[RFC PATCH 1/2] apparmor: mediate file-generated signals

[RFC PATCH 1/2] apparmor: mediate file-generated signals

[Shi Lecun]

File-generated SIGIO and SIGURG notifications use file_send_sigiotask
rather than task_kill. AppArmor does not implement that hook, so its
signal send and receive rules are not enforced on this path. A profile
that denies SIGIO reception can therefore still receive an asynchronous
pipe notification even though a direct kill() is denied.

Save the credentials of the task that sets the file owner and use them
as the sender identity at delivery. Resolve the newest sender and
recipient labels, and use aa_may_signal() to enforce both send and
receive rules. Treat a zero signal argument as SIGIO.

Use the existing fown lock to protect the saved credentials. Replace
the reference when ownership is set again and drop it when the file is
destroyed. The task triggering I/O need not be the owner setter, and
delivery can run in interrupt context, so current cannot identify the
sender.

QEMU/KVM tests on v7.4-rc1 cover send/receive denials, allowed signals,
F_SETSIG, process-group and TID owners, profile transitions, ownership
replacement, unconfined senders and TCP urgent notifications. A separate
fcntl fix handles the case where queuing a configured signal fails and
delivery falls back to an unchecked SIGIO.

Fixes: cd1dbf76b23d ("apparmor: add the ability to mediate signals")
Signed-off-by: Shi Lecun <shilc2025@mail.sustech.edu.cn>
---
 security/apparmor/include/file.h |  2 ++
 security/apparmor/lsm.c          | 41 +++++++++++++++++++++++++++++++-
 2 files changed, 42 insertions(+), 1 deletion(-)

diff --git a/security/apparmor/include/file.h b/security/apparmor/include/file.h
index 1614c07fc53e..c638baf7b9c0 100644
--- a/security/apparmor/include/file.h
+++ b/security/apparmor/include/file.h
@@ -37,11 +37,13 @@ static inline struct aa_file_ctx *file_ctx(struct file *file)
 /* struct aa_file_ctx - the AppArmor context the file was opened in
  * @lock: lock to update the ctx
  * @label: label currently cached on the ctx
+ * @fown_cred: credentials of the file owner setter, protected by fown->lock
  * @perms: the permission the file was opened with
  */
 struct aa_file_ctx {
 	spinlock_t lock;
 	struct aa_label __rcu *label;
+	const struct cred *fown_cred;
 	u32 allow;
 };
 
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
index eaebc3c60c5a..b1c4e82463e2 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -522,8 +522,45 @@ static void apparmor_file_free_security(struct file *file)
 {
 	struct aa_file_ctx *ctx = file_ctx(file);
 
-	if (ctx)
+	if (ctx) {
 		aa_put_label(rcu_access_pointer(ctx->label));
+		put_cred(ctx->fown_cred);
+	}
+}
+
+static void apparmor_file_set_fowner(struct file *file)
+{
+	struct aa_file_ctx *ctx = file_ctx(file);
+	const struct cred *old;
+
+	lockdep_assert_held(&file_f_owner(file)->lock);
+	old = ctx->fown_cred;
+	ctx->fown_cred = get_current_cred();
+	put_cred(old);
+}
+
+static int apparmor_file_send_sigiotask(struct task_struct *target,
+					struct fown_struct *fown, int sig)
+{
+	const struct cred *cred, *tc;
+	struct aa_label *sender, *receiver;
+	int error;
+
+	/* Delivery can run in interrupt context, unrelated to the setter. */
+	lockdep_assert_held(&fown->lock);
+	cred = file_ctx(fown->file)->fown_cred;
+	if (!cred)
+		return 0;
+
+	tc = get_task_cred(target);
+	sender = aa_get_newest_cred_label(cred);
+	receiver = aa_get_newest_cred_label(tc);
+	error = aa_may_signal(cred, sender, tc, receiver, sig ? sig : SIGIO);
+	aa_put_label(receiver);
+	aa_put_label(sender);
+	put_cred(tc);
+
+	return error;
 }
 
 static int common_file_perm(const char *op, struct file *file, u32 mask)
@@ -1810,6 +1847,8 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = {
 	LSM_HOOK_INIT(file_permission, apparmor_file_permission),
 	LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security),
 	LSM_HOOK_INIT(file_free_security, apparmor_file_free_security),
+	LSM_HOOK_INIT(file_set_fowner, apparmor_file_set_fowner),
+	LSM_HOOK_INIT(file_send_sigiotask, apparmor_file_send_sigiotask),
 	LSM_HOOK_INIT(mmap_file, apparmor_mmap_file),
 	LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect),
 	LSM_HOOK_INIT(file_lock, apparmor_file_lock),
-- 
2.56.0

[RFC PATCH 2/2] fcntl: recheck signal permissions before falling back to SIGIO

[Shi Lecun]

F_SETSIG allows a file owner to request a signal other than SIGIO.
send_sigio_to_task() checks permission for the configured signal, but
if queuing fails, it falls back to SIGIO without checking permission
for the fallback. Permission for the configured signal does not imply
permission for SIGIO.

Recheck permission before falling back from a different signal to
SIGIO. Keep the existing behavior when SIGIO itself has already been
checked.

This was reproduced on x86-64 QEMU/KVM with AppArmor file signal
mediation added: a recipient allowed a real-time signal but denied
SIGIO reception and set RLIMIT_SIGPENDING to zero. Queuing the
real-time signal failed, and the denied SIGIO was delivered. With this
change, the fallback SIGIO is blocked; allowing SIGIO still permits
fallback.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Shi Lecun <shilc2025@mail.sustech.edu.cn>
---
 fs/fcntl.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/fs/fcntl.c b/fs/fcntl.c
index 9b71bc9d71d1..5b0c912264ca 100644
--- a/fs/fcntl.c
+++ b/fs/fcntl.c
@@ -904,6 +904,9 @@ static void send_sigio_to_task(struct task_struct *p,
 			si.si_fd    = fd;
 			if (!do_send_sig_info(signum, &si, p, type))
 				break;
+			/* The fallback signal may have different permissions. */
+			if (signum != SIGIO && !sigio_perm(p, fown, SIGIO))
+				break;
 		}
 			fallthrough;	/* fall back on the old plain SIGIO signal */
 		case 0:
-- 
2.56.0

Re: [RFC PATCH 2/2] fcntl: recheck signal permissions before falling back to SIGIO

[sashiko-bot]

> F_SETSIG allows a file owner to request a signal other than SIGIO.
> send_sigio_to_task() checks permission for the configured signal, but
> if queuing fails, it falls back to SIGIO without checking permission
> for the fallback. Permission for the configured signal does not imply
> permission for SIGIO.
> 
> Recheck permission before falling back from a different signal to
> SIGIO. Keep the existing behavior when SIGIO itself has already been
> checked.
> 
> This was reproduced on x86-64 QEMU/KVM with AppArmor file signal
> mediation added: a recipient allowed a real-time signal but denied
> SIGIO reception and set RLIMIT_SIGPENDING to zero. Queuing the
> real-time signal failed, and the denied SIGIO was delivered. With this
> change, the fallback SIGIO is blocked; allowing SIGIO still permits
> fallback.
> 
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Signed-off-by: Shi Lecun <shilc2025@mail.sustech.edu.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/B01DC8398B429509+20261107154928.3519030-2-shilc2025@mail.sustech.edu.cn?part=2

Re: [RFC PATCH 1/2] apparmor: mediate file-generated signals

[sashiko-bot]

> File-generated SIGIO and SIGURG notifications use file_send_sigiotask
> rather than task_kill. AppArmor does not implement that hook, so its
> signal send and receive rules are not enforced on this path. A profile
> that denies SIGIO reception can therefore still receive an asynchronous
> pipe notification even though a direct kill() is denied.
> 
> Save the credentials of the task that sets the file owner and use them
> as the sender identity at delivery. Resolve the newest sender and
> recipient labels, and use aa_may_signal() to enforce both send and
> receive rules. Treat a zero signal argument as SIGIO.
> 
> Use the existing fown lock to protect the saved credentials. Replace
> the reference when ownership is set again and drop it when the file is
> destroyed. The task triggering I/O need not be the owner setter, and
> delivery can run in interrupt context, so current cannot identify the
> sender.
> 
> QEMU/KVM tests on v7.4-rc1 cover send/receive denials, allowed signals,
> F_SETSIG, process-group and TID owners, profile transitions, ownership
> replacement, unconfined senders and TCP urgent notifications. A separate
> fcntl fix handles the case where queuing a configured signal fails and
> delivery falls back to an unchecked SIGIO.
> 
> Fixes: cd1dbf76b23d ("apparmor: add the ability to mediate signals")
> Signed-off-by: Shi Lecun <shilc2025@mail.sustech.edu.cn>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/B01DC8398B429509+20261107154928.3519030-2-shilc2025@mail.sustech.edu.cn?part=1