From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-11.4 required=3.0 tests=DKIMWL_WL_MED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS,USER_AGENT_GIT,USER_IN_DEF_DKIM_WL autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 34D4DC3B187 for ; Tue, 11 Feb 2020 22:56:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 09F892082F for ; Tue, 11 Feb 2020 22:56:12 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="lRBeat1D" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727740AbgBKW4L (ORCPT ); Tue, 11 Feb 2020 17:56:11 -0500 Received: from mail-pf1-f202.google.com ([209.85.210.202]:46856 "EHLO mail-pf1-f202.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727199AbgBKW4L (ORCPT ); Tue, 11 Feb 2020 17:56:11 -0500 Received: by mail-pf1-f202.google.com with SMTP id c185so141691pfb.13 for ; Tue, 11 Feb 2020 14:56:09 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20161025; h=date:message-id:mime-version:subject:from:to; bh=z5hBZFlukE73X5tySesJV8jPEinxyOGgZx3qCpc+FhQ=; b=lRBeat1DM/6m8wVzhtbw3NbGYuXI5jrNZCMDH2bkPtPkorENZSb/rNayT9WHqeuj4z XNiVPVGX2pusznQ1ujf8QR2xOyBI/+zE5DN9wxiuYLG6WE5+drIQepezj2KwFMRbrZXL 9pht2m3MheSA4XZzOWTsaYLJbHT7vKjw/CecQE80mFpR3gYzIRcVZib11+kBT1jsexEe 6NcsyOlB/MGz7sS46G6OcUah1YEZi0GWN+npoLpF03tNcuX0eDaTYVVCBNhYAe7EM1DI GODlU6IlhvIVeuAEmd/Ih1Nu8CS43QgX1CsO4cXY4B2rg23HINcAnFHVQYeurJwrhMJN F/Jg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:date:message-id:mime-version:subject:from:to; bh=z5hBZFlukE73X5tySesJV8jPEinxyOGgZx3qCpc+FhQ=; b=mZ1gtIyIu+ZxpUpri439vBNaAUFtfNSta4UFP9dCDvpBT3Vt2Bux2+lUSwcg4KvrjB WPRT3nvHsqlpxe2e+9+am1XnJNIwJVFAApwaieI38U9xahKssYuz5nVa5cu2ksDcMlQS hc8hg0erJcf8U5Vp8C3OucXKhAhsPTpdVtWfZ17cOmdG/G0cSfRSnhWVBNjZFWMI9Qyj qDngcIZB/ZKiOi7SJBlAgCyD7jo7tjp57zdnaIJoR07l5SgndqMQa5wYM3MkUSGGcS+r QzgjJbm1pBADxb23WDBelJI97k+kCithtUNhCt59EoZbVqxPFzDq7jJFZQsYJOSNoEke hV7g== X-Gm-Message-State: APjAAAVf4khZe08GqbTMEqrWZxfuOnXzWw62Dl2ooeFQD/Fl+geUTurQ h3NFLj3HM3wBMr1MVt6nekyadiMetl4= X-Google-Smtp-Source: APXvYqz3X0ton3FvOV+uorjZiWOGrdx8y9Xd27MZc3lIrLJXDLMtq+k4O5/wHZSBlOtX5wMSTKh//psjJJc= X-Received: by 2002:a65:420b:: with SMTP id c11mr5419343pgq.306.1581461769152; Tue, 11 Feb 2020 14:56:09 -0800 (PST) Date: Tue, 11 Feb 2020 14:55:41 -0800 Message-Id: <20200211225547.235083-1-dancol@google.com> Mime-Version: 1.0 X-Mailer: git-send-email 2.25.0.225.g125e21ebc7-goog Subject: [PATCH v2 0/6] Harden userfaultfd From: Daniel Colascione To: dancol@google.com, timmurray@google.com, nosh@google.com, nnk@google.com, lokeshgidra@google.com, linux-kernel@vger.kernel.org, linux-api@vger.kernel.org, selinux@vger.kernel.org Content-Type: text/plain; charset="UTF-8" Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Userfaultfd in unprivileged contexts could be potentially very useful. We'd like to harden userfaultfd to make such unprivileged use less risky. This patch series allows SELinux to manage userfaultfd file descriptors and allows administrators to limit userfaultfd to servicing user-mode faults, increasing the difficulty of using userfaultfd in exploit chains invoking delaying kernel faults. A new anon_inodes interface allows callers to opt into SELinux management of anonymous file objects. In this mode, anon_inodes creates new ephemeral inodes for anonymous file objects instead of reusing a singleton dummy inode. A new LSM hook gives security modules an opportunity to configure and veto these ephemeral inodes. Existing anon_inodes users must opt into the new functionality. Daniel Colascione (6): Add a new flags-accepting interface for anonymous inodes Add a concept of a "secure" anonymous file Teach SELinux about a new userfaultfd class Wire UFFD up to SELinux Let userfaultfd opt out of handling kernel-mode faults Add a new sysctl for limiting userfaultfd to user mode faults Documentation/admin-guide/sysctl/vm.rst | 13 ++++ fs/anon_inodes.c | 89 +++++++++++++++++-------- fs/userfaultfd.c | 29 ++++++-- include/linux/anon_inodes.h | 27 ++++++-- include/linux/lsm_hooks.h | 8 +++ include/linux/security.h | 2 + include/linux/userfaultfd_k.h | 3 + include/uapi/linux/userfaultfd.h | 9 +++ kernel/sysctl.c | 9 +++ security/security.c | 8 +++ security/selinux/hooks.c | 68 +++++++++++++++++++ security/selinux/include/classmap.h | 2 + 12 files changed, 229 insertions(+), 38 deletions(-) -- 2.25.0.225.g125e21ebc7-goog