lkml.org 
[lkml]   [2022]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH v2 4/4] selinux: Implement create_user_ns hook
From
On 7/19/22 8:32 PM, Paul Moore wrote:
> On Thu, Jul 7, 2022 at 6:32 PM Frederick Lawler <fred@cloudflare.com> wrote:
>>
>> Unprivileged user namespace creation is an intended feature to enable
>> sandboxing, however this feature is often used to as an initial step to
>> perform a privilege escalation attack.
>>
>> This patch implements a new namespace { userns_create } access control
>> permission to restrict which domains allow or deny user namespace
>> creation. This is necessary for system administrators to quickly protect
>> their systems while waiting for vulnerability patches to be applied.
>>
>> This permission can be used in the following way:
>>
>> allow domA_t domB_t : namespace { userns_create };
>>
>> Signed-off-by: Frederick Lawler <fred@cloudflare.com>
>>
>> ---
>> Changes since v1:
>> - Introduce this patch
>> ---
>> security/selinux/hooks.c | 9 +++++++++
>> security/selinux/include/classmap.h | 2 ++
>> 2 files changed, 11 insertions(+)
>>
>> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
>> index beceb89f68d9..73fbcb434fe0 100644
>> --- a/security/selinux/hooks.c
>> +++ b/security/selinux/hooks.c
>> @@ -4227,6 +4227,14 @@ static void selinux_task_to_inode(struct task_struct *p,
>> spin_unlock(&isec->lock);
>> }
>>
>> +static int selinux_userns_create(const struct cred *cred)
>> +{
>> + u32 sid = current_sid();
>> +
>> + return avc_has_perm(&selinux_state, sid, sid, SECCLASS_NAMESPACE,
>> + NAMESPACE__USERNS_CREATE, NULL);
>> +}
>
> As we continue to discuss this, I'm beginning to think that having a
> dedicated object class for the userns might be a good idea. I believe
> I was the one who gave you these code snippets, so feel free to blame
> me for the respin ;)
>

No worries, I'll make this change for v3.

> This is what I'm thinking:
>
> static int selinux_userns_create(const struct cred *cred)
> {
> u32 sid = current_sid();
>
> return avc_has_perm(&selinux_state, sid, sid,
> SECCLASS_USER_NAMESPACE,
> USER_NAMESPACE__CREATE, NULL);
> }
>
>> diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
>> index ff757ae5f253..9943e85c6b3e 100644
>> --- a/security/selinux/include/classmap.h
>> +++ b/security/selinux/include/classmap.h
>> @@ -254,6 +254,8 @@ const struct security_class_mapping secclass_map[] = {
>> { COMMON_FILE_PERMS, NULL } },
>> { "io_uring",
>> { "override_creds", "sqpoll", NULL } },
>> + { "namespace",
>> + { "userns_create", NULL } },
>
> The above would need to change to:
>
> { "user_namespace",
> { "create", NULL } }
>

\
 
 \ /
  Last update: 2022-07-20 16:58    [W:0.085 / U:0.244 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site