On Thu, Jul 7, 2022 at 6:32 PM Frederick Lawler <fred@xxxxxxxxxxxxxx> wrote:
>
> Unprivileged user namespace creation is an intended feature to enable
> sandboxing, however this feature is often used to as an initial step to
> perform a privilege escalation attack.
>
> This patch implements a new namespace { userns_create } access control
> permission to restrict which domains allow or deny user namespace
> creation. This is necessary for system administrators to quickly protect
> their systems while waiting for vulnerability patches to be applied.
>
> This permission can be used in the following way:
>
> allow domA_t domB_t : namespace { userns_create };
>
> Signed-off-by: Frederick Lawler <fred@xxxxxxxxxxxxxx>
>
> ---
> Changes since v1:
> - Introduce this patch
> ---
> security/selinux/hooks.c | 9 +++++++++
> security/selinux/include/classmap.h | 2 ++
> 2 files changed, 11 insertions(+)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index beceb89f68d9..73fbcb434fe0 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -4227,6 +4227,14 @@ static void selinux_task_to_inode(struct task_struct *p,
> spin_unlock(&isec->lock);
> }
>
> +static int selinux_userns_create(const struct cred *cred)
> +{
> + u32 sid = current_sid();
> +
> + return avc_has_perm(&selinux_state, sid, sid, SECCLASS_NAMESPACE,
> + NAMESPACE__USERNS_CREATE, NULL);
> +}
As we continue to discuss this, I'm beginning to think that having a
dedicated object class for the userns might be a good idea. I believe
I was the one who gave you these code snippets, so feel free to blame
me for the respin ;)
This is what I'm thinking:
static int selinux_userns_create(const struct cred *cred)
{
u32 sid = current_sid();
return avc_has_perm(&selinux_state, sid, sid,
SECCLASS_USER_NAMESPACE,
USER_NAMESPACE__CREATE, NULL);
}
> diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
> index ff757ae5f253..9943e85c6b3e 100644
> --- a/security/selinux/include/classmap.h
> +++ b/security/selinux/include/classmap.h
> @@ -254,6 +254,8 @@ const struct security_class_mapping secclass_map[] = {
> { COMMON_FILE_PERMS, NULL } },
> { "io_uring",
> { "override_creds", "sqpoll", NULL } },
> + { "namespace",
> + { "userns_create", NULL } },
The above would need to change to:
{ "user_namespace",
{ "create", NULL } }
--
paul-moore.com
