UbiquitousOS
/
OpenCloudOS-Kernel
mirror of https://gitee.com/OpenCloudOS/OpenCloudOS-Kernel.git
11
0
Fork 0
Code Issues Projects Releases Wiki Activity

selinux: fix race condition when computing ocontext SIDs 

Current code contains a lot of racy patterns when converting an
ocontext's context structure to an SID. This is being done in a "lazy"
fashion, such that the SID is looked up in the SID table only when it's
first needed and then cached in the "sid" field of the ocontext
structure. However, this is done without any locking or memory barriers
and is thus unsafe.

Between commits 24ed7fdae6 ("selinux: use separate table for initial
SID lookup") and 66f8e2f03c ("selinux: sidtab reverse lookup hash
table"), this race condition lead to an actual observable bug, because a
pointer to the shared sid field was passed directly to
sidtab_context_to_sid(), which was using this location to also store an
intermediate value, which could have been read by other threads and
interpreted as an SID. In practice this caused e.g. new mounts to get a
wrong (seemingly random) filesystem context, leading to strange denials.
This bug has been spotted in the wild at least twice, see [1] and [2].

Fix the race condition by making all the racy functions use a common
helper that ensures the ocontext::sid accesses are made safely using the
appropriate SMP constructs.

Note that security_netif_sid() was populating the sid field of both
contexts stored in the ocontext, but only the first one was actually
used. The SELinux wiki's documentation on the "netifcon" policy
statement [3] suggests that using only the first context is intentional.
I kept only the handling of the first context here, as there is really
no point in doing the SID lookup for the unused one.

I wasn't able to reproduce the bug mentioned above on any kernel that
includes commit 66f8e2f03c, even though it has been reported that the
issue occurs with that commit, too, just less frequently. Thus, I wasn't
able to verify that this patch fixes the issue, but it makes sense to
avoid the race condition regardless.

[1] https://github.com/containers/container-selinux/issues/89
[2] https://lists.fedoraproject.org/archives/list/selinux@lists.fedoraproject.org/thread/6DMTAMHIOAOEMUAVTULJD45JZU7IBAFM/
[3] https://selinuxproject.org/page/NetworkStatements#netifcon

Cc: stable@vger.kernel.org
Cc: Xinjie Zheng <xinjie@google.com>
Reported-by: Sujithra Periasamy <sujithra@google.com>
Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Ondrej Mosnacek 2021-07-28 16:03:13 +02:00 committed by Paul Moore
parent 4342f70538
commit cbfcd13be5
1 changed files with 77 additions and 85 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

162
security/selinux/ss/services.c
View File

@ -2376,6 +2376,43 @@ err_policy:
return rc; return rc;
} }
/**
* ocontext_to_sid - Helper to safely get sid for an ocontext
* @sidtab: SID table
* @c: ocontext structure
* @index: index of the context entry (0 or 1)
* @out_sid: pointer to the resulting SID value
*
* For all ocontexts except OCON_ISID the SID fields are populated
* on-demand when needed. Since updating the SID value is an SMP-sensitive
* operation, this helper must be used to do that safely.
*
* WARNING: This function may return -ESTALE, indicating that the caller
* must retry the operation after re-acquiring the policy pointer!
*/
static int ocontext_to_sid(struct sidtab *sidtab, struct ocontext *c,
size_t index, u32 *out_sid)
{
int rc;
u32 sid;
/* Ensure the associated sidtab entry is visible to this thread. */
sid = smp_load_acquire(&c->sid[index]);
if (!sid) {
rc = sidtab_context_to_sid(sidtab, &c->context[index], &sid);
if (rc)
return rc;
/*
* Ensure the new sidtab entry is visible to other threads
* when they see the SID.
*/
smp_store_release(&c->sid[index], sid);
}
*out_sid = sid;
return 0;
}
/** /**
* security_port_sid - Obtain the SID for a port. * security_port_sid - Obtain the SID for a port.
* @state: SELinux state * @state: SELinux state
@ -2414,17 +2451,13 @@ retry:
} }
if (c) { if (c) {
if (!c->sid[0]) { rc = ocontext_to_sid(sidtab, c, 0, out_sid);
rc = sidtab_context_to_sid(sidtab, &c->context[0], if (rc == -ESTALE) {
&c->sid[0]); rcu_read_unlock();
if (rc == -ESTALE) { goto retry;
rcu_read_unlock();
goto retry;
}
if (rc)
goto out;
} }
*out_sid = c->sid[0]; if (rc)
goto out;
} else { } else {
*out_sid = SECINITSID_PORT; *out_sid = SECINITSID_PORT;
} }
@ -2473,18 +2506,13 @@ retry:
} }
if (c) { if (c) {
if (!c->sid[0]) { rc = ocontext_to_sid(sidtab, c, 0, out_sid);
rc = sidtab_context_to_sid(sidtab, if (rc == -ESTALE) {
&c->context[0], rcu_read_unlock();
&c->sid[0]); goto retry;
if (rc == -ESTALE) {
rcu_read_unlock();
goto retry;
}
if (rc)
goto out;
} }
*out_sid = c->sid[0]; if (rc)
goto out;
} else } else
*out_sid = SECINITSID_UNLABELED; *out_sid = SECINITSID_UNLABELED;
@ -2533,17 +2561,13 @@ retry:
} }
if (c) { if (c) {
if (!c->sid[0]) { rc = ocontext_to_sid(sidtab, c, 0, out_sid);
rc = sidtab_context_to_sid(sidtab, &c->context[0], if (rc == -ESTALE) {
&c->sid[0]); rcu_read_unlock();
if (rc == -ESTALE) { goto retry;
rcu_read_unlock();
goto retry;
}
if (rc)
goto out;
} }
*out_sid = c->sid[0]; if (rc)
goto out;
} else } else
*out_sid = SECINITSID_UNLABELED; *out_sid = SECINITSID_UNLABELED;
@ -2587,25 +2611,13 @@ retry:
} }
if (c) { if (c) {
if (!c->sid[0] || !c->sid[1]) { rc = ocontext_to_sid(sidtab, c, 0, if_sid);
rc = sidtab_context_to_sid(sidtab, &c->context[0], if (rc == -ESTALE) {
&c->sid[0]); rcu_read_unlock();
if (rc == -ESTALE) { goto retry;
rcu_read_unlock();
goto retry;
}
if (rc)
goto out;
rc = sidtab_context_to_sid(sidtab, &c->context[1],
&c->sid[1]);
if (rc == -ESTALE) {
rcu_read_unlock();
goto retry;
}
if (rc)
goto out;
} }
*if_sid = c->sid[0]; if (rc)
goto out;
} else } else
*if_sid = SECINITSID_NETIF; *if_sid = SECINITSID_NETIF;
@ -2697,18 +2709,13 @@ retry:
} }
if (c) { if (c) {
if (!c->sid[0]) { rc = ocontext_to_sid(sidtab, c, 0, out_sid);
rc = sidtab_context_to_sid(sidtab, if (rc == -ESTALE) {
&c->context[0], rcu_read_unlock();
&c->sid[0]); goto retry;
if (rc == -ESTALE) {
rcu_read_unlock();
goto retry;
}
if (rc)
goto out;
} }
*out_sid = c->sid[0]; if (rc)
goto out;
} else { } else {
*out_sid = SECINITSID_NODE; *out_sid = SECINITSID_NODE;
} }
@ -2873,7 +2880,7 @@ static inline int __security_genfs_sid(struct selinux_policy *policy,
u16 sclass; u16 sclass;
struct genfs *genfs; struct genfs *genfs;
struct ocontext *c; struct ocontext *c;
int rc, cmp = 0; int cmp = 0;
while (path[0] == '/' && path[1] == '/') while (path[0] == '/' && path[1] == '/')
path++; path++;
@ -2887,9 +2894,8 @@ static inline int __security_genfs_sid(struct selinux_policy *policy,
break; break;
} }
rc = -ENOENT;
if (!genfs || cmp) if (!genfs || cmp)
goto out; return -ENOENT;
for (c = genfs->head; c; c = c->next) { for (c = genfs->head; c; c = c->next) {
len = strlen(c->u.name); len = strlen(c->u.name);
@ -2898,20 +2904,10 @@ static inline int __security_genfs_sid(struct selinux_policy *policy,
break; break;
} }
rc = -ENOENT;
if (!c) if (!c)
goto out; return -ENOENT;
if (!c->sid[0]) { return ocontext_to_sid(sidtab, c, 0, sid);
rc = sidtab_context_to_sid(sidtab, &c->context[0], &c->sid[0]);
if (rc)
goto out;
}
*sid = c->sid[0];
rc = 0;
out:
return rc;
} }
/** /**
@ -2996,17 +2992,13 @@ retry:
if (c) { if (c) {
sbsec->behavior = c->v.behavior; sbsec->behavior = c->v.behavior;
if (!c->sid[0]) { rc = ocontext_to_sid(sidtab, c, 0, &sbsec->sid);
rc = sidtab_context_to_sid(sidtab, &c->context[0], if (rc == -ESTALE) {
&c->sid[0]); rcu_read_unlock();
if (rc == -ESTALE) { goto retry;
rcu_read_unlock();
goto retry;
}
if (rc)
goto out;
} }
sbsec->sid = c->sid[0]; if (rc)
goto out;
} else { } else {
rc = __security_genfs_sid(policy, fstype, "/", rc = __security_genfs_sid(policy, fstype, "/",
SECCLASS_DIR, &sbsec->sid); SECCLASS_DIR, &sbsec->sid);