Re: [patch 0/4] MAP_NOZERO v2 - VM_NOZERO/MAP_NOZERO early summer madness

Kyle Moffett
2007-07-01T00:22:11Z

On Jun 30, 2007, at 19:57:18, Davide Libenzi wrote:
> On Sat, 30 Jun 2007, Kyle Moffett wrote:
>> Very simple case: SELinux is turned on, an s9 (IE: TOP_SECRET)
>> process calls free(), and an s3 (IE: UNCLASSIFIED) process calls
>> malloc(), getting the data from the TOP_SECRET process.
>
> Note that you use *s3* and *s9*. Those will be two different
> context cookies. SeLinux will have its own way to set the cookie
> in the mm_struct, to *s3* in one case, and to *s9* in the other
> case. This will make things so that they'll never see each other
> pages.

Except s3 and s9 aren't complete cookies. A complete label might be:
"system_u:system_r:apache2_t:s3" for an unclassified apache web-
server process, or "kmoffett_u:secadmin_r:usershell_t:s9" for me
logged in with a top-secret label in my security-administrator role.
That's why you'd need to call an LSM hook to get a unique identifier,
as the LSM would actually need to allocate identifiers for
equivalence classes. Secondly, processes may change labels as they
run, so you couldn't just call it once and cache the result, you
would need to call it for every freed page (or every re-use of a page).

>>> It is very easy, assuming a simple unsigned long cookie is enough
>>> for
>>> SeLinux, to fit in the current MAP_NOZERO. Well, we have to change
>>> something in the current struct page _mapcount reuse, but that
>>> doable. There
>>> is one line to change, that is the line where the cookie is
>>> assigned to the
>>> mm_struct.

I do think a single unsigned long cookie would work, as long as you
have an LSM hook:

int process_equivalence_class(struct task_struct *task, unsigned long
*result);

If it returns 0 then you can use the result as a page cookie,
otherwise you can't reuse pages for this process at all.

Cheers,
Kyle Moffett