Re: [PATCH v2 4/4] selinux: Implement create_user_ns hook

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 7/19/22 8:32 PM, Paul Moore wrote:
On Thu, Jul 7, 2022 at 6:32 PM Frederick Lawler <fred@xxxxxxxxxxxxxx> wrote:

Unprivileged user namespace creation is an intended feature to enable
sandboxing, however this feature is often used to as an initial step to
perform a privilege escalation attack.

This patch implements a new namespace { userns_create } access control
permission to restrict which domains allow or deny user namespace
creation. This is necessary for system administrators to quickly protect
their systems while waiting for vulnerability patches to be applied.

This permission can be used in the following way:

         allow domA_t domB_t : namespace { userns_create };

Signed-off-by: Frederick Lawler <fred@xxxxxxxxxxxxxx>

---
Changes since v1:
- Introduce this patch
---
  security/selinux/hooks.c            | 9 +++++++++
  security/selinux/include/classmap.h | 2 ++
  2 files changed, 11 insertions(+)

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index beceb89f68d9..73fbcb434fe0 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4227,6 +4227,14 @@ static void selinux_task_to_inode(struct task_struct *p,
         spin_unlock(&isec->lock);
  }

+static int selinux_userns_create(const struct cred *cred)
+{
+       u32 sid = current_sid();
+
+       return avc_has_perm(&selinux_state, sid, sid, SECCLASS_NAMESPACE,
+                                               NAMESPACE__USERNS_CREATE, NULL);
+}

As we continue to discuss this, I'm beginning to think that having a
dedicated object class for the userns might be a good idea.  I believe
I was the one who gave you these code snippets, so feel free to blame
me for the respin ;)


No worries, I'll make this change for v3.

This is what I'm thinking:

   static int selinux_userns_create(const struct cred *cred)
   {
     u32 sid = current_sid();

     return avc_has_perm(&selinux_state, sid, sid,
                         SECCLASS_USER_NAMESPACE,
                         USER_NAMESPACE__CREATE, NULL);
   }

diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index ff757ae5f253..9943e85c6b3e 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -254,6 +254,8 @@ const struct security_class_mapping secclass_map[] = {
           { COMMON_FILE_PERMS, NULL } },
         { "io_uring",
           { "override_creds", "sqpoll", NULL } },
+       { "namespace",
+         { "userns_create", NULL } },

The above would need to change to:

   { "user_namespace",
     { "create", NULL } }





[Index of Archives]     [Linux Wireless]     [Linux Kernel]     [ATH6KL]     [Linux Bluetooth]     [Linux Netdev]     [Kernel Newbies]     [Share Photos]     [IDE]     [Security]     [Git]     [Netfilter]     [Bugtraq]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Linux ATA RAID]     [Samba]     [Device Mapper]

  Powered by Linux