From mboxrd@z Thu Jan 1 00:00:00 1970 X-Msuck: nntp://news.gmane.org/gmane.linux.lib.musl.general/207 Path: news.gmane.org!not-for-mail From: Vasiliy Kulikov Newsgroups: gmane.linux.lib.musl.general Subject: Re: some fixes to musl Date: Sun, 24 Jul 2011 22:38:41 +0400 Message-ID: <20110724183841.GD6429@albatros> References: <20110721170255.GA7352@albatros> <20110721182101.GB132@brightrain.aerifal.cx> <20110721191643.GA29045@albatros> <20110722020820.GD132@brightrain.aerifal.cx> <20110724093911.GB6076@albatros> <20110724125644.GJ132@brightrain.aerifal.cx> Reply-To: musl@lists.openwall.com NNTP-Posting-Host: lo.gmane.org Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii X-Trace: dough.gmane.org 1311532801 15139 80.91.229.12 (24 Jul 2011 18:40:01 GMT) X-Complaints-To: usenet@dough.gmane.org NNTP-Posting-Date: Sun, 24 Jul 2011 18:40:01 +0000 (UTC) To: musl@lists.openwall.com Original-X-From: musl-return-291-gllmg-musl=m.gmane.org@lists.openwall.com Sun Jul 24 20:39:57 2011 Return-path: Envelope-to: gllmg-musl@lo.gmane.org Original-Received: from mother.openwall.net ([195.42.179.200]) by lo.gmane.org with smtp (Exim 4.69) (envelope-from ) id 1Ql3am-00086P-P8 for gllmg-musl@lo.gmane.org; Sun, 24 Jul 2011 20:39:56 +0200 Original-Received: (qmail 11864 invoked by uid 550); 24 Jul 2011 18:39:56 -0000 Mailing-List: contact musl-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: Original-Received: (qmail 11856 invoked from network); 24 Jul 2011 18:39:56 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=sender:date:from:to:subject:message-id:references:mime-version :content-type:content-disposition:in-reply-to:user-agent; bh=33so7H01CBGpjUKqiAsRHQUl7AHPs/ciHTZHL0wustk=; b=G0j5l4xRbJp4kohouaiqwXivNCXrZRfSmlEAs3+oPQdsyckSzYt9lr+WApM6Xjs3tB gHEtVahvuY103pHUlMQ6dj0/aylCs5P75xl6R1vycAshfGRjEhZjuiwP8nRSM2Z8kDqv ArnISdE+d7bsyiG3FCpFwCnAfV9vYLT9QL3ek= Original-Sender: Vasiliy Kulikov Content-Disposition: inline In-Reply-To: <20110724125644.GJ132@brightrain.aerifal.cx> User-Agent: Mutt/1.5.20 (2009-06-14) Xref: news.gmane.org gmane.linux.lib.musl.general:207 Archived-At: Rich, On Sun, Jul 24, 2011 at 08:56 -0400, Rich Felker wrote: > On Sun, Jul 24, 2011 at 01:39:11PM +0400, Vasiliy Kulikov wrote: > > > It should be obvious that a bogus LSM will create gaping security > > > holes if it's allowed such power. > > > > I don't say such handling is perfect, just want to show it can be > > somehow justified: > > > > Most of LSM hooks maintain some security context associated with > > file/task/socket/etc. Some actions may require (re)allocation of this > > context. If the allocation fails (e.g. OOM), it's wrong to allow the > > task to continue the work with the object, which has an outdated context > > (not updated against some recent activity). So, unexpected ENOMEM is > > returned. > > Are you saying that all operations on the associated object > (file/task/socket/etc.) are automatically first subjected to an LSM > hook? Or just that the LSM module author might set up a hook? The LSM may set up a hook. The hook may deny any access to an object. But not all hooks are registered by all LSM implementations. Some hook implementations are simply log the event and return success unconditionally. IIRC, only SELinux implements all hooks (among all in-tree LSM implementations). If a hook is not registered, it is a noop. > In the latter case, I would say it's a bug and potential gaping > vulnerability for a module to install a hook on any > resource-deallocation function. It should probably needs better review, but at first sight only shutdown() among all deallocations may fail because of LSM. And only SELinux implements it. I suppose hooking shutdown() makes sense as a task may get an fd e.g. for read only access, and shutdown would break RO restriction. close(2) is not hooked. > In short, I think you've raised really good points, and LSM probably > needs an audit... Yes, and possible breakage of implicit expectations is not the only reason for the review :-) Thanks, -- Vasiliy