Re: [RFC PATCH v3 5/6] kernel: add KAP checks for unshare and setns

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] security: kap: CLONE_NEWUSER skip in
  kap_check_namespace_flags() breaks user:unshare rules
--

commit 9adc8e1a3a53f48cafa9cf1ec8d4bd24d0a65150
Author: HARIHARA SUDHAN. R <harisudhan@armoriq.io>

kernel: add KAP checks for unshare and setns

This commit adds KAP namespace flag checks to ksys_unshare() and the setns
syscall.

> diff --git a/kernel/fork.c b/kernel/fork.c
> index 33760ece3bb30..3dda9f211ceae 100644
> --- a/kernel/fork.c
> +++ b/kernel/fork.c
[ ... ]
> @@ -3286,6 +3287,9 @@ int ksys_unshare(unsigned long unshare_flags)
>  			 current->fs != current->real_fs);
>  
>  	err = check_unshare_flags(unshare_flags);
> +	if (err)
> +		goto bad_unshare_out;
> +	err = kap_check_namespace_flags(unshare_flags, "unshare");
>  	if (err)
>  		goto bad_unshare_out;
>  	/*

[Severity: High]
Does kap_check_namespace_flags() fail to enforce "user:unshare" and "user:*"
predicates when unshare() is called with CLONE_NEWUSER?

security/kap/kap_lsm.c:kap_check_namespace_flags() {
	...
		if (kap_namespaces[i].flag == CLONE_NEWUSER &&
		    strcmp(operation, "setns"))
			continue;
	...
}

Because kap_check_namespace_flags() skips CLONE_NEWUSER for "unshare", the
check is deferred to kap_userns_create(), which passes the bare target string
"user" to kap_check_static_target().  In kap_string_match(), "user" does not
match "user:unshare" or "user:*", so allow rules using the documented
TYPE:OPERATION syntax reject unshare(CLONE_NEWUSER) with -EACCES, while deny
rules for "user:unshare" or "user:*" paired with a broad allow rule such as
"*" are bypassed.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261110202246.274-1-harisudhan@armoriq.io?part=5