landlock: Don't lose track of restrictions on cred_transfer
When a process' cred struct is replaced, this _almost_ always invokes
the cred_prepare LSM hook; but in one special case (when
KEYCTL_SESSION_TO_PARENT updates the parent's credentials), the
cred_transfer LSM hook is used instead. Landlock only implements the
cred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes
all information on Landlock restrictions to be lost.
This basically means that a process with the ability to use the fork()
and keyctl() syscalls can get rid of all Landlock restrictions on
itself.
Fix it by adding a cred_transfer hook that does the same thing as the
existing cred_prepare hook. (Implemented by having hook_cred_prepare()
call hook_cred_transfer() so that the two functions are less likely to
accidentally diverge in the future.)
Cc: stable@kernel.org
Fixes: 385975dca5
("landlock: Set up the security framework and manage credentials")
Signed-off-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20240724-landlock-houdini-fix-v1-1-df89a4560ca3@google.com
Signed-off-by: Mickaël Salaün <mic@digikod.net>
This commit is contained in:
parent
0c38364824
commit
39705a6c29
@ -14,8 +14,8 @@
|
|||||||
#include "ruleset.h"
|
#include "ruleset.h"
|
||||||
#include "setup.h"
|
#include "setup.h"
|
||||||
|
|
||||||
static int hook_cred_prepare(struct cred *const new,
|
static void hook_cred_transfer(struct cred *const new,
|
||||||
const struct cred *const old, const gfp_t gfp)
|
const struct cred *const old)
|
||||||
{
|
{
|
||||||
struct landlock_ruleset *const old_dom = landlock_cred(old)->domain;
|
struct landlock_ruleset *const old_dom = landlock_cred(old)->domain;
|
||||||
|
|
||||||
@ -23,6 +23,12 @@ static int hook_cred_prepare(struct cred *const new,
|
|||||||
landlock_get_ruleset(old_dom);
|
landlock_get_ruleset(old_dom);
|
||||||
landlock_cred(new)->domain = old_dom;
|
landlock_cred(new)->domain = old_dom;
|
||||||
}
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
static int hook_cred_prepare(struct cred *const new,
|
||||||
|
const struct cred *const old, const gfp_t gfp)
|
||||||
|
{
|
||||||
|
hook_cred_transfer(new, old);
|
||||||
return 0;
|
return 0;
|
||||||
}
|
}
|
||||||
|
|
||||||
@ -36,6 +42,7 @@ static void hook_cred_free(struct cred *const cred)
|
|||||||
|
|
||||||
static struct security_hook_list landlock_hooks[] __ro_after_init = {
|
static struct security_hook_list landlock_hooks[] __ro_after_init = {
|
||||||
LSM_HOOK_INIT(cred_prepare, hook_cred_prepare),
|
LSM_HOOK_INIT(cred_prepare, hook_cred_prepare),
|
||||||
|
LSM_HOOK_INIT(cred_transfer, hook_cred_transfer),
|
||||||
LSM_HOOK_INIT(cred_free, hook_cred_free),
|
LSM_HOOK_INIT(cred_free, hook_cred_free),
|
||||||
};
|
};
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user