Commit 7ff17f55 authored Aug 21, 2024 by Jann Horn Committed by GONG, Ruiqi Aug 21, 2024

landlock: Don't lose track of restrictions on cred_transfer

mainline inclusion
from mainline-v6.11-rc1
commit 39705a6c29f8a2b93cf5b99528a55366c50014d1
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPQE
CVE: CVE-2024-42318

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=39705a6c29f8a2b93cf5b99528a55366c50014d1



--------------------------------

When a process' cred struct is replaced, this _almost_ always invokes
the cred_prepare LSM hook; but in one special case (when
KEYCTL_SESSION_TO_PARENT updates the parent's credentials), the
cred_transfer LSM hook is used instead.  Landlock only implements the
cred_prepare hook, not cred_transfer, so KEYCTL_SESSION_TO_PARENT causes
all information on Landlock restrictions to be lost.

This basically means that a process with the ability to use the fork()
and keyctl() syscalls can get rid of all Landlock restrictions on
itself.

Fix it by adding a cred_transfer hook that does the same thing as the
existing cred_prepare hook. (Implemented by having hook_cred_prepare()
call hook_cred_transfer() so that the two functions are less likely to
accidentally diverge in the future.)

Cc: stable@kernel.org
Fixes: 385975dc ("landlock: Set up the security framework and manage credentials")
Signed-off-by: Jann Horn <jannh@google.com>
Link: https://lore.kernel.org/r/20240724-landlock-houdini-fix-v1-1-df89a4560ca3@google.com


Signed-off-by: Mickaël Salaün <mic@digikod.net>
Conflicts:
	security/landlock/cred.c
[Just context conflicts.]
Signed-off-by: GONG, Ruiqi <gongruiqi1@huawei.com>

parent 73aa0e41

security/landlock/cred.c

+9 −2

Original line number	Diff line number	Diff line
		@@ -14,8 +14,8 @@
		#include "ruleset.h"
		#include "setup.h"

		static int hook_cred_prepare(struct cred *const new,
		const struct cred *const old, const gfp_t gfp)
		static void hook_cred_transfer(struct cred *const new,
		const struct cred *const old)
		{
		struct landlock_ruleset *const old_dom = landlock_cred(old)->domain;

		@@ -23,6 +23,12 @@ static int hook_cred_prepare(struct cred *const new,
		landlock_get_ruleset(old_dom);
		landlock_cred(new)->domain = old_dom;
		}
		}

		static int hook_cred_prepare(struct cred *const new,
		const struct cred *const old, const gfp_t gfp)
		{
		hook_cred_transfer(new, old);
		return 0;
		}

		@@ -36,6 +42,7 @@ static void hook_cred_free(struct cred *const cred)

		static struct security_hook_list landlock_hooks[] __lsm_ro_after_init = {
		LSM_HOOK_INIT(cred_prepare, hook_cred_prepare),
		LSM_HOOK_INIT(cred_transfer, hook_cred_transfer),
		LSM_HOOK_INIT(cred_free, hook_cred_free),
		};