1
2
3
4
5
6
7
8
9
10
11
12
13
14
15#define pr_fmt(fmt) "SafeSetID: " fmt
16
17#include <linux/lsm_hooks.h>
18#include <linux/module.h>
19#include <linux/ptrace.h>
20#include <linux/sched/task_stack.h>
21#include <linux/security.h>
22#include "lsm.h"
23
24
25int safesetid_initialized;
26
27struct setid_ruleset __rcu *safesetid_setuid_rules;
28struct setid_ruleset __rcu *safesetid_setgid_rules;
29
30
31
32enum sid_policy_type _setid_policy_lookup(struct setid_ruleset *policy,
33 kid_t src, kid_t dst)
34{
35 struct setid_rule *rule;
36 enum sid_policy_type result = SIDPOL_DEFAULT;
37
38 if (policy->type == UID) {
39 hash_for_each_possible(policy->rules, rule, next, __kuid_val(src.uid)) {
40 if (!uid_eq(rule->src_id.uid, src.uid))
41 continue;
42 if (uid_eq(rule->dst_id.uid, dst.uid))
43 return SIDPOL_ALLOWED;
44 result = SIDPOL_CONSTRAINED;
45 }
46 } else if (policy->type == GID) {
47 hash_for_each_possible(policy->rules, rule, next, __kgid_val(src.gid)) {
48 if (!gid_eq(rule->src_id.gid, src.gid))
49 continue;
50 if (gid_eq(rule->dst_id.gid, dst.gid)){
51 return SIDPOL_ALLOWED;
52 }
53 result = SIDPOL_CONSTRAINED;
54 }
55 } else {
56
57 result = SIDPOL_CONSTRAINED;
58 }
59 return result;
60}
61
62
63
64
65
66static enum sid_policy_type setid_policy_lookup(kid_t src, kid_t dst, enum setid_type new_type)
67{
68 enum sid_policy_type result = SIDPOL_DEFAULT;
69 struct setid_ruleset *pol;
70
71 rcu_read_lock();
72 if (new_type == UID)
73 pol = rcu_dereference(safesetid_setuid_rules);
74 else if (new_type == GID)
75 pol = rcu_dereference(safesetid_setgid_rules);
76 else {
77 result = SIDPOL_CONSTRAINED;
78 rcu_read_unlock();
79 return result;
80 }
81
82 if (pol) {
83 pol->type = new_type;
84 result = _setid_policy_lookup(pol, src, dst);
85 }
86 rcu_read_unlock();
87 return result;
88}
89
90static int safesetid_security_capable(const struct cred *cred,
91 struct user_namespace *ns,
92 int cap,
93 unsigned int opts)
94{
95
96 if (cap != CAP_SETUID && cap != CAP_SETGID)
97 return 0;
98
99
100
101
102
103
104
105
106
107
108
109
110 if ((opts & CAP_OPT_INSETID) != 0)
111 return 0;
112
113 switch (cap) {
114 case CAP_SETUID:
115
116
117
118
119 if (setid_policy_lookup((kid_t){.uid = cred->uid}, INVALID_ID, UID) == SIDPOL_DEFAULT)
120 return 0;
121
122
123
124
125 pr_warn("Operation requires CAP_SETUID, which is not available to UID %u for operations besides approved set*uid transitions\n",
126 __kuid_val(cred->uid));
127 return -EPERM;
128 break;
129 case CAP_SETGID:
130
131
132
133
134 if (setid_policy_lookup((kid_t){.gid = cred->gid}, INVALID_ID, GID) == SIDPOL_DEFAULT)
135 return 0;
136
137
138
139
140 pr_warn("Operation requires CAP_SETGID, which is not available to GID %u for operations besides approved set*gid transitions\n",
141 __kuid_val(cred->uid));
142 return -EPERM;
143 break;
144 default:
145
146 return 0;
147 break;
148 }
149 return 0;
150}
151
152
153
154
155
156static bool id_permitted_for_cred(const struct cred *old, kid_t new_id, enum setid_type new_type)
157{
158 bool permitted;
159
160
161 if (new_type == UID) {
162 if (uid_eq(new_id.uid, old->uid) || uid_eq(new_id.uid, old->euid) ||
163 uid_eq(new_id.uid, old->suid))
164 return true;
165 } else if (new_type == GID){
166 if (gid_eq(new_id.gid, old->gid) || gid_eq(new_id.gid, old->egid) ||
167 gid_eq(new_id.gid, old->sgid))
168 return true;
169 } else
170 return false;
171
172
173
174
175
176 permitted =
177 setid_policy_lookup((kid_t){.uid = old->uid}, new_id, new_type) != SIDPOL_CONSTRAINED;
178
179 if (!permitted) {
180 if (new_type == UID) {
181 pr_warn("UID transition ((%d,%d,%d) -> %d) blocked\n",
182 __kuid_val(old->uid), __kuid_val(old->euid),
183 __kuid_val(old->suid), __kuid_val(new_id.uid));
184 } else if (new_type == GID) {
185 pr_warn("GID transition ((%d,%d,%d) -> %d) blocked\n",
186 __kgid_val(old->gid), __kgid_val(old->egid),
187 __kgid_val(old->sgid), __kgid_val(new_id.gid));
188 } else
189 return false;
190 }
191 return permitted;
192}
193
194
195
196
197
198
199static int safesetid_task_fix_setuid(struct cred *new,
200 const struct cred *old,
201 int flags)
202{
203
204
205 if (setid_policy_lookup((kid_t){.uid = old->uid}, INVALID_ID, UID) == SIDPOL_DEFAULT)
206 return 0;
207
208 if (id_permitted_for_cred(old, (kid_t){.uid = new->uid}, UID) &&
209 id_permitted_for_cred(old, (kid_t){.uid = new->euid}, UID) &&
210 id_permitted_for_cred(old, (kid_t){.uid = new->suid}, UID) &&
211 id_permitted_for_cred(old, (kid_t){.uid = new->fsuid}, UID))
212 return 0;
213
214
215
216
217
218
219 force_sig(SIGKILL);
220 return -EACCES;
221}
222
223static int safesetid_task_fix_setgid(struct cred *new,
224 const struct cred *old,
225 int flags)
226{
227
228
229 if (setid_policy_lookup((kid_t){.gid = old->gid}, INVALID_ID, GID) == SIDPOL_DEFAULT)
230 return 0;
231
232 if (id_permitted_for_cred(old, (kid_t){.gid = new->gid}, GID) &&
233 id_permitted_for_cred(old, (kid_t){.gid = new->egid}, GID) &&
234 id_permitted_for_cred(old, (kid_t){.gid = new->sgid}, GID) &&
235 id_permitted_for_cred(old, (kid_t){.gid = new->fsgid}, GID))
236 return 0;
237
238
239
240
241
242
243 force_sig(SIGKILL);
244 return -EACCES;
245}
246
247static struct security_hook_list safesetid_security_hooks[] = {
248 LSM_HOOK_INIT(task_fix_setuid, safesetid_task_fix_setuid),
249 LSM_HOOK_INIT(task_fix_setgid, safesetid_task_fix_setgid),
250 LSM_HOOK_INIT(capable, safesetid_security_capable)
251};
252
253static int __init safesetid_security_init(void)
254{
255 security_add_hooks(safesetid_security_hooks,
256 ARRAY_SIZE(safesetid_security_hooks), "safesetid");
257
258
259 safesetid_initialized = 1;
260
261 return 0;
262}
263
264DEFINE_LSM(safesetid_security_init) = {
265 .init = safesetid_security_init,
266 .name = "safesetid",
267};
268