[RFC][PATCH 0/7] File descriptor labeling

[Roberto Sassu]

File descriptor labeling issue

Actually SELinux and SMACK assign to file descriptors the same label of the
opening process and use it in LSM hooks security_file_permission(),
security_file_fcntl() and others to verify if the 'current' process has the
rights to perform the requested operation.

Using the credentials of the 'current' process may be not appropriate in
case a file descriptor is opened by a kernel service (i.e. a filesystem)
and made shared among user processes. For instance, in a system with
SELinux and eCryptfs, if the process A opens an encrypted file, eCryptfs
obtains a file descriptor to access the correspondent inode in the lower
filesystem, labeled with the A's label.

If the process B accesses the same encrypted file, it needs the 'use'
permission on the A's label other than permissions for the lower inode.
However, if B is the first accessing process, A needs the 'use' permission
on the B's label.

The solution proposed is to modify those kernel services that deal with
file descriptors to provide their set of credentials to dentry_open(), so
that obtained objects are labeled with a unique label. In this way, in the
above example, if eCryptfs provides its credentials with the label C to
dentry_open(), all user processes need the 'use' permission only on C.



File descriptor labeling and IMA

The above proposal suggests to use the file descriptor label as a new
criteria in the IMA policy to determine if a file must be measured. It will
be possible to measure all files opened by a kernel service by simply
writing a rule where the file descriptor label given as a value matches the
one provided by the same service together with other credentials to the
function dentry_open().

In the above example, if eCryptfs provides its credentials with the label C
to dentry_open(), it is possible to measure all inodes opened in the lower
filesystem by specifying a rule like:

fowner_type=C


The benefits of this new criteria will be greater with the integration of
EVM and the IMA appraisal feature in the kernel. ECryptfs can be used in
conjunction with these components to verify the integrity of the content
and extended attributes of encrypted files.

Roberto Sassu


Roberto Sassu (7):
  fs: initialize file->f_cred with credentials provided
  selinux: label new file descriptors using file->f_cred
  smack: assign the label set in file->f_cred to new file descriptors
  smack: fix label check in smack_kernel_act_as()
  smack: import the security label in smack_secctx_to_secid()
  security: new LSM hook security_file_getsecid()
  ima: added new LSM conditions in the policy

 Documentation/ABI/testing/ima_policy |    7 ++++-
 fs/file_table.c                      |    5 +--
 fs/internal.h                        |    2 +-
 fs/namei.c                           |    2 +-
 fs/open.c                            |    2 +-
 include/linux/security.h             |   12 +++++++++
 security/capability.c                |    6 ++++
 security/integrity/ima/ima.h         |    4 +-
 security/integrity/ima/ima_api.c     |    4 +-
 security/integrity/ima/ima_main.c    |    4 +-
 security/integrity/ima/ima_policy.c  |   45 +++++++++++++++++++++++++++++----
 security/security.c                  |    6 ++++
 security/selinux/hooks.c             |    9 ++++++-
 security/smack/smack_lsm.c           |   23 +++++++++++++++--
 14 files changed, 108 insertions(+), 23 deletions(-)

-- 
1.7.4.4

Attachment: smime.p7s
Description: S/MIME cryptographic signature