diff options
author | Paul Moore <paul@paul-moore.com> | 2022-10-10 12:31:21 -0400 |
---|---|---|
committer | Paul Moore <paul@paul-moore.com> | 2022-11-04 23:25:30 -0400 |
commit | b10b9c342f7571f287fd422be5d5c0beb26ba974 (patch) | |
tree | e2afb492a670ba89d761a4f94d875cf0a171b17e /include/linux/lsm_hooks.h | |
parent | 610b17b05c5c682fbb8fefedae1aacaab412eac3 (diff) | |
download | linux-stable-b10b9c342f7571f287fd422be5d5c0beb26ba974.tar.gz linux-stable-b10b9c342f7571f287fd422be5d5c0beb26ba974.tar.bz2 linux-stable-b10b9c342f7571f287fd422be5d5c0beb26ba974.zip |
lsm: make security_socket_getpeersec_stream() sockptr_t safe
Commit 4ff09db1b79b ("bpf: net: Change sk_getsockopt() to take the
sockptr_t argument") made it possible to call sk_getsockopt()
with both user and kernel address space buffers through the use of
the sockptr_t type. Unfortunately at the time of conversion the
security_socket_getpeersec_stream() LSM hook was written to only
accept userspace buffers, and in a desire to avoid having to change
the LSM hook the commit author simply passed the sockptr_t's
userspace buffer pointer. Since the only sk_getsockopt() callers
at the time of conversion which used kernel sockptr_t buffers did
not allow SO_PEERSEC, and hence the
security_socket_getpeersec_stream() hook, this was acceptable but
also very fragile as future changes presented the possibility of
silently passing kernel space pointers to the LSM hook.
There are several ways to protect against this, including careful
code review of future commits, but since relying on code review to
catch bugs is a recipe for disaster and the upstream eBPF maintainer
is "strongly against defensive programming", this patch updates the
LSM hook, and all of the implementations to support sockptr_t and
safely handle both user and kernel space buffers.
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>
Diffstat (limited to 'include/linux/lsm_hooks.h')
-rw-r--r-- | include/linux/lsm_hooks.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 9a7e69aff3d1..2831efebde69 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -949,8 +949,8 @@ * SO_GETPEERSEC. For tcp sockets this can be meaningful if the * socket is associated with an ipsec SA. * @sock is the local socket. - * @optval userspace memory where the security state is to be copied. - * @optlen userspace int where the module should copy the actual length + * @optval memory where the security state is to be copied. + * @optlen memory where the module should copy the actual length * of the security state. * @len as input is the maximum length to copy to userspace provided * by the caller. |