From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751591AbbJOIEd (ORCPT ); Thu, 15 Oct 2015 04:04:33 -0400 Received: from smtp102.biz.mail.bf1.yahoo.com ([98.139.221.61]:22064 "EHLO smtp102.biz.mail.bf1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751421AbbJOIEZ (ORCPT ); Thu, 15 Oct 2015 04:04:25 -0400 X-Yahoo-Newman-Property: ymail-4 X-YMail-OSG: MIZwaZAVM1nJLpzlXodt.aV7M7PID.3yK0z9fNtciJoalcm 6sZyzb41_VXxug1Qe5PPBGqHVTvc5UsTrqUHX0KopGxMpi9IWPP4pHNflg.v 8By_iBIBEg0HKtMaAF3fwGeZKUaIq93iivgNgMZEmyV5vdrzrezT2dEzu2Qa lloHgYs3Sf_LJJp1n0X6.79CSIj5s.GdC7nacZGUmmJX582KgKSLRJ5Sfmtt W_3vCHXoQUXfQPufq5bqWf6AEK8jm981ZsccV3MRpdNdIPzYRVu5mwvyMdPW VLNBmjnOdZtNxrHp0ePANc1BnnkgHhxVj6fCx2a.tjQEO7r2T2AW2PzosQgg S8ilS75GWvRjWi4RNUsCT.UriSgEsTranxZnM5aZ8bo.jmsu54LtqTFHcFC0 ULiKcIxZOClXUgdv.1OAmuKIwbmtjWUI9tXAKRvIyNSGs9rLFFRwB.JUioNL z2ow0coGcPgAsICt1i_fvbm7jtYcRaaqICk9pQMEWnvGUwPZt5nlbZT4Tllu uXVqAE0peHetsGPG63I227YRQpfjXyBO_AluESvewDOAUoCREYgxTuxQPOQo zKWx3biip X-Yahoo-SMTP: OIJXglSswBDfgLtXluJ6wiAYv6_cnw-- Subject: Re: [PATCH v4] Smack: limited capability for changing process label To: =?UTF-8?Q?Rafa=c5=82_Krypa?= References: <1444838083-890-1-git-send-email-r.krypa@samsung.com> <561F5A65.8070502@samsung.com> Cc: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Zbigniew Jasinski , Tomasz Swierczek , Casey Schaufler From: Casey Schaufler Message-ID: <561F5E02.1080505@schaufler-ca.com> Date: Thu, 15 Oct 2015 01:04:18 -0700 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.3.0 MIME-Version: 1.0 In-Reply-To: <561F5A65.8070502@samsung.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 10/15/2015 12:48 AM, Rafał Krypa wrote: > On 2015-10-14 17:54, Rafal Krypa wrote: >> From: Zbigniew Jasinski >> >> This feature introduces new kernel interface: >> >> - /relabel-self - for setting transition labels list >> >> This list is used to control smack label transition mechanism. >> List is set by, and per process. Process can transit to new label only if >> label is on the list. Only process with CAP_MAC_ADMIN capability can add >> labels to this list. With this list, process can change it's label without >> CAP_MAC_ADMIN but only once. After label changing, list is unset. >> >> Changes in v2: >> * use list_for_each_entry instead of _rcu during label write >> * added missing description in security/Smack.txt >> >> Changes in v3: >> * squashed into one commit >> >> Changes in v4: >> * switch from global list to per-task list >> * since the per-task list is accessed only by the task itself >> there is no need to use synchronization mechanisms on it >> >> Signed-off-by: Zbigniew Jasinski >> Signed-off-by: Rafal Krypa >> --- >> Documentation/security/Smack.txt | 14 ++++ >> security/smack/smack.h | 3 +- >> security/smack/smack_access.c | 6 +- >> security/smack/smack_lsm.c | 73 ++++++++++++++++- >> security/smack/smackfs.c | 167 ++++++++++++++++++++++++++++++++++++--- >> 5 files changed, 246 insertions(+), 17 deletions(-) >> >> diff --git a/Documentation/security/Smack.txt b/Documentation/security/Smack.txt >> index 5e6d07f..d9ace08 100644 >> --- a/Documentation/security/Smack.txt >> +++ b/Documentation/security/Smack.txt >> @@ -255,6 +255,20 @@ unconfined >> the access permitted if it wouldn't be otherwise. Note that this >> is dangerous and can ruin the proper labeling of your system. >> It should never be used in production. >> +relabel-self >> + This interface contains a list of labels to which the process can >> + transition to, by writing to /proc/self/attr/current. >> + Normally a process can change its own label to any legal value, but only >> + if it has CAP_MAC_ADMIN. This interface allows a process without >> + CAP_MAC_ADMIN to relabel itself to one of labels from predefined list. >> + A process without CAP_MAC_ADMIN can change its label only once. When it >> + does, this list will be cleared. >> + >> + The format accepted on write is: >> + "%s" >> + for adding label, and: >> + "-%s" >> + for removing label from list. > I have one concern here, let me make some self-criticism. > The interface described here for relabel-self is convenient and suiting actual needs of user space parts that are going to use it. > But it is inconsistent with other existing interfaces in smackfs. Recently I submitted a patch (merged into v4.2) that extended onlycap to allow multiple labels in it. > The smackfs interface for onlycap always takes the full list of labels that replaces the list that was previously set. > Now relabel-self is also going to contain a list of labels. But smackfs interface gets one label at a time and performs add/remove operations. > > Are you OK. with such inconsistency? > A foolish consistency is the hobgoblin of little minds. More directly, I am fine with it. Some of your previous work made removing labels from lists practical where it had not been before. I would rather have an inconsistent interface set than one that is consistently bad.