Re: [PATCH v2 4/4] selinux: Implement create_user_ns hook

[Frederick Lawler]

On 7/19/22 8:32 PM, Paul Moore wrote:
> On Thu, Jul 7, 2022 at 6:32 PM Frederick Lawler <fred@xxxxxxxxxxxxxx> wrote:
> > Unprivileged user namespace creation is an intended feature to enable
> > sandboxing, however this feature is often used to as an initial step to
> > perform a privilege escalation attack.
> >
> > This patch implements a new namespace { userns_create } access control
> > permission to restrict which domains allow or deny user namespace
> > creation. This is necessary for system administrators to quickly protect
> > their systems while waiting for vulnerability patches to be applied.
> >
> > This permission can be used in the following way:
> >
> >          allow domA_t domB_t : namespace { userns_create };
> >
> > Signed-off-by: Frederick Lawler <fred@xxxxxxxxxxxxxx>
> >
> > ---
> > Changes since v1:
> > - Introduce this patch
> > ---
> >   security/selinux/hooks.c            | 9 +++++++++
> >   security/selinux/include/classmap.h | 2 ++
> >   2 files changed, 11 insertions(+)
> >
> > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
> > index beceb89f68d9..73fbcb434fe0 100644
> > --- a/security/selinux/hooks.c
> > +++ b/security/selinux/hooks.c
> > @@ -4227,6 +4227,14 @@ static void selinux_task_to_inode(struct task_struct *p,
> >          spin_unlock(&isec->lock);
> >   }
> >
> > +static int selinux_userns_create(const struct cred *cred)
> > +{
> > +       u32 sid = current_sid();
> > +
> > +       return avc_has_perm(&selinux_state, sid, sid, SECCLASS_NAMESPACE,
> > +                                               NAMESPACE__USERNS_CREATE, NULL);
> > +}
>
> As we continue to discuss this, I'm beginning to think that having a
> dedicated object class for the userns might be a good idea.  I believe
> I was the one who gave you these code snippets, so feel free to blame
> me for the respin ;)

No worries, I'll make this change for v3.

> This is what I'm thinking:
>
>    static int selinux_userns_create(const struct cred *cred)
>    {
>      u32 sid = current_sid();
>
>      return avc_has_perm(&selinux_state, sid, sid,
>                          SECCLASS_USER_NAMESPACE,
>                          USER_NAMESPACE__CREATE, NULL);
>    }
>
> > diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
> > index ff757ae5f253..9943e85c6b3e 100644
> > --- a/security/selinux/include/classmap.h
> > +++ b/security/selinux/include/classmap.h
> > @@ -254,6 +254,8 @@ const struct security_class_mapping secclass_map[] = {
> >            { COMMON_FILE_PERMS, NULL } },
> >          { "io_uring",
> >            { "override_creds", "sqpoll", NULL } },
> > +       { "namespace",
> > +         { "userns_create", NULL } },
>
> The above would need to change to:
>
>    { "user_namespace",
>      { "create", NULL } }