On Fri, Jan 17, 2020 at 9:23 PM Stephen Smalley <sds@xxxxxxxxxxxxx> wrote:
> commit 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around")
> introduced a new move_mount(2) system call and a corresponding new LSM
> security_move_mount hook but did not implement this hook for any existing
> LSM. This creates a regression for SELinux with respect to consistent
> checking of mounts; the existing selinux_mount hook checks mounton
> permission to the mount point path. Provide a SELinux hook
> implementation for move_mount that applies this same check for
> consistency. In the future we may wish to add a new move_mount
> filesystem permission and check as well, but this addresses
> the immediate regression.
>
> Fixes: 2db154b3ea8e ("vfs: syscall: Add move_mount(2) to move mounts around")
> Signed-off-by: Stephen Smalley <sds@xxxxxxxxxxxxx>
Looks reasonable.
Reviewed-by: Ondrej Mosnacek <omosnace@xxxxxxxxxx>
> ---
> v2 drops the RFC prefix, changes the subject to make it more evident that
> this is a regression fix, and drops the TBD comment from the hook.
>
> security/selinux/hooks.c | 10 ++++++++++
> 1 file changed, 10 insertions(+)
>
> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> index f9224866d60a..b35b5c6ad8be 100644
> --- a/security/selinux/hooks.c
> +++ b/security/selinux/hooks.c
> @@ -2724,6 +2724,14 @@ static int selinux_mount(const char *dev_name,
> return path_has_perm(cred, path, FILE__MOUNTON);
> }
>
> +static int selinux_move_mount(const struct path *from_path,
> + const struct path *to_path)
> +{
> + const struct cred *cred = current_cred();
> +
> + return path_has_perm(cred, to_path, FILE__MOUNTON);
> +}
> +
> static int selinux_umount(struct vfsmount *mnt, int flags)
> {
> const struct cred *cred = current_cred();
> @@ -6913,6 +6921,8 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
> LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
> LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
>
> + LSM_HOOK_INIT(move_mount, selinux_move_mount),
> +
> LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
> LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
>
> --
> 2.24.1
>
--
Ondrej Mosnacek <omosnace at redhat dot com>
Software Engineer, Security Technologies
Red Hat, Inc.
