version 4.19.325-cip132
* tag 'v4.19.325-cip132' of https://git.kernel.org/pub/scm/linux/kernel/git/cip/linux-cip:
CIP: Bump version suffix to -cip132 after merge from cip/linux-4.19.y-st tree
Update localversion-st, tree is up-to-date with 5.10.254.
x86/CPU: Fix FPDSS on Zen1
seg6: separate dst_cache for input and output paths in seg6 lwtunnel
netfilter: nft_ct: fix use-after-free in timeout object destroy
apparmor: fix differential encoding verification
apparmor: fix missing bounds check on DEFAULT table in verify_dfa()
ext4: convert inline data to extents when truncate exceeds inline size
virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false
ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu()
crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl
crypto: authencesn - Fix src offset when decrypting in-place
crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption
crypto: authenc - use memcpy_sglist() instead of null skcipher
crypto: algif_aead - snapshot IV for async AEAD requests
crypto: algif_aead - Revert to operating out-of-place
crypto: algif_aead - use memcpy_sglist() instead of null skcipher
crypto: doc - fix kernel-doc notation in chacha.c and af_alg.c
Buffer overflow in drivers/xen/sys-hypervisor.c
xen/privcmd: fix double free via VMA splitting
crypto: algif_aead - Fix minimum RX size check for decryption
crypto: scatterwalk - Backport memcpy_sglist()
batman-adv: avoid OGM aggregation when skb tailroom is insufficient
device property: Check fwnode->secondary when finding properties
device property: Check fwnode->secondary in fwnode_graph_get_next_endpoint()
device property: Retrieve fwnode from of_node via accessor
media: device property: Return true in fwnode_device_is_available for NULL ops
ext4: fix the might_sleep() warnings in kvfree()
mm/huge_memory: fix folio isn't locked in softleaf_to_folio()
usb: gadget: u_ether: Fix race between gether_disconnect and eth_stop
usb: gadget: f_hid: move list and spinlock inits from bind to alloc
net: rfkill: prevent unlimited numbers of rfkill events from being created
cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path
cpufreq: governor: Free dbs_data directly when gov->init() fails
xen/privcmd: unregister xenstore notifier on module exit
rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
net: stmmac: fix integer underflow in chain mode
net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
mmc: vub300: fix NULL-deref on disconnect
net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
batman-adv: reject oversized global TT response buffers
arm64: dts: hisilicon: hi3798cv200: Add missing dma-ranges
arm64: dts: hisilicon: poplar: Correct PCIe reset GPIO polarity
wifi: brcmsmac: Fix dma_free_coherent() size
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
apparmor: fix unprivileged local user can do privileged policy management
apparmor: Fix double free of ns_name in aa_replace_profiles()
apparmor: fix side-effect bug in match_char() macro usage
apparmor: fix: limit the number of levels of policy namespaces
apparmor: replace recursive profile removal with iterative approach
apparmor: fix memory leak in verify_header
apparmor: validate DFA start states are in bounds in unpack_pdb
mm/rmap: fix two comments related to huge_pmd_unshare()
mm/hugetlb: fix two comments related to huge_pmd_unshare()
mm/hugetlb: make detecting shared pte more reliable
Input: uinput - take event lock when submitting FF request "event"
Input: uinput - fix circular locking dependency with ff-core
xfrm_user: fix info leak in build_report()
wifi: rt2x00usb: fix devres lifetime
usb: gadget: f_uac1_legacy: validate control request size
usb: gadget: dummy_hcd: fix premature URB completion when ZLP follows partial transfer
USB: dummy-hcd: Fix locking/synchronization error
vxlan: validate ND option lengths in vxlan_na_create
comedi: me4000: Fix potential overrun of firmware buffer
comedi: me_daq: Fix potential overrun of firmware buffer
comedi: ni_atmio16d: Fix invalid clean-up after failed attach
comedi: Reinit dev->spinlock between attachments to low-level drivers
comedi: dt2815: add hardware detection to prevent crash
bridge: br_nd_send: validate ND option lengths
usb: ulpi: fix double free in ulpi_register_interface() error path
usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive
iio: gyro: mpu3050: Fix out-of-sequence free_irq()
iio: gyro: mpu3050: Move iio_device_register() to correct location
iio: gyro: mpu3050: Fix irq resource leak
iio: gyro: mpu3050: Fix incorrect free_irq() variable
Input: xpad - add support for Razer Wolverine V3 Pro
USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam
USB: serial: option: add support for Rolling Wireless RW135R-GL
USB: serial: io_edgeport: add support for Blackbox IC135A
drm/ast: dp501: Fix initialization of SCU2C
MIPS: Fix the GCC version check for `__multi3' workaround
Bluetooth: SMP: force responder MITM requirements before building the pairing response
Bluetooth: SMP: derive legacy responder STK authentication from MITM state
ALSA: ctxfi: Fix missing SPDIFI1 index handling
ALSA: caiaq: fix stack out-of-bounds read in init_card
USB: serial: option: add MeiG Smart SRM825WN
drm/ioc32: stop speculation on the drm_compat_ioctl path
media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar
Revert "media: dvb-frontends: w7090p: fix null-ptr-deref in w7090p_tuner_write_serpar and w7090p_tuner_read_serpar"
drm/vmwgfx: Add seqno waiter for sync_files
Revert "drm/vmwgfx: Add seqno waiter for sync_files"
ipv6: avoid overflows in ip6_datagram_send_ctl()
net/sched: cls_flow: fix NULL pointer dereference on shared blocks
net/sched: cls_fw: fix NULL pointer dereference on shared blocks
net/x25: Fix overflow when accumulating packets
net/x25: Fix potential double free of skb
net: macb: properly unregister fixed rate clocks
net: macb: fix clk handling on PCI glue driver removal
Bluetooth: MGMT: validate LTK enc_size on load
netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP
netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent
netfilter: nf_conntrack_helper: pass helper to expect cleanup
netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr
netfilter: x_tables: ensure names are nul-terminated
netfilter: nfnetlink_log: account for netlink header size
net: ipv6: flowlabel: defer exclusive option free until RCU teardown
bpf: Fix regsafe() for pointers to packet
net: xilinx: axienet: Correct BD length masks to match AXIDMA IP spec
ipv6: prevent possible UaF in addrconf_permanent_addr()
net/sched: sch_hfsc: fix divide-by-zero in rtsc_min()
bridge: br_nd_send: linearize skb before parsing ND options
ip6_tunnel: clear skb2->cb[] in ip4ip6_err()
ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach()
tg3: Fix race for querying speed/duplex
net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak
crypto: af-alg - fix NULL pointer dereference in scatterwalk
HID: multitouch: Check to ensure report responses match the request
atm: lec: fix use-after-free in sock_def_readable()
HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
dmaengine: xilinx_dma: Fix reset related timeout with two-channel AXIDMA
dmaengine: xilinx_dma: Program interrupt delay timeout
btrfs: fix lost error when running device stats on multiple devices fs
btrfs: fix super block offset in error message in btrfs_validate_super()
dmaengine: xilinx: xilinx_dma: Fix residue calculation for cyclic DMA
dmaengine: xilinx: xilinx_dma: Fix dma_device directions
ext4: reject mount if bigalloc with s_first_data_block != 0
ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal()
ext4: make recently_deleted() properly work with lazy itable initialization
scsi: ses: Handle positive SCSI error from ses_recv_diag()
scsi: ibmvfc: Fix OOB access in ibmvfc_discover_targets_done()
alarmtimer: Fix argument order in alarm_timer_forward()
cpufreq: conservative: Reset requested_freq on limits change
s390/barrier: Make array_index_mask_nospec() __always_inline
sysctl: fix uninitialized variable in proc_do_large_bitmap
ACPICA: Allow address_space_handler Install and _REG execution as 2 separate steps
ACPICA: include/acpi/acpixf.h: Fix indentation
drm/i915/gmbus: fix spurious timeout on 512-byte burst reads
scsi: scsi_transport_sas: Fix the maximum channel scanning issue
RDMA/rw: Fall back to direct SGE on MR pool exhaustion
net: macb: use the current queue number for stats
netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp
netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check()
netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD
Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop
net: fix fanout UAF in packet_release() via NETDEV_UP race
rtnetlink: count IFLA_INFO_SLAVE_KIND in if_nlmsg_size
openvswitch: validate MPLS set/set_masked payload length
net: openvswitch: Avoid releasing netdev before teardown completes
pinctrl: mediatek: common: Fix probe failure for devices without EINT
Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb
Bluetooth: hci_ll: Fix firmware leak on error path
Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv()
af_key: validate families in pfkey_send_migrate()
xfrm: call xdo_dev_state_delete during state update
dma-buf: Include ioctl.h in UAPI header
xen/privcmd: restrict usage in unprivileged domU
i2c: fsi: Fix a potential leak in fsi_i2c_probe()
icmp: fix NULL pointer dereference in icmp_tag_validation()
nfnetlink_osf: validate individual option lengths in fingerprints
net: bonding: fix NULL deref in bond_debug_rlb_hash_show
udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n
net: macb: fix uninitialized rx_fs_lock
wifi: wlcore: Return -ENOMEM instead of -EAGAIN if there is not enough headroom
wifi: mac80211: fix NULL deref in mesh_matches_local()
PM: runtime: Fix a race condition related to device removal
net: bcmgenet: increase WoL poll timeout
netfilter: nf_conntrack_h323: check for zero length in DecodeQ931()
netfilter: xt_time: use unsigned int for monthday bit shift
netfilter: xt_CT: drop pending enqueued packets on template removal
netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case
netfilter: nf_conntrack_sip: fix Content-Length u32 truncation in sip_help_tcp()
netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct()
netfilter: ctnetlink: remove refcounting in expectation dumpers
net/rose: fix NULL pointer dereference in rose_transmit_link on reconnect
Bluetooth: HIDP: Fix possible UAF
Bluetooth: SMP: make SM/PER/KDU/BI-04-C happy
Bluetooth: LE L2CAP: Disconnect if sum of payload sizes exceed SDU
Bluetooth: LE L2CAP: Disconnect if received packet's SDU exceeds IMTU
staging: rtl8723bs: fix null dereference in find_network
net/tcp-md5: Fix MAC comparison to be constant-time
ALSA: pcm: fix wait_time calculations
can: gs_usb: gs_can_open(): always configure bitrates before starting device
usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling
nfsd: fix heap overflow in NFSv4.0 LOCK replay cache
arm64: mm: Add PTE_DIRTY back to PAGE_KERNEL* to fix kexec/hibernation
smb: client: fix iface port assignment in parse_server_interfaces
iio: light: bh1780: fix PM runtime leak on error path
tracing: Fix syscall events activation by ensuring refcount hits zero
s390/xor: Fix xor_xc_2() inline assembly constraints
drm/amd/display: Use GFP_ATOMIC in dc_create_stream_for_sink
smb: client: Don't log plaintext credentials in cifs_set_cifscreds
wifi: mac80211: fix NULL pointer dereference in mesh_rx_csa_frame()
wifi: libertas: fix use-after-free in lbs_free_adapter()
ext4: fix dirtyclusters double decrement on fs shutdown
ext4: drop extent cache when splitting extent fails
drm/exynos: vidi: use priv->vidi_dev for ctx lookup in vidi_connection_ioctl()
net: Handle napi_schedule() calls from non-interrupt
drm/radeon: apply state adjust rules to some additional HAINAN vairants
serial: 8250: Add late synchronize_irq() to shutdown to handle DW UART BUSY
Bluetooth: L2CAP: Validate L2CAP_INFO_RSP payload length before access
net: macb: fix use-after-free access to PTP clock
nvdimm/bus: Fix potential use after free in asynchronous initialization
iio: chemical: bme680: Fix measurement wait duration calculation
iio: potentiometer: mcp4131: fix double application of wiper shift
iio: dac: ds4424: reject -128 RAW value
btrfs: abort transaction on failure to update root in the received subvol ioctl
x86/apic: Disable x2apic on resume if the kernel expects so
drm/amdgpu: Fix use-after-free race in VM acquire
net: ethernet: arc: emac: quiesce interrupts before requesting IRQ
net: ncsi: fix skb leak in error paths
parisc: Fix initial page table creation for boot
nouveau/dpcd: return EBUSY for aux xfer if the device is asleep
parisc: Increase initial mapping to 64 MB with KALLSYMS
batman-adv: Avoid double-rtnl_lock ELP metric worker
media: dvb-net: fix OOB access in ULE extension header tables
staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie
libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply()
mmc: mmci: Fix device_node reference leak in of_get_dml_pipe_index()
usb: image: mdc800: kill download URB on timeout
usb: mdc800: handle signal and read racing
usb: class: cdc-wdm: fix reordering issue in read code path
USB: usbcore: Introduce usb_bulk_msg_killable()
usb: misc: uss720: properly clean up reference in uss720_probe()
usb: yurex: fix race in probe
usb: xhci: Fix memory leak in xhci_disable_slot()
usb/core/quirks: Add Huawei ME906S-device to wakeup quirk
net: usb: lan78xx: skip LTM configuration for LAN7850
net: usb: lan78xx: fix silent drop of packets with checksum errors
cgroup: fix race between task migration and iteration
e1000/e1000e: Fix leak in DMA error cleanup
i40e: fix src IP mask checks and memcpy argument names in cloud filter
nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set
sched: idle: Make skipping governor callbacks more consistent
netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table()
netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path
netfilter: x_tables: guard option walkers against 1-byte tail reads
can: hi311x: hi3110_open(): add check for hi3110_power_enable() return value
serial: caif: hold tty->link reference in ldisc_open and ser_release
net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit
powerpc: 83xx: km83xx: Fix keymile vendor prefix
remoteproc: sysmon: Correct subsys_name_len type in QMI request
powerpc/uaccess: Fix inline assembly for clang build on PPC32
scsi: ses: Fix devices attaching to different hosts
ACPI: OSI: Add DMI quirk for Acer Aspire One D255
unshare: fix unshare_fs() handling
ACPI: PM: Save NVS memory on Lenovo G70-35
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT
net: vxlan: fix nd_tbl NULL dereference when IPv6 is disabled
net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled
nfc: rawsock: cancel tx_work before socket teardown
nfc: nci: clear NCI_DATA_EXCHANGE before calling completion callback
nfc: nci: free skb on nci_transceive early error paths
net: nfc: nci: Fix zero-length proprietary notifications
amd-xgbe: fix sleep while atomic on suspend/resume
xen/acpi-processor: fix _CST detection using undersized evaluation buffer
wifi: wlcore: Fix a locking bug
can: bcm: fix locking for bcm_op runtime updates
atm: lec: fix null-ptr-deref in lec_arp_clear_vccs
platform/x86: thinkpad_acpi: Fix errors reading battery thresholds
drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()
Squashfs: check metadata block offset is within range
wifi: radiotap: reject radiotap with unknown bits
ALSA: usb-audio: Use correct version for UAC3 header validation
can: ucan: Fix infinite loop from zero-length messages
can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message
net: usb: pegasus: validate USB endpoints
net: usb: kalmia: validate USB endpoints
net: usb: kaweth: validate USB endpoints
nfc: pn533: properly drop the usb interface reference on disconnect
media: dvb-core: fix wrong reinitialization of ringbuffer on reopen
net: arcnet: com20020-pci: fix support for 2.5Mbit cards
ALSA: hda/conexant: Add quirk for HP ZBook Studio G4
clk: tegra: tegra124-emc: fix device leak on set_rate()
drm/tegra: dsi: fix device leak on probe
ARM: omap2: Fix reference count leaks in omap_control_init()
ARM: OMAP2+: add missing of_node_put before break and return
ARM: clean up the memset64() C wrapper
Change-Id: If58eb7898e90d049cd97232a5f2c1fc971671b1f
commit 39440b137546a3aa383cfdabc605fb73811b6093 upstream.
Differential encoding allows loops to be created if it is abused. To
prevent this the unpack should verify that a diff-encode chain
terminates.
Unfortunately the differential encode verification had two bugs.
1. it conflated states that had gone through check and already been
marked, with states that were currently being checked and marked.
This means that loops in the current chain being verified are treated
as a chain that has already been verified.
2. the order bailout on already checked states compared current chain
check iterators j,k instead of using the outer loop iterator i.
Meaning a step backwards in states in the current chain verification
was being mistaken for moving to an already verified state.
Move to a double mark scheme where already verified states get a
different mark, than the current chain being kept. This enables us
to also drop the backwards verification check that was the cause of
the second error as any already verified state is already marked.
Fixes: 031dcc8f4e ("apparmor: dfa add support for state differential encoding")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[uli: backport to 4.19]
Signed-off-by: Ulrich Hecht <uli@kernel.org>
Reviewed-by: Pavel Machek <pavel@nabladev.com>
commit 6601e13e82841879406bf9f369032656f441a425 upstream.
Backport for api changes introduced in
- 90c436a64a6e ("apparmor: pass cred through to audit info.")
- 92de220a7f33 ("apparmor: update policy capable checks to use a label")
An unprivileged local user can load, replace, and remove profiles by
opening the apparmorfs interfaces, via a confused deputy attack, by
passing the opened fd to a privileged process, and getting the
privileged process to write to the interface.
This does require a privileged target that can be manipulated to do
the write for the unprivileged process, but once such access is
achieved full policy management is possible and all the possible
implications that implies: removing confinement, DoS of system or
target applications by denying all execution, by-passing the
unprivileged user namespace restriction, to exploiting kernel bugs for
a local privilege escalation.
The policy management interface can not have its permissions simply
changed from 0666 to 0600 because non-root processes need to be able
to load policy to different policy namespaces.
Instead ensure the task writing the interface has privileges that
are a subset of the task that opened the interface. This is already
done via policy for confined processes, but unconfined can delegate
access to the opened fd, by-passing the usual policy check.
Fixes: b7fd2c0340 ("apparmor: add per policy ns .load, .replace, .remove interface files")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Tested-by: Salvatore Bonaccorso <carnil@debian.org>
Reviewed-by: Georgia Garcia <georgia.garcia@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
commit 306039414932c80f8420695a24d4fe10c84ccfb2 upstream.
Currently the number of policy namespaces is not bounded relying on
the user namespace limit. However policy namespaces aren't strictly
tied to user namespaces and it is possible to create them and nest
them arbitrarily deep which can be used to exhaust system resource.
Hard cap policy namespaces to the same depth as user namespaces.
Fixes: c88d4c7b04 ("AppArmor: core policy routines")
Reported-by: Qualys Security Advisory <qsa@qualys.com>
Reviewed-by: Ryan Lee <ryan.lee@canonical.com>
Reviewed-by: Cengiz Can <cengiz.can@canonical.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ulrich Hecht <uli@kernel.org>
Reserve a secid value that we can use as a wildcard, allowing us to
define policy that's expected to match against all secids.
Change-Id: I103f0970c94cfcb14678f648613568714b5b6ddf
Signed-off-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Add support for parsing secmark policy provided by userspace, and
store that in the overall policy.
Change-Id: I8cc6c232e685042ad517896b17610bbd9733f977
Signed-off-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Move management of the task_struct->security blob out
of the individual security modules and into the security
infrastructure. Instead of allocating the blobs from within
the modules the modules tell the infrastructure how much
space is required, and the space is allocated there.
The only user of this blob is AppArmor. The AppArmor use
is abstracted to avoid future conflict.
Change-Id: Ic315d4b73ad2e62ab53515f3e1c8085a0151596b
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
[kees: adjusted for ordered init series]
Signed-off-by: Kees Cook <keescook@chromium.org>
Move management of the file->f_security blob out of the
individual security modules and into the infrastructure.
The modules no longer allocate or free the data, instead
they tell the infrastructure how much space they require.
Change-Id: I43c6b69dbc7745217c6e0a0283aae7fa1eca568c
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
[kees: adjusted for ordered init series]
Signed-off-by: Kees Cook <keescook@chromium.org>
Move management of the cred security blob out of the
security modules and into the security infrastructre.
Instead of allocating and freeing space the security
modules tell the infrastructure how much space they
require.
Change-Id: I6c6093e9d15efb9c89ecb347d2931e662c0232bb
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
[kees: adjusted for ordered init series]
Signed-off-by: Kees Cook <keescook@chromium.org>
Don't use the cred->security pointer directly.
Provide a helper function that provides the security blob pointer.
Change-Id: If3f4a508e221c26a099ecd3d18b9e57fc64ecd1e
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
[kees: adjusted for ordered init series]
Signed-off-by: Kees Cook <keescook@chromium.org>
commit 2504db207146543736e877241f3b3de005cbe056 upstream.
When finding the profile via patterned attachments, the longest left
match is being set to the static compile time value and not using the
runtime computed value.
Fix this by setting the candidate value to the greater of the
precomputed value or runtime computed value.
Fixes: 21f6066105 ("apparmor: improve overlapping domain attachment resolution")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
commit 511f7b5b835726e844a5fc7444c18e4b8672edfd upstream.
AppArmor is prefixing secids that are converted to secctx with the =
to indicate the secctx should only be parsed from an absolute root
POV. This allows catching errors where secctx are reparsed back into
internal labels.
Unfortunately because audit is using secid to secctx conversion this
means that subject and object labels can result in a very unfortunate
== that can break audit parsing.
eg. the subj==unconfined term in the below audit message
type=USER_LOGIN msg=audit(1639443365.233:160): pid=1633 uid=0 auid=1000
ses=3 subj==unconfined msg='op=login id=1000 exe="/usr/sbin/sshd"
hostname=192.168.122.1 addr=192.168.122.1 terminal=/dev/pts/1 res=success'
Fix this by switch the prepending of = to a _. This still works as a
special character to flag this case without breaking audit. Also move
this check behind debug as it should not be needed during normal
operqation.
Fixes: 26b7899510 ("apparmor: add support for absolute root view based labels")
Reported-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit 1f8266ff58840d698a1e96d2274189de1bdf7969 ]
As a comment above begin_current_label_crit_section() explains,
begin_current_label_crit_section() must run in sleepable context because
when label_is_stale() is true, aa_replace_current_label() runs, which uses
prepare_creds(), which can sleep.
Until now, the ptrace access check (which runs with a task lock held)
violated this rule.
Also add a might_sleep() assertion to begin_current_label_crit_section(),
because asserts are less likely to be ignored than comments.
Fixes: b2d09ae449 ("apparmor: move ptrace checks to using labels")
Signed-off-by: Jann Horn <jannh@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
[ Upstream commit c1a85a00ea66cb6f0bd0f14e47c28c2b0999799f ]
This patch provides a general mechanism for passing flags to the
security_capable LSM hook. It replaces the specific 'audit' flag that is
used to tell security_capable whether it should log an audit message for
the given capability check. The reason for generalizing this flag
passing is so we can add an additional flag that signifies whether
security_capable is being called by a setid syscall (which is needed by
the proposed SafeSetID LSM).
Signed-off-by: Micah Morton <mortonm@chromium.org>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: James Morris <james.morris@microsoft.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
commit 23375b13f98c5464c2b4d15f983cc062940f1f4e upstream.
While commit 11c236b89d ("apparmor: add a default null dfa") ensure
every profile has a policy.dfa it does not resize the policy.start[]
to have entries for every possible start value. Which means
PROFILE_MEDIATES is not safe to use on untrusted input. Unforunately
commit b9590ad4c4 ("apparmor: remove POLICY_MEDIATES_SAFE") did not
take into account the start value usage.
The input string in profile_query_cb() is user controlled and is not
properly checked to be within the limited start[] entries, even worse
it can't be as userspace policy is allowed to make us of entries types
the kernel does not know about. This mean usespace can currently cause
the kernel to access memory up to 240 entries beyond the start array
bounds.
Cc: stable@vger.kernel.org
Fixes: b9590ad4c4 ("apparmor: remove POLICY_MEDIATES_SAFE")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Don't read past the end of the buffer containing permissions
characters or write past the end of the destination string.
Detected by CoverityScan CID#1415361, 1415376 ("Out-of-bounds access")
Fixes: e53cfe6c7c ("apparmor: rework perm mapping to a slightly broader set")
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
Acked-by: Serge Hallyn <serge@hallyn.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
The IDR conversion did not handle an error case for when allocating a
mapping fails, and it did not ensure that mappings did not allocate or
use a 0 value, which is used as an invalid secid. Which is used when a
mapping fails.
Fixes: 3ae7eb49a2be ("apparmor: Use an IDR to allocate apparmor secids")
Signed-off-by: John Johansen <john.johansen@canonical.com>
This patch adds support to Apparmor for integrating with audit rule
filtering. Right now it only handles SUBJ_ROLE, interpreting it as a
single component of a label. This is sufficient to get Apparmor working
with IMA's appraisal rules without any modifications on the IMA side.
Signed-off-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Refactor get_buffers so the cpu_ptr can be obtained in the outer
layer, instead of inside the macro.
This also enables us to cleanup the code and use get_cpu_ptr,
to handle the preempt_disable()
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Use a radix tree to provide a map between the secid and the label,
and along with it a basic ability to provide secctx conversion.
Shared/cached secctx will be added later.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Pull apparmor updates from John Johansen:
"Features:
- add base infrastructure for socket mediation. ABI bump and
additional checks to ensure only v8 compliant policy uses socket af
mediation.
- improve and cleanup dfa verification
- improve profile attachment logic
- improve overlapping expression handling
- add the xattr matching to the attachment logic
- improve signal mediation handling with stacked labels
- improve handling of no_new_privs in a label stack
Cleanups and changes:
- use dfa to parse string split
- bounded version of label_parse
- proper line wrap nulldfa.in
- split context out into task and cred naming to better match usage
- simplify code in aafs
Bug fixes:
- fix display of .ns_name for containers
- fix resource audit messages when auditing peer
- fix logging of the existence test for signals
- fix resource audit messages when auditing peer
- fix display of .ns_name for containers
- fix an error code in verify_table_headers()
- fix memory leak on buffer on error exit path
- fix error returns checks by making size a ssize_t"
* tag 'apparmor-pr-2018-04-10' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor: (36 commits)
apparmor: fix memory leak on buffer on error exit path
apparmor: fix dangling symlinks to policy rawdata after replacement
apparmor: Fix an error code in verify_table_headers()
apparmor: fix error returns checks by making size a ssize_t
apparmor: update MAINTAINERS file git and wiki locations
apparmor: remove POLICY_MEDIATES_SAFE
apparmor: add base infastructure for socket mediation
apparmor: improve overlapping domain attachment resolution
apparmor: convert attaching profiles via xattrs to use dfa matching
apparmor: Add support for attaching profiles via xattr, presence and value
apparmor: cleanup: simplify code to get ns symlink name
apparmor: cleanup create_aafs() error path
apparmor: dfa split verification of table headers
apparmor: dfa add support for state differential encoding
apparmor: dfa move character match into a macro
apparmor: update domain transitions that are subsets of confinement at nnp
apparmor: move context.h to cred.h
apparmor: move task related defines and fns to task.X files
apparmor: cleanup, drop unused fn __aa_task_is_confined()
apparmor: cleanup fixup description of aa_replace_profiles
...
move COUNT_ARGS() macro from apparmor to generic header and extend it
to count till twelve.
COUNT() was an alternative name for this logic, but it's used for
different purpose in many other places.
Similarly for CONCATENATE() macro.
Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
The unpack code now makes sure every profile has a dfa so the safe
version of POLICY_MEDIATES is no longer needed.
Signed-off-by: John Johansen <john.johansen@canonical.com>
version 2 - Force an abi break. Network mediation will only be
available in v8 abi complaint policy.
Provide a basic mediation of sockets. This is not a full net mediation
but just whether a spcific family of socket can be used by an
application, along with setting up some basic infrastructure for
network mediation to follow.
the user space rule hav the basic form of
NETWORK RULE = [ QUALIFIERS ] 'network' [ DOMAIN ]
[ TYPE | PROTOCOL ]
DOMAIN = ( 'inet' | 'ax25' | 'ipx' | 'appletalk' | 'netrom' |
'bridge' | 'atmpvc' | 'x25' | 'inet6' | 'rose' |
'netbeui' | 'security' | 'key' | 'packet' | 'ash' |
'econet' | 'atmsvc' | 'sna' | 'irda' | 'pppox' |
'wanpipe' | 'bluetooth' | 'netlink' | 'unix' | 'rds' |
'llc' | 'can' | 'tipc' | 'iucv' | 'rxrpc' | 'isdn' |
'phonet' | 'ieee802154' | 'caif' | 'alg' | 'nfc' |
'vsock' | 'mpls' | 'ib' | 'kcm' ) ','
TYPE = ( 'stream' | 'dgram' | 'seqpacket' | 'rdm' | 'raw' |
'packet' )
PROTOCOL = ( 'tcp' | 'udp' | 'icmp' )
eg.
network,
network inet,
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Overlapping domain attachments using the current longest left exact
match fail in some simple cases, and with the fix to ensure consistent
behavior by failing unresolvable attachments it becomes important to
do a better job.
eg. under the current match the following are unresolvable where
the alternation is clearly a better match under the most specific
left match rule.
/**
/{bin/,}usr/
Use a counting match that detects when a loop in the state machine is
enter, and return the match count to provide a better specific left
match resolution.
Signed-off-by: John Johansen <john.johansen@canonical.com>
This converts profile attachment based on xattrs to a fixed extended
conditional using dfa matching.
This has a couple of advantages
- pattern matching can be used for the xattr match
- xattrs can be optional for an attachment or marked as required
- the xattr attachment conditional will be able to be combined with
other extended conditionals when the flexible extended conditional
work lands.
The xattr fixed extended conditional is appended to the xmatch
conditional. If an xattr attachment is specified the profile xmatch
will be generated regardless of whether there is a pattern match on
the executable name.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Make it possible to tie Apparmor profiles to the presence of one or more
extended attributes, and optionally their values. An example usecase for
this is to automatically transition to a more privileged Apparmor profile
if an executable has a valid IMA signature, which can then be appraised
by the IMA subsystem.
Signed-off-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
State differential encoding can provide better compression for
apparmor policy, without having significant impact on match time.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Domain transition so far have been largely blocked by no new privs,
unless the transition has been provably a subset of the previous
confinement. There was a couple problems with the previous
implementations,
- transitions that weren't explicitly a stack but resulted in a subset
of confinement were disallowed
- confinement subsets were only calculated from the previous
confinement instead of the confinement being enforced at the time of
no new privs, so transitions would have to get progressively
tighter.
Fix this by detecting and storing a reference to the task's
confinement at the "time" no new privs is set. This reference is then
used to determine whether a transition is a subsystem of the
confinement at the time no new privs was set.
Unfortunately the implementation is less than ideal in that we have to
detect no new privs after the fact when a task attempts a domain
transition. This is adequate for the currently but will not work in a
stacking situation where no new privs could be conceivably be set in
both the "host" and in the container.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Now that file contexts have been moved into file, and task context
fns() and data have been split from the context, only the cred context
remains in context.h so rename to cred.h to better reflect what it
deals with.
Signed-off-by: John Johansen <john.johansen@canonical.com>
With the task domain change information now stored in the task->security
context, the cred->security context only stores the label. We can get
rid of the cred_ctx and directly reference the label, removing a layer
of indirection, and unneeded extra allocations.
Signed-off-by: John Johansen <john.johansen@canonical.com>
The task domain change info is task specific and its and abuse of
the cred to store the information in there. Now that a task->security
field exists store it in the proper place.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Allow apparmor to audit the number of a signal that it does not
provide a mapping for and is currently being reported only as
unknown.
Signed-off-by: John Johansen <john.johansen@canonical.com>
some label/context sources might not be guaranteed to be null terminiated
provide a size bounded version of label parse to deal with these.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
The current split scheme is actually wrong in that it splits
///&
where that is invalid and should fail. Use the dfa to do a proper
bounded split without having to worry about getting the string
processing right in code.
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Seth Arnold <seth.arnold@canonical.com>
Splitting the management struct from the actual data blob will allow
us in the future to do some sharing and other data reduction
techniques like replacing the the raw data with compressed data.
Prepare for this by separating the management struct from the data
blob.
Signed-off-by: John Johansen <john.johansen@canonical.com>
The existence test is not being properly logged as the signal mapping
maps it to the last entry in the named signal table. This is done
to help catch bugs by making the 0 mapped signal value invalid so
that we can catch the signal value not being filled in.
When fixing the off-by-one comparision logic the reporting of the
existence test was broken, because the logic behind the mapped named
table was hidden. Fix this by adding a define for the name lookup
and using it.
Cc: Stable <stable@vger.kernel.org>
Fixes: f7dc4c9a85 ("apparmor: fix off-by-one comparison on MAXMAPPED_SIG")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Resource auditing is using the peer field which is not available
when the rlim data struct is used, because it is a different element
of the same union. Accessing peer during resource auditing could
cause garbage log entries or even oops the kernel.
Move the rlim data block into the same struct as the peer field
so they can be used together.
CC: <stable@vger.kernel.org>
Fixes: 86b92cb782 ("apparmor: move resource checks to using labels")
Signed-off-by: John Johansen <john.johansen@canonical.com>
Given a label with a profile stack of
A//&B or A//&C ...
A ptrace rule should be able to specify a generic trace pattern with
a rule like
ptrace trace A//&**,
however this is failing because while the correct label match routine
is called, it is being done post label decomposition so it is always
being done against a profile instead of the stacked label.
To fix this refactor the cross check to pass the full peer label in to
the label_match.
Fixes: 290f458a4f ("apparmor: allow ptrace checks to be finer grained than just capability")
Cc: Stable <stable@vger.kernel.org>
Reported-by: Matthew Garrett <mjg59@google.com>
Tested-by: Matthew Garrett <mjg59@google.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Pull apparmor bugfix from John Johansen:
"Fix oops in audit_signal_cb hook marked for stable"
* tag 'apparmor-pr-2017-11-30' of git://git.kernel.org/pub/scm/linux/kernel/git/jj/linux-apparmor:
apparmor: fix oops in audit_signal_cb hook
This is a pure automated search-and-replace of the internal kernel
superblock flags.
The s_flags are now called SB_*, with the names and the values for the
moment mirroring the MS_* flags that they're equivalent to.
Note how the MS_xyz flags are the ones passed to the mount system call,
while the SB_xyz flags are what we then use in sb->s_flags.
The script to do this was:
# places to look in; re security/*: it generally should *not* be
# touched (that stuff parses mount(2) arguments directly), but
# there are two places where we really deal with superblock flags.
FILES="drivers/mtd drivers/staging/lustre fs ipc mm \
include/linux/fs.h include/uapi/linux/bfs_fs.h \
security/apparmor/apparmorfs.c security/apparmor/include/lib.h"
# the list of MS_... constants
SYMS="RDONLY NOSUID NODEV NOEXEC SYNCHRONOUS REMOUNT MANDLOCK \
DIRSYNC NOATIME NODIRATIME BIND MOVE REC VERBOSE SILENT \
POSIXACL UNBINDABLE PRIVATE SLAVE SHARED RELATIME KERNMOUNT \
I_VERSION STRICTATIME LAZYTIME SUBMOUNT NOREMOTELOCK NOSEC BORN \
ACTIVE NOUSER"
SED_PROG=
for i in $SYMS; do SED_PROG="$SED_PROG -e s/MS_$i/SB_$i/g"; done
# we want files that contain at least one of MS_...,
# with fs/namespace.c and fs/pnode.c excluded.
L=$(for i in $SYMS; do git grep -w -l MS_$i $FILES; done| sort|uniq|grep -v '^fs/namespace.c'|grep -v '^fs/pnode.c')
for f in $L; do sed -i $f $SED_PROG; done
Requested-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
This reverts commit 651e28c553.
This caused a regression:
"The specific problem is that dnsmasq refuses to start on openSUSE Leap
42.2. The specific cause is that and attempt to open a PF_LOCAL socket
gets EACCES. This means that networking doesn't function on a system
with a 4.14-rc2 system."
Sadly, the developers involved seemed to be in denial for several weeks
about this, delaying the revert. This has not been a good release for
the security subsystem, and this area needs to change development
practices.
Reported-and-bisected-by: James Bottomley <James.Bottomley@hansenpartnership.com>
Tracked-by: Thorsten Leemhuis <regressions@leemhuis.info>
Cc: John Johansen <john.johansen@canonical.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: Seth Arnold <seth.arnold@canonical.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
