1
2
3
4
5
6
7
8
9
10
11
12
13
14
15#define pr_fmt(fmt) "SafeSetID: " fmt
16
17#include <linux/lsm_hooks.h>
18#include <linux/module.h>
19#include <linux/ptrace.h>
20#include <linux/sched/task_stack.h>
21#include <linux/security.h>
22#include "lsm.h"
23
24
25int safesetid_initialized __initdata;
26
27struct setid_ruleset __rcu *safesetid_setuid_rules;
28struct setid_ruleset __rcu *safesetid_setgid_rules;
29
30
31
32enum sid_policy_type _setid_policy_lookup(struct setid_ruleset *policy,
33 kid_t src, kid_t dst)
34{
35 struct setid_rule *rule;
36 enum sid_policy_type result = SIDPOL_DEFAULT;
37
38 if (policy->type == UID) {
39 hash_for_each_possible(policy->rules, rule, next, __kuid_val(src.uid)) {
40 if (!uid_eq(rule->src_id.uid, src.uid))
41 continue;
42 if (uid_eq(rule->dst_id.uid, dst.uid))
43 return SIDPOL_ALLOWED;
44 result = SIDPOL_CONSTRAINED;
45 }
46 } else if (policy->type == GID) {
47 hash_for_each_possible(policy->rules, rule, next, __kgid_val(src.gid)) {
48 if (!gid_eq(rule->src_id.gid, src.gid))
49 continue;
50 if (gid_eq(rule->dst_id.gid, dst.gid)){
51 return SIDPOL_ALLOWED;
52 }
53 result = SIDPOL_CONSTRAINED;
54 }
55 } else {
56
57 result = SIDPOL_CONSTRAINED;
58 }
59 return result;
60}
61
62
63
64
65
66static enum sid_policy_type setid_policy_lookup(kid_t src, kid_t dst, enum setid_type new_type)
67{
68 enum sid_policy_type result = SIDPOL_DEFAULT;
69 struct setid_ruleset *pol;
70
71 rcu_read_lock();
72 if (new_type == UID)
73 pol = rcu_dereference(safesetid_setuid_rules);
74 else if (new_type == GID)
75 pol = rcu_dereference(safesetid_setgid_rules);
76 else {
77 result = SIDPOL_CONSTRAINED;
78 rcu_read_unlock();
79 return result;
80 }
81
82 if (pol) {
83 pol->type = new_type;
84 result = _setid_policy_lookup(pol, src, dst);
85 }
86 rcu_read_unlock();
87 return result;
88}
89
90static int safesetid_security_capable(const struct cred *cred,
91 struct user_namespace *ns,
92 int cap,
93 unsigned int opts)
94{
95
96 if (cap != CAP_SETUID && cap != CAP_SETGID)
97 return 0;
98
99
100
101
102
103
104
105
106
107
108
109
110 if ((opts & CAP_OPT_INSETID) != 0)
111 return 0;
112
113 switch (cap) {
114 case CAP_SETUID:
115
116
117
118
119 if (setid_policy_lookup((kid_t){.uid = cred->uid}, INVALID_ID, UID) == SIDPOL_DEFAULT)
120 return 0;
121
122
123
124
125 pr_warn("Operation requires CAP_SETUID, which is not available to UID %u for operations besides approved set*uid transitions\n",
126 __kuid_val(cred->uid));
127 return -EPERM;
128 case CAP_SETGID:
129
130
131
132
133 if (setid_policy_lookup((kid_t){.gid = cred->gid}, INVALID_ID, GID) == SIDPOL_DEFAULT)
134 return 0;
135
136
137
138
139 pr_warn("Operation requires CAP_SETGID, which is not available to GID %u for operations besides approved set*gid transitions\n",
140 __kuid_val(cred->uid));
141 return -EPERM;
142 default:
143
144 return 0;
145 }
146 return 0;
147}
148
149
150
151
152
153static bool id_permitted_for_cred(const struct cred *old, kid_t new_id, enum setid_type new_type)
154{
155 bool permitted;
156
157
158 if (new_type == UID) {
159 if (uid_eq(new_id.uid, old->uid) || uid_eq(new_id.uid, old->euid) ||
160 uid_eq(new_id.uid, old->suid))
161 return true;
162 } else if (new_type == GID){
163 if (gid_eq(new_id.gid, old->gid) || gid_eq(new_id.gid, old->egid) ||
164 gid_eq(new_id.gid, old->sgid))
165 return true;
166 } else
167 return false;
168
169
170
171
172
173 permitted =
174 setid_policy_lookup((kid_t){.uid = old->uid}, new_id, new_type) != SIDPOL_CONSTRAINED;
175
176 if (!permitted) {
177 if (new_type == UID) {
178 pr_warn("UID transition ((%d,%d,%d) -> %d) blocked\n",
179 __kuid_val(old->uid), __kuid_val(old->euid),
180 __kuid_val(old->suid), __kuid_val(new_id.uid));
181 } else if (new_type == GID) {
182 pr_warn("GID transition ((%d,%d,%d) -> %d) blocked\n",
183 __kgid_val(old->gid), __kgid_val(old->egid),
184 __kgid_val(old->sgid), __kgid_val(new_id.gid));
185 } else
186 return false;
187 }
188 return permitted;
189}
190
191
192
193
194
195
196static int safesetid_task_fix_setuid(struct cred *new,
197 const struct cred *old,
198 int flags)
199{
200
201
202 if (setid_policy_lookup((kid_t){.uid = old->uid}, INVALID_ID, UID) == SIDPOL_DEFAULT)
203 return 0;
204
205 if (id_permitted_for_cred(old, (kid_t){.uid = new->uid}, UID) &&
206 id_permitted_for_cred(old, (kid_t){.uid = new->euid}, UID) &&
207 id_permitted_for_cred(old, (kid_t){.uid = new->suid}, UID) &&
208 id_permitted_for_cred(old, (kid_t){.uid = new->fsuid}, UID))
209 return 0;
210
211
212
213
214
215
216 force_sig(SIGKILL);
217 return -EACCES;
218}
219
220static int safesetid_task_fix_setgid(struct cred *new,
221 const struct cred *old,
222 int flags)
223{
224
225
226 if (setid_policy_lookup((kid_t){.gid = old->gid}, INVALID_ID, GID) == SIDPOL_DEFAULT)
227 return 0;
228
229 if (id_permitted_for_cred(old, (kid_t){.gid = new->gid}, GID) &&
230 id_permitted_for_cred(old, (kid_t){.gid = new->egid}, GID) &&
231 id_permitted_for_cred(old, (kid_t){.gid = new->sgid}, GID) &&
232 id_permitted_for_cred(old, (kid_t){.gid = new->fsgid}, GID))
233 return 0;
234
235
236
237
238
239
240 force_sig(SIGKILL);
241 return -EACCES;
242}
243
244static struct security_hook_list safesetid_security_hooks[] = {
245 LSM_HOOK_INIT(task_fix_setuid, safesetid_task_fix_setuid),
246 LSM_HOOK_INIT(task_fix_setgid, safesetid_task_fix_setgid),
247 LSM_HOOK_INIT(capable, safesetid_security_capable)
248};
249
250static int __init safesetid_security_init(void)
251{
252 security_add_hooks(safesetid_security_hooks,
253 ARRAY_SIZE(safesetid_security_hooks), "safesetid");
254
255
256 safesetid_initialized = 1;
257
258 return 0;
259}
260
261DEFINE_LSM(safesetid_security_init) = {
262 .init = safesetid_security_init,
263 .name = "safesetid",
264};
265