > > } > > #endif /* CONFIG_IO_URING */ > > + > > +/** > > + * security_vduse_perm_check() - Check if a VDUSE device type operation is allowed > > + * @op_perm: the operation type > > + * @device_id: the Virtio device ID > > + * > > + * Check whether the Virtio device creation is allowed > > + * > > + * Return: Returns 0 if permission is granted. > > + */ > > +int security_vduse_perm_check(enum vduse_op_perm op_perm, u32 device_id) > > +{ > > + return call_int_hook(vduse_perm_check, 0, op_perm, device_id); > > +} > > +EXPORT_SYMBOL(security_vduse_perm_check); > > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > > index feda711c6b7b..18845e4f682f 100644 > > --- a/security/selinux/hooks.c > > +++ b/security/selinux/hooks.c > > @@ -21,6 +21,8 @@ > > * Copyright (C) 2016 Mellanox Technologies > > */ > > > > +#include "av_permissions.h" > > +#include "linux/vduse.h" > > #include > > #include > > #include > > @@ -92,6 +94,7 @@ > > #include > > #include > > #include > > +#include > > > > #include "avc.h" > > #include "objsec.h" > > @@ -6950,6 +6953,34 @@ static int selinux_uring_cmd(struct io_uring_cmd *ioucmd) > > } > > #endif /* CONFIG_IO_URING */ > > > > +static int selinux_vduse_perm_check(enum vduse_op_perm op_perm, u32 device_id) > > +{ > > + u32 requested_op, requested_type, sid = current_sid(); > > + int ret; > > + > > + if (op_perm == VDUSE_PERM_CREATE) > > + requested_op = VDUSE__CREATE; > > + else if (op_perm == VDUSE__DESTROY) > > + requested_op = VDUSE__DESTROY; > > + else if (op_perm == VDUSE_PERM_OPEN) > > + requested_op = VDUSE__OPEN; > > + else > > + return -EINVAL; > > + > > + ret = avc_has_perm(sid, sid, SECCLASS_VDUSE, requested_op, NULL); > > + if (ret) > > + return ret; > > + > > + if (device_id == VIRTIO_ID_NET) > > + requested_type = VDUSE__NET; > > + else if (device_id == VIRTIO_ID_BLOCK) > > + requested_type = VDUSE__BLOCK; > > + else > > + return -EINVAL; > > + > > + return avc_has_perm(sid, sid, SECCLASS_VDUSE, requested_type, NULL); > > +} > > + > > /* > > * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order: > > * 1. any hooks that don't belong to (2.) or (3.) below, > > @@ -7243,6 +7274,7 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = { > > #ifdef CONFIG_PERF_EVENTS > > LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc), > > #endif > > + LSM_HOOK_INIT(vduse_perm_check, selinux_vduse_perm_check), > > }; > > > > static __init int selinux_init(void) > > diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h > > index a3c380775d41..b0a358cbac1c 100644 > > --- a/security/selinux/include/classmap.h > > +++ b/security/selinux/include/classmap.h > > @@ -256,6 +256,8 @@ const struct security_class_mapping secclass_map[] = { > > { "override_creds", "sqpoll", "cmd", NULL } }, > > { "user_namespace", > > { "create", NULL } }, > > + { "vduse", > > + { "create", "destroy", "open", "net", "block", NULL} }, > > { NULL } > > }; > >