summaryrefslogtreecommitdiffstats
path: root/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0019-Smack-Rationalize-mount-restrictions.patch
diff options
context:
space:
mode:
authorYannick GICQUEL <yannick.gicquel@iot.bzh>2015-10-19 15:57:07 +0200
committerGerrit Code Review <gerrit@172.30.200.200>2015-11-06 15:23:36 +0000
commitede19ea0c47fb23f3fc779833d1e57cf76f3371e (patch)
tree47d6fae2283c54def1871aaf2a73828ac68b1b34 /meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0019-Smack-Rationalize-mount-restrictions.patch
parent1cd8ab18abca96e4ee108f80225058d875b28347 (diff)
kernel: smack security backport from kernel 4
Here is the backport of all patches relating to smack support on kernel side. For more details, see file: meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/README Please note that patches are applied only if "smack" is in the ditro features. Here are the 2 lines to add in the local.conf OVERRIDES .= ":smack" DISTRO_FEATURES_append = " smack" Change-Id: I147a3532aec531f977d6ec34c576261835711f1e Signed-off-by: Yannick GICQUEL <yannick.gicquel@iot.bzh> Signed-off-by: José Bollo <jose.bollo@iot.bzh>
Diffstat (limited to 'meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0019-Smack-Rationalize-mount-restrictions.patch')
-rw-r--r--meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0019-Smack-Rationalize-mount-restrictions.patch185
1 files changed, 185 insertions, 0 deletions
diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0019-Smack-Rationalize-mount-restrictions.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0019-Smack-Rationalize-mount-restrictions.patch
new file mode 100644
index 0000000..ca3fabe
--- /dev/null
+++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0019-Smack-Rationalize-mount-restrictions.patch
@@ -0,0 +1,185 @@
+From 4f315dddfeb6f5aadad30d85bf4374b4e05c6e43 Mon Sep 17 00:00:00 2001
+From: Casey Schaufler <casey@schaufler-ca.com>
+Date: Mon, 30 Dec 2013 09:38:00 -0800
+Subject: [PATCH 19/54] Smack: Rationalize mount restrictions
+
+The mount restrictions imposed by Smack rely heavily on the
+use of the filesystem "floor", which is the label that all
+processes writing to the filesystem must have access to. It
+turns out that while the "floor" notion is sound, it has yet
+to be fully implemented and has never been used.
+
+The sb_mount and sb_umount hooks only make sense if the
+filesystem floor is used actively, and it isn't. They can
+be reintroduced if a rational restriction comes up. Until
+then, they get removed.
+
+The sb_kern_mount hook is required for the option processing.
+It is too permissive in the case of unprivileged mounts,
+effectively bypassing the CAP_MAC_ADMIN restrictions if
+any of the smack options are specified. Unprivileged mounts
+are no longer allowed to set Smack filesystem options.
+Additionally, the root and default values are set to the
+label of the caller, in keeping with the policy that objects
+get the label of their creator.
+
+Targeted for git://git.gitorious.org/smack-next/kernel.git
+
+Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
+---
+ security/smack/smack_lsm.c | 83 ++++++++++++++++------------------------------
+ 1 file changed, 29 insertions(+), 54 deletions(-)
+
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 67b7381d..d552832 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -229,7 +229,7 @@ static int smack_syslog(int typefrom_file)
+ if (smack_privileged(CAP_MAC_OVERRIDE))
+ return 0;
+
+- if (smack_syslog_label != NULL && smack_syslog_label != skp)
++ if (smack_syslog_label != NULL && smack_syslog_label != skp)
+ rc = -EACCES;
+
+ return rc;
+@@ -339,10 +339,12 @@ static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data)
+ struct inode *inode = root->d_inode;
+ struct superblock_smack *sp = sb->s_security;
+ struct inode_smack *isp;
++ struct smack_known *skp;
+ char *op;
+ char *commap;
+ char *nsp;
+ int transmute = 0;
++ int specified = 0;
+
+ if (sp->smk_initialized)
+ return 0;
+@@ -357,34 +359,56 @@ static int smack_sb_kern_mount(struct super_block *sb, int flags, void *data)
+ if (strncmp(op, SMK_FSHAT, strlen(SMK_FSHAT)) == 0) {
+ op += strlen(SMK_FSHAT);
+ nsp = smk_import(op, 0);
+- if (nsp != NULL)
++ if (nsp != NULL) {
+ sp->smk_hat = nsp;
++ specified = 1;
++ }
+ } else if (strncmp(op, SMK_FSFLOOR, strlen(SMK_FSFLOOR)) == 0) {
+ op += strlen(SMK_FSFLOOR);
+ nsp = smk_import(op, 0);
+- if (nsp != NULL)
++ if (nsp != NULL) {
+ sp->smk_floor = nsp;
++ specified = 1;
++ }
+ } else if (strncmp(op, SMK_FSDEFAULT,
+ strlen(SMK_FSDEFAULT)) == 0) {
+ op += strlen(SMK_FSDEFAULT);
+ nsp = smk_import(op, 0);
+- if (nsp != NULL)
++ if (nsp != NULL) {
+ sp->smk_default = nsp;
++ specified = 1;
++ }
+ } else if (strncmp(op, SMK_FSROOT, strlen(SMK_FSROOT)) == 0) {
+ op += strlen(SMK_FSROOT);
+ nsp = smk_import(op, 0);
+- if (nsp != NULL)
++ if (nsp != NULL) {
+ sp->smk_root = nsp;
++ specified = 1;
++ }
+ } else if (strncmp(op, SMK_FSTRANS, strlen(SMK_FSTRANS)) == 0) {
+ op += strlen(SMK_FSTRANS);
+ nsp = smk_import(op, 0);
+ if (nsp != NULL) {
+ sp->smk_root = nsp;
+ transmute = 1;
++ specified = 1;
+ }
+ }
+ }
+
++ if (!smack_privileged(CAP_MAC_ADMIN)) {
++ /*
++ * Unprivileged mounts don't get to specify Smack values.
++ */
++ if (specified)
++ return -EPERM;
++ /*
++ * Unprivileged mounts get root and default from the caller.
++ */
++ skp = smk_of_current();
++ sp->smk_root = skp->smk_known;
++ sp->smk_default = skp->smk_known;
++ }
+ /*
+ * Initialize the root inode.
+ */
+@@ -421,53 +445,6 @@ static int smack_sb_statfs(struct dentry *dentry)
+ return rc;
+ }
+
+-/**
+- * smack_sb_mount - Smack check for mounting
+- * @dev_name: unused
+- * @path: mount point
+- * @type: unused
+- * @flags: unused
+- * @data: unused
+- *
+- * Returns 0 if current can write the floor of the filesystem
+- * being mounted on, an error code otherwise.
+- */
+-static int smack_sb_mount(const char *dev_name, struct path *path,
+- const char *type, unsigned long flags, void *data)
+-{
+- struct superblock_smack *sbp = path->dentry->d_sb->s_security;
+- struct smk_audit_info ad;
+-
+- smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
+- smk_ad_setfield_u_fs_path(&ad, *path);
+-
+- return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad);
+-}
+-
+-/**
+- * smack_sb_umount - Smack check for unmounting
+- * @mnt: file system to unmount
+- * @flags: unused
+- *
+- * Returns 0 if current can write the floor of the filesystem
+- * being unmounted, an error code otherwise.
+- */
+-static int smack_sb_umount(struct vfsmount *mnt, int flags)
+-{
+- struct superblock_smack *sbp;
+- struct smk_audit_info ad;
+- struct path path;
+-
+- path.dentry = mnt->mnt_root;
+- path.mnt = mnt;
+-
+- smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_PATH);
+- smk_ad_setfield_u_fs_path(&ad, path);
+-
+- sbp = path.dentry->d_sb->s_security;
+- return smk_curacc(sbp->smk_floor, MAY_WRITE, &ad);
+-}
+-
+ /*
+ * BPRM hooks
+ */
+@@ -3762,8 +3739,6 @@ struct security_operations smack_ops = {
+ .sb_copy_data = smack_sb_copy_data,
+ .sb_kern_mount = smack_sb_kern_mount,
+ .sb_statfs = smack_sb_statfs,
+- .sb_mount = smack_sb_mount,
+- .sb_umount = smack_sb_umount,
+
+ .bprm_set_creds = smack_bprm_set_creds,
+ .bprm_committing_creds = smack_bprm_committing_creds,
+--
+2.1.4
+