xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

LSM: SafeSetID: rewrite userspace API to atomic updates

Browse Source 
The current API of the SafeSetID LSM uses one write() per rule, and applies
each written rule instantly. This has several downsides:

 - While a policy is being loaded, once a single parent-child pair has been
   loaded, the parent is restricted to that specific child, even if
   subsequent rules would allow transitions to other child UIDs. This means
   that during policy loading, set*uid() can randomly fail.
 - To replace the policy without rebooting, it is necessary to first flush
   all old rules. This creates a time window in which no constraints are
   placed on the use of CAP_SETUID.
 - If we want to perform sanity checks on the final policy, this requires
   that the policy isn't constructed in a piecemeal fashion without telling
   the kernel when it's done.

Other kernel APIs - including things like the userns code and netfilter -
avoid this problem by performing updates atomically. Luckily, SafeSetID
hasn't landed in a stable (upstream) release yet, so maybe it's not too
late to completely change the API.

The new API for SafeSetID is: If you want to change the policy, open
"safesetid/whitelist_policy" and write the entire policy,
newline-delimited, in there.

Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: Micah Morton <mortonm@chromium.org>
This commit is contained in:
Jann Horn
2019-04-10 09:56:05 -07:00
committed by Micah Morton
parent 71a98971b9
commit 03638e62f5
4 changed files with 149 additions and 169 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
tools/testing/selftests/safesetid/safesetid-test.c
View File

@@ -142,23 +142,17 @@ static void ensure_securityfs_mounted(void)
static void write_policies(void)
{
static char *policy_str =
"1:2\n"
"1:3\n";
ssize_t written;
int fd;
fd = open(add_whitelist_policy_file, O_WRONLY);
if (fd < 0)
die("cant open add_whitelist_policy file\n");
written = write(fd, "1:2", strlen("1:2"));
if (written != strlen("1:2")) {
if (written >= 0) {
die("short write to %s\n", add_whitelist_policy_file);
} else {
die("write to %s failed: %s\n",
add_whitelist_policy_file, strerror(errno));
}
}
written = write(fd, "1:3", strlen("1:3"));
if (written != strlen("1:3")) {
written = write(fd, policy_str, strlen(policy_str));
if (written != strlen(policy_str)) {
if (written >= 0) {
die("short write to %s\n", add_whitelist_policy_file);
} else {