security: Protection for exploiting null dereference using mmap

Add a new security check on mmap operations to see if the user is attempting to mmap to low area of the address space. The amount of space protected is indicated by the new proc tunable /proc/sys/vm/mmap_min_addr and defaults to 0, preserving existing behavior. This patch uses a new SELinux security class "memprotect." Policy already contains a number of allow rules like a_t self:process * (unconfined_t being one of them) which mean that putting this check in the process class (its best current fit) would make it useless as all user processes, which we also want to protect against, would be allowed. By taking the memprotect name of the new class it will also make it possible for us to move some of the other memory protect permissions out of 'process' and into the new class next time we bump the policy version number (which I also think is a good future idea) Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>

security: Protection for exploiting null dereference using mmap
Add a new security check on mmap operations to see if the user is attempting to mmap to low area of the address space. The amount of space protected is indicated by the new proc tunable /proc/sys/vm/mmap_min_addr and defaults to 0, preserving existing behavior. This patch uses a new SELinux security class "memprotect." Policy already contains a number of allow rules like a_t self:process * (unconfined_t being one of them) which mean that putting this check in the process class (its best current fit) would make it useless as all user processes, which we also want to protect against, would be allowed. By taking the memprotect name of the new class it will also make it possible for us to move some of the other memory protect permissions out of 'process' and into the new class next time we bump the policy version number (which I also think is a good future idea) Acked-by: Stephen Smalley <sds@tycho.nsa.gov> Acked-by: Chris Wright <chrisw@sous-sol.org> Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>
Eric Paris · James Morris
1 parent 13bddc2e9d
Showing 13 changed files with 70 additions and 15 deletions Side-by-side Diff
Documentation/sysctl/vm.txt
include/linux/security.h
kernel/sysctl.c
mm/mmap.c
mm/mremap.c
mm/nommu.c
security/dummy.c
security/security.c
security/selinux/hooks.c
security/selinux/include/av_perm_to_string.h
security/selinux/include/av_permissions.h
security/selinux/include/class_to_string.h
security/selinux/include/flask.h
@@ -31,6 +31,7 @@
 - min_unmapped_ratio
 - min_slab_ratio
 - panic_on_oom
+- mmap_min_address
  
 ==============================================================
  
@@ -216,4 +217,17 @@
 The default value is 0.
 1 and 2 are for failover of clustering. Please select either
 according to your policy of failover.
+
+==============================================================
+
+mmap_min_addr
+
+This file indicates the amount of address space  which a user process will
+be restricted from mmaping.  Since kernel null dereference bugs could
+accidentally operate based on the information in the first couple of pages
+of memory userspace processes should not be allowed to write to them.  By
+default this value is set to 0 and no protections will be enforced by the
+security module.  Setting this value to something like 64k will allow the
+vast majority of applications to work correctly and provide defense in depth
+against future potential kernel bugs.
@@ -71,6 +71,7 @@
 extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);
 extern int cap_netlink_recv(struct sk_buff *skb, int cap);
  
+extern unsigned long mmap_min_addr;
 /*
  * Values used in the task_security_ops calls
  */
@@ -1241,8 +1242,9 @@
 	int (*file_ioctl) (struct file * file, unsigned int cmd,
 			   unsigned long arg);
 	int (*file_mmap) (struct file * file,
-			  unsigned long reqprot,
-			  unsigned long prot, unsigned long flags);
+			  unsigned long reqprot, unsigned long prot,
+			  unsigned long flags, unsigned long addr,
+			  unsigned long addr_only);
 	int (*file_mprotect) (struct vm_area_struct * vma,
 			      unsigned long reqprot,
 			      unsigned long prot);
  
@@ -1814,9 +1816,12 @@
  
 static inline int security_file_mmap (struct file *file, unsigned long reqprot,
 				      unsigned long prot,
-				      unsigned long flags)
+				      unsigned long flags,
+				      unsigned long addr,
+				      unsigned long addr_only)
 {
-	return security_ops->file_mmap (file, reqprot, prot, flags);
+	return security_ops->file_mmap (file, reqprot, prot, flags, addr,
+					addr_only);
 }
  
 static inline int security_file_mprotect (struct vm_area_struct *vma,
@@ -2489,7 +2494,9 @@
  
 static inline int security_file_mmap (struct file *file, unsigned long reqprot,
 				      unsigned long prot,
-				      unsigned long flags)
+				      unsigned long flags,
+				      unsigned long addr,
+				      unsigned long addr_only)
 {
 	return 0;
 }
@@ -949,6 +949,16 @@
 		.strategy	= &sysctl_jiffies,
 	},
 #endif
+#ifdef CONFIG_SECURITY
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "mmap_min_addr",
+		.data		= &mmap_min_addr,
+		.maxlen         = sizeof(unsigned long),
+		.mode		= 0644,
+		.proc_handler	= &proc_doulongvec_minmax,
+	},
+#endif
 #if defined(CONFIG_X86_32) || \
    (defined(CONFIG_SUPERH) && defined(CONFIG_VSYSCALL))
 	{
@@ -1023,10 +1023,10 @@
 		}
 	}
  
-	error = security_file_mmap(file, reqprot, prot, flags);
+	error = security_file_mmap(file, reqprot, prot, flags, addr, 0);
 	if (error)
 		return error;
-		
+
 	/* Clear old maps */
 	error = -ENOMEM;
 munmap_back:
@@ -291,6 +291,10 @@
 		if ((addr <= new_addr) && (addr+old_len) > new_addr)
 			goto out;
  
+		ret = security_file_mmap(0, 0, 0, 0, new_addr, 1);
+		if (ret)
+			goto out;
+
 		ret = do_munmap(mm, new_addr, new_len);
 		if (ret)
 			goto out;
@@ -390,8 +394,13 @@
  
 			new_addr = get_unmapped_area(vma->vm_file, 0, new_len,
 						vma->vm_pgoff, map_flags);
-			ret = new_addr;
-			if (new_addr & ~PAGE_MASK)
+			if (new_addr & ~PAGE_MASK) {
+				ret = new_addr;
+				goto out;
+			}
+
+			ret = security_file_mmap(0, 0, 0, 0, new_addr, 1);
+			if (ret)
 				goto out;
 		}
 		ret = move_vma(vma, addr, old_len, new_len, new_addr);
@@ -639,7 +639,7 @@
 	}
  
 	/* allow the security API to have its say */
-	ret = security_file_mmap(file, reqprot, prot, flags);
+	ret = security_file_mmap(file, reqprot, prot, flags, addr, 0);
 	if (ret < 0)
 		return ret;
  
@@ -420,8 +420,12 @@
  
 static int dummy_file_mmap (struct file *file, unsigned long reqprot,
 			    unsigned long prot,
-			    unsigned long flags)
+			    unsigned long flags,
+			    unsigned long addr,
+			    unsigned long addr_only)
 {
+	if (addr < mmap_min_addr)
+		return -EACCES;
 	return 0;
 }
  
@@ -24,6 +24,7 @@
 extern void security_fixup_ops(struct security_operations *ops);
  
 struct security_operations *security_ops;	/* Initialized to NULL */
+unsigned long mmap_min_addr;		/* 0 means no protection */
  
 static inline int verify(struct security_operations *ops)
 {
@@ -176,5 +177,6 @@
 EXPORT_SYMBOL_GPL(unregister_security);
 EXPORT_SYMBOL_GPL(mod_reg_security);
 EXPORT_SYMBOL_GPL(mod_unreg_security);
+EXPORT_SYMBOL_GPL(mmap_min_addr);
 EXPORT_SYMBOL(security_ops);
@@ -2569,12 +2569,16 @@
 }
  
 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
-			     unsigned long prot, unsigned long flags)
+			     unsigned long prot, unsigned long flags,
+			     unsigned long addr, unsigned long addr_only)
 {
-	int rc;
+	int rc = 0;
+	u32 sid = ((struct task_security_struct*)(current->security))->sid;
  
-	rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
-	if (rc)
+	if (addr < mmap_min_addr)
+		rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
+				  MEMPROTECT__MMAP_ZERO, NULL);
+	if (rc || addr_only)
 		return rc;
  
 	if (selinux_checkreqprot)
@@ -158,4 +158,5 @@
    S_(SECCLASS_KEY, KEY__CREATE, "create")
    S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NODE_BIND, "node_bind")
    S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NAME_CONNECT, "name_connect")
+   S_(SECCLASS_MEMPROTECT, MEMPROTECT__MMAP_ZERO, "mmap_zero")
@@ -823,4 +823,5 @@
 #define DCCP_SOCKET__NAME_BIND                    0x00200000UL
 #define DCCP_SOCKET__NODE_BIND                    0x00400000UL
 #define DCCP_SOCKET__NAME_CONNECT                 0x00800000UL
+#define MEMPROTECT__MMAP_ZERO                     0x00000001UL
@@ -63,4 +63,5 @@
     S_("key")
     S_(NULL)
     S_("dccp_socket")
+    S_("memprotect")
@@ -49,6 +49,7 @@
 #define SECCLASS_PACKET                                  57
 #define SECCLASS_KEY                                     58
 #define SECCLASS_DCCP_SOCKET                             60
+#define SECCLASS_MEMPROTECT                              61
  
 /*
  * Security identifier indices for initial entities
...	...	@@ -31,6 +31,7 @@
31	31	- min_unmapped_ratio
32	32	- min_slab_ratio
33	33	- panic_on_oom
	34	+- mmap_min_address
34	35
35	36	==============================================================
36	37
...	...	@@ -216,4 +217,17 @@
216	217	The default value is 0.
217	218	1 and 2 are for failover of clustering. Please select either
218	219	according to your policy of failover.
	220	+
	221	+==============================================================
	222	+
	223	+mmap_min_addr
	224	+
	225	+This file indicates the amount of address space which a user process will
	226	+be restricted from mmaping. Since kernel null dereference bugs could
	227	+accidentally operate based on the information in the first couple of pages
	228	+of memory userspace processes should not be allowed to write to them. By
	229	+default this value is set to 0 and no protections will be enforced by the
	230	+security module. Setting this value to something like 64k will allow the
	231	+vast majority of applications to work correctly and provide defense in depth
	232	+against future potential kernel bugs.
...	...	@@ -71,6 +71,7 @@
71	71	extern int cap_netlink_send(struct sock sk, struct sk_buff skb);
72	72	extern int cap_netlink_recv(struct sk_buff *skb, int cap);
73	73
	74	+extern unsigned long mmap_min_addr;
74	75	/*
75	76	* Values used in the task_security_ops calls
76	77	*/
...	...	@@ -1241,8 +1242,9 @@
1241	1242	int (file_ioctl) (struct file file, unsigned int cmd,
1242	1243	unsigned long arg);
1243	1244	int (file_mmap) (struct file file,
1244		- unsigned long reqprot,
1245		- unsigned long prot, unsigned long flags);
	1245	+ unsigned long reqprot, unsigned long prot,
	1246	+ unsigned long flags, unsigned long addr,
	1247	+ unsigned long addr_only);
1246	1248	int (file_mprotect) (struct vm_area_struct vma,
1247	1249	unsigned long reqprot,
1248	1250	unsigned long prot);
1249	1251
...	...	@@ -1814,9 +1816,12 @@
1814	1816
1815	1817	static inline int security_file_mmap (struct file *file, unsigned long reqprot,
1816	1818	unsigned long prot,
1817		- unsigned long flags)
	1819	+ unsigned long flags,
	1820	+ unsigned long addr,
	1821	+ unsigned long addr_only)
1818	1822	{
1819		- return security_ops->file_mmap (file, reqprot, prot, flags);
	1823	+ return security_ops->file_mmap (file, reqprot, prot, flags, addr,
	1824	+ addr_only);
1820	1825	}
1821	1826
1822	1827	static inline int security_file_mprotect (struct vm_area_struct *vma,
...	...	@@ -2489,7 +2494,9 @@
2489	2494
2490	2495	static inline int security_file_mmap (struct file *file, unsigned long reqprot,
2491	2496	unsigned long prot,
2492		- unsigned long flags)
	2497	+ unsigned long flags,
	2498	+ unsigned long addr,
	2499	+ unsigned long addr_only)
2493	2500	{
2494	2501	return 0;
2495	2502	}
...	...	@@ -949,6 +949,16 @@
949	949	.strategy = &sysctl_jiffies,
950	950	},
951	951	#endif
	952	+#ifdef CONFIG_SECURITY
	953	+ {
	954	+ .ctl_name = CTL_UNNUMBERED,
	955	+ .procname = "mmap_min_addr",
	956	+ .data = &mmap_min_addr,
	957	+ .maxlen = sizeof(unsigned long),
	958	+ .mode = 0644,
	959	+ .proc_handler = &proc_doulongvec_minmax,
	960	+ },
	961	+#endif
952	962	#if defined(CONFIG_X86_32) \|\| \
953	963	(defined(CONFIG_SUPERH) && defined(CONFIG_VSYSCALL))
954	964	{
...	...	@@ -1023,10 +1023,10 @@
1023	1023	}
1024	1024	}
1025	1025
1026		- error = security_file_mmap(file, reqprot, prot, flags);
	1026	+ error = security_file_mmap(file, reqprot, prot, flags, addr, 0);
1027	1027	if (error)
1028	1028	return error;
1029		-
	1029	+
1030	1030	/* Clear old maps */
1031	1031	error = -ENOMEM;
1032	1032	munmap_back:
...	...	@@ -291,6 +291,10 @@
291	291	if ((addr <= new_addr) && (addr+old_len) > new_addr)
292	292	goto out;
293	293
	294	+ ret = security_file_mmap(0, 0, 0, 0, new_addr, 1);
	295	+ if (ret)
	296	+ goto out;
	297	+
294	298	ret = do_munmap(mm, new_addr, new_len);
295	299	if (ret)
296	300	goto out;
...	...	@@ -390,8 +394,13 @@
390	394
391	395	new_addr = get_unmapped_area(vma->vm_file, 0, new_len,
392	396	vma->vm_pgoff, map_flags);
393		- ret = new_addr;
394		- if (new_addr & ~PAGE_MASK)
	397	+ if (new_addr & ~PAGE_MASK) {
	398	+ ret = new_addr;
	399	+ goto out;
	400	+ }
	401	+
	402	+ ret = security_file_mmap(0, 0, 0, 0, new_addr, 1);
	403	+ if (ret)
395	404	goto out;
396	405	}
397	406	ret = move_vma(vma, addr, old_len, new_len, new_addr);
...	...	@@ -639,7 +639,7 @@
639	639	}
640	640
641	641	/* allow the security API to have its say */
642		- ret = security_file_mmap(file, reqprot, prot, flags);
	642	+ ret = security_file_mmap(file, reqprot, prot, flags, addr, 0);
643	643	if (ret < 0)
644	644	return ret;
645	645
...	...	@@ -420,8 +420,12 @@
420	420
421	421	static int dummy_file_mmap (struct file *file, unsigned long reqprot,
422	422	unsigned long prot,
423		- unsigned long flags)
	423	+ unsigned long flags,
	424	+ unsigned long addr,
	425	+ unsigned long addr_only)
424	426	{
	427	+ if (addr < mmap_min_addr)
	428	+ return -EACCES;
425	429	return 0;
426	430	}
427	431
...	...	@@ -24,6 +24,7 @@
24	24	extern void security_fixup_ops(struct security_operations *ops);
25	25
26	26	struct security_operations security_ops; / Initialized to NULL */
	27	+unsigned long mmap_min_addr; /* 0 means no protection */
27	28
28	29	static inline int verify(struct security_operations *ops)
29	30	{
...	...	@@ -176,5 +177,6 @@
176	177	EXPORT_SYMBOL_GPL(unregister_security);
177	178	EXPORT_SYMBOL_GPL(mod_reg_security);
178	179	EXPORT_SYMBOL_GPL(mod_unreg_security);
	180	+EXPORT_SYMBOL_GPL(mmap_min_addr);
179	181	EXPORT_SYMBOL(security_ops);
...	...	@@ -2569,12 +2569,16 @@
2569	2569	}
2570	2570
2571	2571	static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2572		- unsigned long prot, unsigned long flags)
	2572	+ unsigned long prot, unsigned long flags,
	2573	+ unsigned long addr, unsigned long addr_only)
2573	2574	{
2574		- int rc;
	2575	+ int rc = 0;
	2576	+ u32 sid = ((struct task_security_struct*)(current->security))->sid;
2575	2577
2576		- rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2577		- if (rc)
	2578	+ if (addr < mmap_min_addr)
	2579	+ rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
	2580	+ MEMPROTECT__MMAP_ZERO, NULL);
	2581	+ if (rc \|\| addr_only)
2578	2582	return rc;
2579	2583
2580	2584	if (selinux_checkreqprot)
...	...	@@ -158,4 +158,5 @@
158	158	S_(SECCLASS_KEY, KEY__CREATE, "create")
159	159	S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NODE_BIND, "node_bind")
160	160	S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NAME_CONNECT, "name_connect")
	161	+ S_(SECCLASS_MEMPROTECT, MEMPROTECT__MMAP_ZERO, "mmap_zero")