12 Jul, 2016
17 commits
-
While using AppArmor, SYS_CAP_RESOURCE is insufficient to call prlimit
on another task. The only other example of a AppArmor mediating access to
another, already running, task (ignoring fork+exec) is ptrace.The AppArmor model for ptrace is that one of the following must be true:
1) The tracer is unconfined
2) The tracer is in complain mode
3) The tracer and tracee are confined by the same profile
4) The tracer is confined but has SYS_CAP_PTRACE1), 2, and 3) are already true for setrlimit.
We can match the ptrace model just by allowing CAP_SYS_RESOURCE.
We still test the values of the rlimit since it can always be overridden
using a value that means unlimited for a particular resource.Signed-off-by: Jeff Mahoney
Signed-off-by: John Johansen -
list_next_entry has been defined in list.h, so I replace list_entry_next
with it.Signed-off-by: Geliang Tang
Acked-by: Serge Hallyn
Signed-off-by: John Johansen -
When finding a child profile via an rcu critical section, the profile
may be put and scheduled for deletion after the child is found but
before its refcount is incremented.Protect against this by repeating the lookup if the profiles refcount
is 0 and is one its way to deletion.Signed-off-by: John Johansen
Acked-by: Seth Arnold -
Signed-off-by: John Johansen
Acked-by: Seth Arnold -
Signed-off-by: John Johansen
Acked-by: Seth Arnold -
The target profile name was not being correctly audited in a few
cases because the target variable was not being set and gotos
passed the code to set it at apply:Since it is always based on new_profile just drop the target var
and conditionally report based on new_profile.Signed-off-by: John Johansen
Acked-by: Seth Arnold -
Currently logging of a successful profile load only logs the basename
of the profile. This can result in confusion when a child profile has
the same name as the another profile in the set. Logging the hname
will ensure there is no confusion.Signed-off-by: John Johansen
Acked-by: Seth Arnold -
currently only the profile that is causing the failure is logged. This
makes it more confusing than necessary about which profiles loaded
and which didn't. So make sure to log success and failure messages for
all profiles in the set being loaded.Signed-off-by: John Johansen
Acked-by: Seth Arnold -
Signed-off-by: John Johansen
Acked-by: Seth Arnold -
Signed-off-by: John Johansen
Acked-by: Tyler Hicks
Acked-by: Seth Arnold -
Internal mounts are not mounted anywhere and as such should be treated
as disconnected paths.Signed-off-by: John Johansen
Acked-by: Seth Arnold -
Bind mounts can fail to be properly reconnected when PATH_CONNECT is
specified. Ensure that when PATH_CONNECT is specified the path has
a root.BugLink: http://bugs.launchpad.net/bugs/1319984
Signed-off-by: John Johansen
Acked-by: Seth Arnold -
Signed-off-by: John Johansen
Acked-by: Seth Arnold -
The current behavior is confusing as it causes exec failures to report
the executable is missing instead of identifying that apparmor
caused the failure.Signed-off-by: John Johansen
Acked-by: Seth Arnold -
BugLink: http://bugs.launchpad.net/bugs/1268727
The task field in the lsm_audit struct needs to be initialized if
a change_hat fails, otherwise the following oops will occurBUG: unable to handle kernel paging request at 0000002fbead7d08
IP: [] _raw_spin_lock+0xe/0x50
PGD 1e3f35067 PUD 0
Oops: 0002 [#1] SMP
Modules linked in: pppox crc_ccitt p8023 p8022 psnap llc ax25 btrfs raid6_pq xor xfs libcrc32c dm_multipath scsi_dh kvm_amd dcdbas kvm microcode amd64_edac_mod joydev edac_core psmouse edac_mce_amd serio_raw k10temp sp5100_tco i2c_piix4 ipmi_si ipmi_msghandler acpi_power_meter mac_hid lp parport hid_generic usbhid hid pata_acpi mpt2sas ahci raid_class pata_atiixp bnx2 libahci scsi_transport_sas [last unloaded: tipc]
CPU: 2 PID: 699 Comm: changehat_twice Tainted: GF O 3.13.0-7-generic #25-Ubuntu
Hardware name: Dell Inc. PowerEdge R415/08WNM9, BIOS 1.8.6 12/06/2011
task: ffff8802135c6000 ti: ffff880212986000 task.ti: ffff880212986000
RIP: 0010:[] [] _raw_spin_lock+0xe/0x50
RSP: 0018:ffff880212987b68 EFLAGS: 00010006
RAX: 0000000000020000 RBX: 0000002fbead7500 RCX: 0000000000000000
RDX: 0000000000000292 RSI: ffff880212987ba8 RDI: 0000002fbead7d08
RBP: ffff880212987b68 R08: 0000000000000246 R09: ffff880216e572a0
R10: ffffffff815fd677 R11: ffffea0008469580 R12: ffffffff8130966f
R13: ffff880212987ba8 R14: 0000002fbead7d08 R15: ffff8800d8c6b830
FS: 00002b5e6c84e7c0(0000) GS:ffff880216e40000(0000) knlGS:0000000055731700
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000002fbead7d08 CR3: 000000021270f000 CR4: 00000000000006e0
Stack:
ffff880212987b98 ffffffff81075f17 ffffffff8130966f 0000000000000009
0000000000000000 0000000000000000 ffff880212987bd0 ffffffff81075f7c
0000000000000292 ffff880212987c08 ffff8800d8c6b800 0000000000000026
Call Trace:
[] __lock_task_sighand+0x47/0x80
[] ? apparmor_cred_prepare+0x2f/0x50
[] do_send_sig_info+0x2c/0x80
[] send_sig_info+0x1e/0x30
[] aa_audit+0x13d/0x190
[] aa_audit_file+0xbc/0x130
[] ? apparmor_cred_prepare+0x2f/0x50
[] aa_change_hat+0x202/0x530
[] aa_setprocattr_changehat+0x116/0x1d0
[] apparmor_setprocattr+0x25d/0x300
[] security_setprocattr+0x16/0x20
[] proc_pid_attr_write+0x107/0x130
[] vfs_write+0xb4/0x1f0
[] SyS_write+0x49/0xa0
[] tracesys+0xe1/0xe6Signed-off-by: John Johansen
Acked-by: Seth Arnold -
When set atomic replacement is used and the parent is updated before the
child, and the child did not exist in the old parent so there is no
direct replacement then the new child is incorrectly added to the old
parent. This results in the new parent not having the child(ren) that
it should and the old parent when being destroyed asserting the
following error.AppArmor: policy_destroy: internal error, policy '' still
contains profilesSigned-off-by: John Johansen
Acked-by: Seth Arnold -
Signed-off-by: John Johansen
Acked-by: Seth Arnold
09 Jul, 2016
1 commit
-
…dhowells/linux-fs into next
08 Jul, 2016
3 commits
-
The Smack working tree has moved from gitorious to github.
Signed-off-by: Casey Schaufler
-
Add a separate Kconfig option for SAMPLES_SECCOMP.
Main reason for this is that, just like other samples, it's forced to
be a module.Without this, since the sample is a target only controlled by
CONFIG_SECCOMP_FILTER, the samples will be built before include files are
put in place properly. For example, from an arm64 allmodconfig built with
"make -sk -j 32" (without specific target), the following happens:samples/seccomp/bpf-fancy.c:13:27: fatal error: linux/seccomp.h: No such file or directory
samples/seccomp/bpf-helper.h:20:50: fatal error: linux/seccomp.h: No such file or directory
samples/seccomp/dropper.c:20:27: fatal error: linux/seccomp.h: No such file or directory
samples/seccomp/bpf-direct.c:21:27: fatal error: linux/seccomp.h: No such file or directorySo, just stick to the same format as other samples.
Signed-off-by: Olof Johansson
Signed-off-by: Kees Cook
07 Jul, 2016
1 commit
30 Jun, 2016
8 commits
-
Extend the PCR supplied as a parameter, instead of assuming that the
measurement entry uses the default configured PCR.Signed-off-by: Eric Richter
Signed-off-by: Mimi Zohar -
IMA avoids re-measuring files by storing the current state as a flag in
the integrity cache. It will then skip adding a new measurement log entry
if the cache reports the file as already measured.If a policy measures an already measured file to a new PCR, the measurement
will not be added to the list. This patch implements a new bitfield for
specifying which PCR the file was measured into, rather than if it was
measured.Signed-off-by: Eric Richter
Signed-off-by: Mimi Zohar -
Template entry duplicates are prevented from being added to the
measurement list by checking a hash table that contains the template
entry digests. However, the PCR value is not included in this comparison,
so duplicate template entry digests with differing PCRs may be dropped.This patch redefines duplicate template entries as template entries with
the same digest and same PCR values.Reported-by: Mimi Zohar
Signed-off-by: Eric Richter
Signed-off-by: Mimi Zohar -
IMA assumes that the same default Kconfig PCR is extended for each
entry. This patch replaces the default configured PCR with the policy
defined PCR.Signed-off-by: Eric Richter
Signed-off-by: Mimi Zohar -
The IMA measurement list entries include the Kconfig defined PCR value.
This patch defines a new ima_template_entry field for including the PCR
as specified in the policy rule.Signed-off-by: Eric Richter
Signed-off-by: Mimi Zohar -
Different policy rules may extend different PCRs. This patch retrieves
the specific PCR for the matched rule. Subsequent patches will include
the rule specific PCR in the measurement list and extend the appropriate
PCR.Signed-off-by: Eric Richter
Signed-off-by: Mimi Zohar -
This patch defines a new IMA measurement policy rule option "pcr=",
which allows extending different PCRs on a per rule basis. For example,
the system independent files could extend the default IMA Kconfig
specified PCR, while the system dependent files could extend a different
PCR.The following is an example of this usage with an SELinux policy; the
rule would extend PCR 11 with system configuration files:measure func=FILE_CHECK mask=MAY_READ obj_type=system_conf_t pcr=11
Changelog v3:
- FIELD_SIZEOF returns bytes, not bits. Fixed INVALID_PCRSigned-off-by: Eric Richter
Signed-off-by: Mimi Zohar -
To keep track of which measurements have been extended to which PCRs, this
patch defines a new integrity_iint_cache field named measured_pcrs. This
field is a bitmask of the PCRs measured. Each bit corresponds to a PCR
index. For example, bit 10 corresponds to PCR 10.Signed-off-by: Eric Richter
Signed-off-by: Mimi Zohar
28 Jun, 2016
10 commits
-
SMACK uses similar functions to control CIPSO, these are
the equivalent functions for CALIPSO and follow exactly
the same semantics.int netlbl_cfg_calipso_add(struct calipso_doi *doi_def,
struct netlbl_audit *audit_info)
Adds a CALIPSO doi.void netlbl_cfg_calipso_del(u32 doi, struct netlbl_audit *audit_info)
Removes a CALIPSO doi.int netlbl_cfg_calipso_map_add(u32 doi, const char *domain,
const struct in6_addr *addr,
const struct in6_addr *mask,
struct netlbl_audit *audit_info)
Creates a mapping between a domain and a CALIPSO doi. If
addr and mask are non-NULL this creates an address-selector
type mapping.This also extends netlbl_cfg_map_del() to remove IPv6 address-selector
mappings.Signed-off-by: Huw Davies
Signed-off-by: Paul Moore -
This works in exactly the same way as the CIPSO label cache.
The idea is to allow the lsm to cache the result of a secattr
lookup so that it doesn't need to perform the lookup for
every skbuff.It introduces two sysctl controls:
calipso_cache_enable - enables/disables the cache.
calipso_cache_bucket_size - sets the size of a cache bucket.Signed-off-by: Huw Davies
Signed-off-by: Paul Moore -
Lengths, checksum and the DOI are checked. Checking of the
level and categories are left for the socket layer.CRC validation is performed in the calipso module to avoid
unconditionally linking crc_ccitt() into ipv6.Signed-off-by: Huw Davies
Signed-off-by: Paul Moore -
This makes it possible to route the error to the appropriate
labelling engine. CALIPSO is far less verbose than CIPSO
when encountering a bogus packet, so there is no need for a
CALIPSO error handler.Signed-off-by: Huw Davies
Signed-off-by: Paul Moore -
In some cases, the lsm needs to add the label to the skbuff directly.
A NF_INET_LOCAL_OUT IPv6 hook is added to selinux to match the IPv4
behaviour. This allows selinux to label the skbuffs that it requires.Signed-off-by: Huw Davies
Signed-off-by: Paul Moore -
Signed-off-by: Huw Davies
Signed-off-by: Paul Moore -
Request sockets need to have a label that takes into account the
incoming connection as well as their parent's label. This is used
for the outgoing SYN-ACK and for their child full-socket.Signed-off-by: Huw Davies
Signed-off-by: Paul Moore -
If set, these will take precedence over the parent's options during
both sending and child creation. If they're not set, the parent's
options (if any) will be used.This is to allow the security_inet_conn_request() hook to modify the
IPv6 options in just the same way that it already may do for IPv4.Signed-off-by: Huw Davies
Signed-off-by: Paul Moore -
If a socket has a netlabel in place then don't let setsockopt() alter
the socket's IPv6 hop-by-hop option. This is in the same spirit as
the existing check for IPv4.Signed-off-by: Huw Davies
Signed-off-by: Paul Moore -
CALIPSO is a hop-by-hop IPv6 option. A lot of this patch is based on
the equivalent CISPO code. The main difference is due to manipulating
the options in the hop-by-hop header.Signed-off-by: Huw Davies
Signed-off-by: Paul Moore
