securityfs.c 8.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345
  1. // SPDX-License-Identifier: GPL-2.0
  2. /*
  3. * SafeSetID Linux Security Module
  4. *
  5. * Author: Micah Morton <mortonm@chromium.org>
  6. *
  7. * Copyright (C) 2018 The Chromium OS Authors.
  8. *
  9. * This program is free software; you can redistribute it and/or modify
  10. * it under the terms of the GNU General Public License version 2, as
  11. * published by the Free Software Foundation.
  12. *
  13. */
  14. #define pr_fmt(fmt) "SafeSetID: " fmt
  15. #include <linux/security.h>
  16. #include <linux/cred.h>
  17. #include "lsm.h"
  18. static DEFINE_MUTEX(uid_policy_update_lock);
  19. static DEFINE_MUTEX(gid_policy_update_lock);
  20. /*
  21. * In the case the input buffer contains one or more invalid IDs, the kid_t
  22. * variables pointed to by @parent and @child will get updated but this
  23. * function will return an error.
  24. * Contents of @buf may be modified.
  25. */
  26. static int parse_policy_line(struct file *file, char *buf,
  27. struct setid_rule *rule)
  28. {
  29. char *child_str;
  30. int ret;
  31. u32 parsed_parent, parsed_child;
  32. /* Format of |buf| string should be <UID>:<UID> or <GID>:<GID> */
  33. child_str = strchr(buf, ':');
  34. if (child_str == NULL)
  35. return -EINVAL;
  36. *child_str = '\0';
  37. child_str++;
  38. ret = kstrtou32(buf, 0, &parsed_parent);
  39. if (ret)
  40. return ret;
  41. ret = kstrtou32(child_str, 0, &parsed_child);
  42. if (ret)
  43. return ret;
  44. if (rule->type == UID){
  45. rule->src_id.uid = make_kuid(file->f_cred->user_ns, parsed_parent);
  46. rule->dst_id.uid = make_kuid(file->f_cred->user_ns, parsed_child);
  47. if (!uid_valid(rule->src_id.uid) || !uid_valid(rule->dst_id.uid))
  48. return -EINVAL;
  49. } else if (rule->type == GID){
  50. rule->src_id.gid = make_kgid(file->f_cred->user_ns, parsed_parent);
  51. rule->dst_id.gid = make_kgid(file->f_cred->user_ns, parsed_child);
  52. if (!gid_valid(rule->src_id.gid) || !gid_valid(rule->dst_id.gid))
  53. return -EINVAL;
  54. } else {
  55. /* Error, rule->type is an invalid type */
  56. return -EINVAL;
  57. }
  58. return 0;
  59. }
  60. static void __release_ruleset(struct rcu_head *rcu)
  61. {
  62. struct setid_ruleset *pol =
  63. container_of(rcu, struct setid_ruleset, rcu);
  64. int bucket;
  65. struct setid_rule *rule;
  66. struct hlist_node *tmp;
  67. hash_for_each_safe(pol->rules, bucket, tmp, rule, next)
  68. kfree(rule);
  69. kfree(pol->policy_str);
  70. kfree(pol);
  71. }
  72. static void release_ruleset(struct setid_ruleset *pol){
  73. call_rcu(&pol->rcu, __release_ruleset);
  74. }
  75. static void insert_rule(struct setid_ruleset *pol, struct setid_rule *rule)
  76. {
  77. if (pol->type == UID)
  78. hash_add(pol->rules, &rule->next, __kuid_val(rule->src_id.uid));
  79. else if (pol->type == GID)
  80. hash_add(pol->rules, &rule->next, __kgid_val(rule->src_id.gid));
  81. else /* Error, pol->type is neither UID or GID */
  82. return;
  83. }
  84. static int verify_ruleset(struct setid_ruleset *pol)
  85. {
  86. int bucket;
  87. struct setid_rule *rule, *nrule;
  88. int res = 0;
  89. hash_for_each(pol->rules, bucket, rule, next) {
  90. if (_setid_policy_lookup(pol, rule->dst_id, INVALID_ID) == SIDPOL_DEFAULT) {
  91. if (pol->type == UID) {
  92. pr_warn("insecure policy detected: uid %d is constrained but transitively unconstrained through uid %d\n",
  93. __kuid_val(rule->src_id.uid),
  94. __kuid_val(rule->dst_id.uid));
  95. } else if (pol->type == GID) {
  96. pr_warn("insecure policy detected: gid %d is constrained but transitively unconstrained through gid %d\n",
  97. __kgid_val(rule->src_id.gid),
  98. __kgid_val(rule->dst_id.gid));
  99. } else { /* pol->type is an invalid type */
  100. res = -EINVAL;
  101. return res;
  102. }
  103. res = -EINVAL;
  104. /* fix it up */
  105. nrule = kmalloc(sizeof(struct setid_rule), GFP_KERNEL);
  106. if (!nrule)
  107. return -ENOMEM;
  108. if (pol->type == UID){
  109. nrule->src_id.uid = rule->dst_id.uid;
  110. nrule->dst_id.uid = rule->dst_id.uid;
  111. nrule->type = UID;
  112. } else { /* pol->type must be GID if we've made it to here */
  113. nrule->src_id.gid = rule->dst_id.gid;
  114. nrule->dst_id.gid = rule->dst_id.gid;
  115. nrule->type = GID;
  116. }
  117. insert_rule(pol, nrule);
  118. }
  119. }
  120. return res;
  121. }
  122. static ssize_t handle_policy_update(struct file *file,
  123. const char __user *ubuf, size_t len, enum setid_type policy_type)
  124. {
  125. struct setid_ruleset *pol;
  126. char *buf, *p, *end;
  127. int err;
  128. pol = kmalloc(sizeof(struct setid_ruleset), GFP_KERNEL);
  129. if (!pol)
  130. return -ENOMEM;
  131. pol->policy_str = NULL;
  132. pol->type = policy_type;
  133. hash_init(pol->rules);
  134. p = buf = memdup_user_nul(ubuf, len);
  135. if (IS_ERR(buf)) {
  136. err = PTR_ERR(buf);
  137. goto out_free_pol;
  138. }
  139. pol->policy_str = kstrdup(buf, GFP_KERNEL);
  140. if (pol->policy_str == NULL) {
  141. err = -ENOMEM;
  142. goto out_free_buf;
  143. }
  144. /* policy lines, including the last one, end with \n */
  145. while (*p != '\0') {
  146. struct setid_rule *rule;
  147. end = strchr(p, '\n');
  148. if (end == NULL) {
  149. err = -EINVAL;
  150. goto out_free_buf;
  151. }
  152. *end = '\0';
  153. rule = kmalloc(sizeof(struct setid_rule), GFP_KERNEL);
  154. if (!rule) {
  155. err = -ENOMEM;
  156. goto out_free_buf;
  157. }
  158. rule->type = policy_type;
  159. err = parse_policy_line(file, p, rule);
  160. if (err)
  161. goto out_free_rule;
  162. if (_setid_policy_lookup(pol, rule->src_id, rule->dst_id) == SIDPOL_ALLOWED) {
  163. pr_warn("bad policy: duplicate entry\n");
  164. err = -EEXIST;
  165. goto out_free_rule;
  166. }
  167. insert_rule(pol, rule);
  168. p = end + 1;
  169. continue;
  170. out_free_rule:
  171. kfree(rule);
  172. goto out_free_buf;
  173. }
  174. err = verify_ruleset(pol);
  175. /* bogus policy falls through after fixing it up */
  176. if (err && err != -EINVAL)
  177. goto out_free_buf;
  178. /*
  179. * Everything looks good, apply the policy and release the old one.
  180. * What we really want here is an xchg() wrapper for RCU, but since that
  181. * doesn't currently exist, just use a spinlock for now.
  182. */
  183. if (policy_type == UID) {
  184. mutex_lock(&uid_policy_update_lock);
  185. pol = rcu_replace_pointer(safesetid_setuid_rules, pol,
  186. lockdep_is_held(&uid_policy_update_lock));
  187. mutex_unlock(&uid_policy_update_lock);
  188. } else if (policy_type == GID) {
  189. mutex_lock(&gid_policy_update_lock);
  190. pol = rcu_replace_pointer(safesetid_setgid_rules, pol,
  191. lockdep_is_held(&gid_policy_update_lock));
  192. mutex_unlock(&gid_policy_update_lock);
  193. } else {
  194. /* Error, policy type is neither UID or GID */
  195. pr_warn("error: bad policy type");
  196. }
  197. err = len;
  198. out_free_buf:
  199. kfree(buf);
  200. out_free_pol:
  201. if (pol)
  202. release_ruleset(pol);
  203. return err;
  204. }
  205. static ssize_t safesetid_uid_file_write(struct file *file,
  206. const char __user *buf,
  207. size_t len,
  208. loff_t *ppos)
  209. {
  210. if (!file_ns_capable(file, &init_user_ns, CAP_MAC_ADMIN))
  211. return -EPERM;
  212. if (*ppos != 0)
  213. return -EINVAL;
  214. return handle_policy_update(file, buf, len, UID);
  215. }
  216. static ssize_t safesetid_gid_file_write(struct file *file,
  217. const char __user *buf,
  218. size_t len,
  219. loff_t *ppos)
  220. {
  221. if (!file_ns_capable(file, &init_user_ns, CAP_MAC_ADMIN))
  222. return -EPERM;
  223. if (*ppos != 0)
  224. return -EINVAL;
  225. return handle_policy_update(file, buf, len, GID);
  226. }
  227. static ssize_t safesetid_file_read(struct file *file, char __user *buf,
  228. size_t len, loff_t *ppos, struct mutex *policy_update_lock, struct __rcu setid_ruleset* ruleset)
  229. {
  230. ssize_t res = 0;
  231. struct setid_ruleset *pol;
  232. const char *kbuf;
  233. mutex_lock(policy_update_lock);
  234. pol = rcu_dereference_protected(ruleset, lockdep_is_held(policy_update_lock));
  235. if (pol) {
  236. kbuf = pol->policy_str;
  237. res = simple_read_from_buffer(buf, len, ppos,
  238. kbuf, strlen(kbuf));
  239. }
  240. mutex_unlock(policy_update_lock);
  241. return res;
  242. }
  243. static ssize_t safesetid_uid_file_read(struct file *file, char __user *buf,
  244. size_t len, loff_t *ppos)
  245. {
  246. return safesetid_file_read(file, buf, len, ppos,
  247. &uid_policy_update_lock, safesetid_setuid_rules);
  248. }
  249. static ssize_t safesetid_gid_file_read(struct file *file, char __user *buf,
  250. size_t len, loff_t *ppos)
  251. {
  252. return safesetid_file_read(file, buf, len, ppos,
  253. &gid_policy_update_lock, safesetid_setgid_rules);
  254. }
  255. static const struct file_operations safesetid_uid_file_fops = {
  256. .read = safesetid_uid_file_read,
  257. .write = safesetid_uid_file_write,
  258. };
  259. static const struct file_operations safesetid_gid_file_fops = {
  260. .read = safesetid_gid_file_read,
  261. .write = safesetid_gid_file_write,
  262. };
  263. static int __init safesetid_init_securityfs(void)
  264. {
  265. int ret;
  266. struct dentry *policy_dir;
  267. struct dentry *uid_policy_file;
  268. struct dentry *gid_policy_file;
  269. if (!safesetid_initialized)
  270. return 0;
  271. policy_dir = securityfs_create_dir("safesetid", NULL);
  272. if (IS_ERR(policy_dir)) {
  273. ret = PTR_ERR(policy_dir);
  274. goto error;
  275. }
  276. uid_policy_file = securityfs_create_file("uid_allowlist_policy", 0600,
  277. policy_dir, NULL, &safesetid_uid_file_fops);
  278. if (IS_ERR(uid_policy_file)) {
  279. ret = PTR_ERR(uid_policy_file);
  280. goto error;
  281. }
  282. gid_policy_file = securityfs_create_file("gid_allowlist_policy", 0600,
  283. policy_dir, NULL, &safesetid_gid_file_fops);
  284. if (IS_ERR(gid_policy_file)) {
  285. ret = PTR_ERR(gid_policy_file);
  286. goto error;
  287. }
  288. return 0;
  289. error:
  290. securityfs_remove(policy_dir);
  291. return ret;
  292. }
  293. fs_initcall(safesetid_init_securityfs);