* [PATCH 1/3] vfs: re-introduce MAY_CHDIR
@ 2010-04-09 22:13 Eric Paris
[not found] ` <20100409221352.2612.11909.stgit-E+B5uJFuEZf0UfVguI6niVaTQe2KTcn/@public.gmane.org>
0 siblings, 1 reply; 6+ messages in thread
From: Eric Paris @ 2010-04-09 22:13 UTC (permalink / raw)
To: selinux-+05T5uksL2qpZYMLLGbcSA
Cc: linux-fsdevel-u79uwXL29TY76Z2rM5mHXA,
jmorris-gx6/JNMH7DfYtjvyW6yDsg, sds-+05T5uksL2qpZYMLLGbcSA,
casey-iSGtlc1asvQWG2LlvL+J4A, viro@
Currently MAY_ACCESS means that filesystems must check the permissions
right then and not rely on cached results or the results of future
operations on the object. This can be because of a call to sys_access() or
because of a call to chdir() which needs to check search without relying on
any future operations inside that dir. I plan to use MAY_ACCESS for other
purposes in the security system, so I split the MAY_ACCESS and the
MAY_CHDIR cases.
Signed-off-by: Eric Paris <eparis-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
---
fs/fuse/dir.c | 2 +-
fs/nfs/dir.c | 2 +-
fs/open.c | 6 +++---
include/linux/fs.h | 1 +
4 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 4787ae6..7c8c55b 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1016,7 +1016,7 @@ static int fuse_permission(struct inode *inode, int mask)
exist. So if permissions are revoked this won't be
noticed immediately, only after the attribute
timeout has expired */
- } else if (mask & MAY_ACCESS) {
+ } else if (mask & (MAY_ACCESS | MAY_CHDIR)) {
err = fuse_access(inode, mask);
} else if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode)) {
if (!(inode->i_mode & S_IXUGO)) {
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index be46f26..4c7d8fc 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1927,7 +1927,7 @@ int nfs_permission(struct inode *inode, int mask)
if ((mask & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
goto out;
/* Is this sys_access() ? */
- if (mask & MAY_ACCESS)
+ if (mask & (MAY_ACCESS | MAY_CHDIR))
goto force_lookup;
switch (inode->i_mode & S_IFMT) {
diff --git a/fs/open.c b/fs/open.c
index b93eac3..d01e116 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -534,7 +534,7 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename)
if (error)
goto out;
- error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_ACCESS);
+ error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_CHDIR);
if (error)
goto dput_and_out;
@@ -563,7 +563,7 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
if (!S_ISDIR(inode->i_mode))
goto out_putf;
- error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
+ error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
if (!error)
set_fs_pwd(current->fs, &file->f_path);
out_putf:
@@ -581,7 +581,7 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename)
if (error)
goto out;
- error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_ACCESS);
+ error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_CHDIR);
if (error)
goto dput_and_out;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 14d8597..188d3e4 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -53,6 +53,7 @@ struct inodes_stat_t {
#define MAY_APPEND 8
#define MAY_ACCESS 16
#define MAY_OPEN 32
+#define MAY_CHDIR 64
/*
* flags in file.f_mode. Note that FMODE_READ and FMODE_WRITE must correspond
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 1/3] vfs: re-introduce MAY_CHDIR
@ 2010-04-09 22:16 Eric Paris
2010-04-09 22:16 ` [PATCH 2/3] security: make LSMs explicitly mask off permissions Eric Paris
0 siblings, 1 reply; 6+ messages in thread
From: Eric Paris @ 2010-04-09 22:16 UTC (permalink / raw)
To: selinux; +Cc: linux-fsdevel, jmorris, sds, casey, viro
Currently MAY_ACCESS means that filesystems must check the permissions
right then and not rely on cached results or the results of future
operations on the object. This can be because of a call to sys_access() or
because of a call to chdir() which needs to check search without relying on
any future operations inside that dir. I plan to use MAY_ACCESS for other
purposes in the security system, so I split the MAY_ACCESS and the
MAY_CHDIR cases.
Signed-off-by: Eric Paris <eparis@redhat.com>
---
fs/fuse/dir.c | 2 +-
fs/nfs/dir.c | 2 +-
fs/open.c | 6 +++---
include/linux/fs.h | 1 +
4 files changed, 6 insertions(+), 5 deletions(-)
diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
index 4787ae6..7c8c55b 100644
--- a/fs/fuse/dir.c
+++ b/fs/fuse/dir.c
@@ -1016,7 +1016,7 @@ static int fuse_permission(struct inode *inode, int mask)
exist. So if permissions are revoked this won't be
noticed immediately, only after the attribute
timeout has expired */
- } else if (mask & MAY_ACCESS) {
+ } else if (mask & (MAY_ACCESS | MAY_CHDIR)) {
err = fuse_access(inode, mask);
} else if ((mask & MAY_EXEC) && S_ISREG(inode->i_mode)) {
if (!(inode->i_mode & S_IXUGO)) {
diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
index be46f26..4c7d8fc 100644
--- a/fs/nfs/dir.c
+++ b/fs/nfs/dir.c
@@ -1927,7 +1927,7 @@ int nfs_permission(struct inode *inode, int mask)
if ((mask & (MAY_READ | MAY_WRITE | MAY_EXEC)) == 0)
goto out;
/* Is this sys_access() ? */
- if (mask & MAY_ACCESS)
+ if (mask & (MAY_ACCESS | MAY_CHDIR))
goto force_lookup;
switch (inode->i_mode & S_IFMT) {
diff --git a/fs/open.c b/fs/open.c
index b93eac3..d01e116 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -534,7 +534,7 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename)
if (error)
goto out;
- error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_ACCESS);
+ error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_CHDIR);
if (error)
goto dput_and_out;
@@ -563,7 +563,7 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd)
if (!S_ISDIR(inode->i_mode))
goto out_putf;
- error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
+ error = inode_permission(inode, MAY_EXEC | MAY_CHDIR);
if (!error)
set_fs_pwd(current->fs, &file->f_path);
out_putf:
@@ -581,7 +581,7 @@ SYSCALL_DEFINE1(chroot, const char __user *, filename)
if (error)
goto out;
- error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_ACCESS);
+ error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_CHDIR);
if (error)
goto dput_and_out;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 14d8597..188d3e4 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -53,6 +53,7 @@ struct inodes_stat_t {
#define MAY_APPEND 8
#define MAY_ACCESS 16
#define MAY_OPEN 32
+#define MAY_CHDIR 64
/*
* flags in file.f_mode. Note that FMODE_READ and FMODE_WRITE must correspond
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/3] security: make LSMs explicitly mask off permissions
2010-04-09 22:16 [PATCH 1/3] vfs: re-introduce MAY_CHDIR Eric Paris
@ 2010-04-09 22:16 ` Eric Paris
2010-04-11 17:37 ` Casey Schaufler
[not found] ` <20100409221621.2681.15115.stgit-E+B5uJFuEZf0UfVguI6niVaTQe2KTcn/@public.gmane.org>
0 siblings, 2 replies; 6+ messages in thread
From: Eric Paris @ 2010-04-09 22:16 UTC (permalink / raw)
To: selinux; +Cc: linux-fsdevel, jmorris, sds, casey, viro
SELinux needs to pass the MAY_ACCESS flag so it can handle auditting
correctly. Presently the masking of MAY_* flags is done in the VFS. In
order to allow LSMs to decide what flags they care about and what flags
they don't just pass them all and the each LSM mask off what they don't
need. This patch should contain no functional changes to either the VFS or
any LSM.
Signed-off-by: Eric Paris <eparis@redhat.com>
---
fs/namei.c | 3 +--
security/selinux/hooks.c | 2 ++
security/smack/smack_lsm.c | 2 ++
3 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/fs/namei.c b/fs/namei.c
index f068192..3b0f583 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -282,8 +282,7 @@ int inode_permission(struct inode *inode, int mask)
if (retval)
return retval;
- return security_inode_permission(inode,
- mask & (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND));
+ return security_inode_permission(inode, mask);
}
/**
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 740a71f..344ba62 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -2700,6 +2700,8 @@ static int selinux_inode_permission(struct inode *inode, int mask)
{
const struct cred *cred = current_cred();
+ mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
+
if (!mask) {
/* No permission to check. Existence test. */
return 0;
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index f1b6846..df467f4 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -599,6 +599,8 @@ static int smack_inode_rename(struct inode *old_inode,
static int smack_inode_permission(struct inode *inode, int mask)
{
struct smk_audit_info ad;
+
+ mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
/*
* No permission to check. Existence test. Yup, it's there.
*/
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH 2/3] security: make LSMs explicitly mask off permissions
2010-04-09 22:16 ` [PATCH 2/3] security: make LSMs explicitly mask off permissions Eric Paris
@ 2010-04-11 17:37 ` Casey Schaufler
[not found] ` <20100409221621.2681.15115.stgit-E+B5uJFuEZf0UfVguI6niVaTQe2KTcn/@public.gmane.org>
1 sibling, 0 replies; 6+ messages in thread
From: Casey Schaufler @ 2010-04-11 17:37 UTC (permalink / raw)
To: Eric Paris; +Cc: selinux, linux-fsdevel, jmorris, sds, viro, Casey Schaufler
Eric Paris wrote:
> SELinux needs to pass the MAY_ACCESS flag so it can handle auditting
> correctly.
I'm not sure that I like the direction this is heading. Excesses
of granularity don't come about from a single change like this,
but from their repeated application and tendency to inspire others
to see breaking out special cases as an easy quick fix.
> Presently the masking of MAY_* flags is done in the VFS. In
> order to allow LSMs to decide what flags they care about and what flags
> they don't just pass them all and the each LSM mask off what they don't
> need. This patch should contain no functional changes to either the VFS or
> any LSM.
>
> Signed-off-by: Eric Paris <eparis@redhat.com>
>
I'm acking this not because I like the approach but because I don't
see it as causing any damage and I don't have a better solution to
the audit problem that wouldn't require a redesign of SELinux.
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
> ---
>
> fs/namei.c | 3 +--
> security/selinux/hooks.c | 2 ++
> security/smack/smack_lsm.c | 2 ++
> 3 files changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/fs/namei.c b/fs/namei.c
> index f068192..3b0f583 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -282,8 +282,7 @@ int inode_permission(struct inode *inode, int mask)
> if (retval)
> return retval;
>
> - return security_inode_permission(inode,
> - mask & (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND));
> + return security_inode_permission(inode, mask);
> }
>
> /**
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 740a71f..344ba62 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -2700,6 +2700,8 @@ static int selinux_inode_permission(struct inode *inode, int mask)
> {
> const struct cred *cred = current_cred();
>
> + mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
> +
> if (!mask) {
> /* No permission to check. Existence test. */
> return 0;
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index f1b6846..df467f4 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -599,6 +599,8 @@ static int smack_inode_rename(struct inode *old_inode,
> static int smack_inode_permission(struct inode *inode, int mask)
> {
> struct smk_audit_info ad;
> +
> + mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
> /*
> * No permission to check. Existence test. Yup, it's there.
> */
>
>
>
^ permalink raw reply [flat|nested] 6+ messages in thread[parent not found: <20100409221621.2681.15115.stgit-E+B5uJFuEZf0UfVguI6niVaTQe2KTcn/@public.gmane.org>]
* Re: [PATCH 2/3] security: make LSMs explicitly mask off permissions
[not found] ` <20100409221621.2681.15115.stgit-E+B5uJFuEZf0UfVguI6niVaTQe2KTcn/@public.gmane.org>
@ 2010-04-27 12:47 ` Stephen Smalley
0 siblings, 0 replies; 6+ messages in thread
From: Stephen Smalley @ 2010-04-27 12:47 UTC (permalink / raw)
To: Eric Paris
Cc: selinux-+05T5uksL2qpZYMLLGbcSA,
linux-fsdevel-u79uwXL29TY76Z2rM5mHXA,
jmorris-gx6/JNMH7DfYtjvyW6yDsg, casey-iSGtlc1asvQWG2LlvL+J4A,
viro-RmSDqhL/yNMiFSDQTTA3OLVCufUGDwFn
On Fri, 2010-04-09 at 18:16 -0400, Eric Paris wrote:
> SELinux needs to pass the MAY_ACCESS flag so it can handle auditting
> correctly. Presently the masking of MAY_* flags is done in the VFS. In
> order to allow LSMs to decide what flags they care about and what flags
> they don't just pass them all and the each LSM mask off what they don't
> need. This patch should contain no functional changes to either the VFS or
> any LSM.
>
> Signed-off-by: Eric Paris <eparis-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
Acked-by: Stephen Smalley <sds-+05T5uksL2qpZYMLLGbcSA@public.gmane.org>
> ---
>
> fs/namei.c | 3 +--
> security/selinux/hooks.c | 2 ++
> security/smack/smack_lsm.c | 2 ++
> 3 files changed, 5 insertions(+), 2 deletions(-)
>
> diff --git a/fs/namei.c b/fs/namei.c
> index f068192..3b0f583 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -282,8 +282,7 @@ int inode_permission(struct inode *inode, int mask)
> if (retval)
> return retval;
>
> - return security_inode_permission(inode,
> - mask & (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND));
> + return security_inode_permission(inode, mask);
> }
>
> /**
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index 740a71f..344ba62 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -2700,6 +2700,8 @@ static int selinux_inode_permission(struct inode *inode, int mask)
> {
> const struct cred *cred = current_cred();
>
> + mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
> +
> if (!mask) {
> /* No permission to check. Existence test. */
> return 0;
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index f1b6846..df467f4 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -599,6 +599,8 @@ static int smack_inode_rename(struct inode *old_inode,
> static int smack_inode_permission(struct inode *inode, int mask)
> {
> struct smk_audit_info ad;
> +
> + mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
> /*
> * No permission to check. Existence test. Yup, it's there.
> */
>
>
> --
> This message was distributed to subscribers of the selinux mailing list.
> If you no longer wish to subscribe, send mail to majordomo-+05T5uksL2qpZYMLLGbcSA@public.gmane.org with
> the words "unsubscribe selinux" without quotes as the message.
--
Stephen Smalley
National Security Agency
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2010-04-27 12:47 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2010-04-09 22:13 [PATCH 1/3] vfs: re-introduce MAY_CHDIR Eric Paris
[not found] ` <20100409221352.2612.11909.stgit-E+B5uJFuEZf0UfVguI6niVaTQe2KTcn/@public.gmane.org>
2010-04-09 22:13 ` [PATCH 2/3] security: make LSMs explicitly mask off permissions Eric Paris
2010-04-09 22:14 ` [PATCH 3/3] SELinux: special dontaudit for access checks Eric Paris
-- strict thread matches above, loose matches on Subject: below --
2010-04-09 22:16 [PATCH 1/3] vfs: re-introduce MAY_CHDIR Eric Paris
2010-04-09 22:16 ` [PATCH 2/3] security: make LSMs explicitly mask off permissions Eric Paris
2010-04-11 17:37 ` Casey Schaufler
[not found] ` <20100409221621.2681.15115.stgit-E+B5uJFuEZf0UfVguI6niVaTQe2KTcn/@public.gmane.org>
2010-04-27 12:47 ` Stephen Smalley
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).