Skip to content
  1. Jun 19, 2019
  3. Jun 18, 2019
    • Mike Salvatore's avatar
      apparmor: reset pos on failure to unpack for various functions · 156e4299
      Mike Salvatore authored 
      

Each function that manipulates the aa_ext struct should reset it's "pos"
member on failure. This ensures that, on failure, no changes are made to
the state of the aa_ext struct.

There are paths were elements are optional and the error path is
used to indicate the optional element is not present. This means
instead of just aborting on error the unpack stream can become
unsynchronized on optional elements, if using one of the affected
functions.

Cc: stable@vger.kernel.org
Fixes: 736ec752 ("AppArmor: policy routines for loading and unpacking policy")
Signed-off-by: default avatarMike Salvatore <mike.salvatore@canonical.com>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      156e4299
    • Jann Horn's avatar
      apparmor: enforce nullbyte at end of tag string · 8404d7a6
      Jann Horn authored 
      

A packed AppArmor policy contains null-terminated tag strings that are read
by unpack_nameX(). However, unpack_nameX() uses string functions on them
without ensuring that they are actually null-terminated, potentially
leading to out-of-bounds accesses.

Make sure that the tag string is null-terminated before passing it to
strcmp().

Cc: stable@vger.kernel.org
Fixes: 736ec752 ("AppArmor: policy routines for loading and unpacking policy")
Signed-off-by: default avatarJann Horn <jannh@google.com>
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      8404d7a6
    • John Johansen's avatar
      apparmor: fix PROFILE_MEDIATES for untrusted input · 23375b13
      John Johansen authored 
      

While commit 11c236b8 ("apparmor: add a default null dfa") ensure
every profile has a policy.dfa it does not resize the policy.start[]
to have entries for every possible start value. Which means
PROFILE_MEDIATES is not safe to use on untrusted input. Unforunately
commit b9590ad4 ("apparmor: remove POLICY_MEDIATES_SAFE") did not
take into account the start value usage.

The input string in profile_query_cb() is user controlled and is not
properly checked to be within the limited start[] entries, even worse
it can't be as userspace policy is allowed to make us of entries types
the kernel does not know about. This mean usespace can currently cause
the kernel to access memory up to 240 entries beyond the start array
bounds.

Cc: stable@vger.kernel.org
Fixes: b9590ad4 ("apparmor: remove POLICY_MEDIATES_SAFE")
Signed-off-by: default avatarJohn Johansen <john.johansen@canonical.com>
      23375b13
  5. Jun 15, 2019
    • Casey Schaufler's avatar
      Smack: Restore the smackfsdef mount option and add missing prefixes · 6e7739fc
      Casey Schaufler authored 
      

The 5.1 mount system rework changed the smackfsdef mount option to
smackfsdefault.  This fixes the regression by making smackfsdef treated
the same way as smackfsdefault.

Also fix the smack_param_specs[] to have "smack" prefixes on all the
names.  This isn't visible to a user unless they either:

 (a) Try to mount a filesystem that's converted to the internal mount API
     and that implements the ->parse_monolithic() context operation - and
     only then if they call security_fs_context_parse_param() rather than
     security_sb_eat_lsm_opts().

     There are no examples of this upstream yet, but nfs will probably want
     to do this for nfs2 or nfs3.

 (b) Use fsconfig() to configure the filesystem - in which case
     security_fs_context_parse_param() will be called.

This issue is that smack_sb_eat_lsm_opts() checks for the "smack" prefix
on the options, but smack_fs_context_parse_param() does not.

Fixes: c3300aaf ("smack: get rid of match_token()")
Fixes: 2febd254 ("smack: Implement filesystem context security hooks")
Cc: stable@vger.kernel.org
Reported-by: default avatarJose Bollo <jose.bollo@iot.bzh>
Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Tested-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
      6e7739fc
  7. Jun 12, 2019
  9. Jun 11, 2019
  11. Jun 05, 2019
  13. May 30, 2019
  15. May 24, 2019
  17. May 21, 2019
  19. May 20, 2019
  21. May 10, 2019
  23. May 08, 2019
  25. May 02, 2019
  27. Apr 30, 2019
  29. Apr 29, 2019
    • Paulo Alcantara's avatar
      selinux: use kernel linux/socket.h for genheaders and mdp · dfbd199a
      Paulo Alcantara authored 
      

When compiling genheaders and mdp from a newer host kernel, the
following error happens:

    In file included from scripts/selinux/genheaders/genheaders.c:18:
    ./security/selinux/include/classmap.h:238:2: error: #error New
    address family defined, please update secclass_map.  #error New
    address family defined, please update secclass_map.  ^~~~~
    make[3]: *** [scripts/Makefile.host:107:
    scripts/selinux/genheaders/genheaders] Error 1 make[2]: ***
    [scripts/Makefile.build:599: scripts/selinux/genheaders] Error 2
    make[1]: *** [scripts/Makefile.build:599: scripts/selinux] Error 2
    make[1]: *** Waiting for unfinished jobs....

Instead of relying on the host definition, include linux/socket.h in
classmap.h to have PF_MAX.

Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaulo Alcantara <paulo@paulo.ac>
Acked-by: default avatarStephen Smalley <sds@tycho.nsa.gov>
[PM: manually merge in mdp.c, subject line tweaks]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
      dfbd199a
  31. Apr 26, 2019
  33. Apr 25, 2019
    • Eric Biggers's avatar
      crypto: shash - remove shash_desc::flags · 877b5691
      Eric Biggers authored 
      

The flags field in 'struct shash_desc' never actually does anything.
The only ostensibly supported flag is CRYPTO_TFM_REQ_MAY_SLEEP.
However, no shash algorithm ever sleeps, making this flag a no-op.

With this being the case, inevitably some users who can't sleep wrongly
pass MAY_SLEEP.  These would all need to be fixed if any shash algorithm
actually started sleeping.  For example, the shash_ahash_*() functions,
which wrap a shash algorithm with the ahash API, pass through MAY_SLEEP
from the ahash API to the shash API.  However, the shash functions are
called under kmap_atomic(), so actually they're assumed to never sleep.

Even if it turns out that some users do need preemption points while
hashing large buffers, we could easily provide a helper function
crypto_shash_update_large() which divides the data into smaller chunks
and calls crypto_shash_update() and cond_resched() for each chunk.  It's
not necessary to have a flag in 'struct shash_desc', nor is it necessary
to make individual shash algorithms aware of this at all.

Therefore, remove shash_desc::flags, and document that the
crypto_shash_*() functions can be called from any context.

Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
      877b5691
  35. Apr 24, 2019
  37. Apr 18, 2019
  39. Apr 15, 2019
  41. Apr 10, 2019
    • James Morris's avatar
      Revert "security: inode: fix a missing check for securityfs_create_file" · fe9fd2ef
      James Morris authored 
      

This reverts commit d1a08460.

From Al Viro:

"Rather bad way to do it - generally, register_filesystem() should be
the last thing done by initialization.  Any modular code that
does unregister_filesystem() on failure exit is flat-out broken;
here it's not instantly FUBAR, but it's a bloody bad example.

What's more, why not let simple_fill_super() do it?  Just
static int fill_super(struct super_block *sb, void *data, int silent)
{
        static const struct tree_descr files[] = {
                {"lsm", &lsm_ops, 0444},
                {""}
        };

and to hell with that call of securityfs_create_file() and all its
failure handling..."

Signed-off-by: default avatarJames Morris <james.morris@microsoft.com>
      fe9fd2ef
    • Al Viro's avatar
      apparmorfs: fix use-after-free on symlink traversal · f51dcd0f
      Al Viro authored 
      

symlink body shouldn't be freed without an RCU delay.  Switch apparmorfs
to ->destroy_inode() and use of call_rcu(); free both the inode and symlink
body in the callback.

Signed-off-by: default avatarAl Viro <viro@zeniv.linux.org.uk>
      f51dcd0f