Revision 2172fa709ab32ca60e86179dc67d0857be8e2c98 authored by Stephen Smalley on 30 January 2014, 16:26:59 UTC, committed by Paul Moore on 05 February 2014, 17:20:51 UTC
Setting an empty security context (length=0) on a file will lead to incorrectly dereferencing the type and other fields of the security context structure, yielding a kernel BUG. As a zero-length security context is never valid, just reject all such security contexts whether coming from userspace via setxattr or coming from the filesystem upon a getxattr request by SELinux. Setting a security context value (empty or otherwise) unknown to SELinux in the first place is only possible for a root process (CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only if the corresponding SELinux mac_admin permission is also granted to the domain by policy. In Fedora policies, this is only allowed for specific domains such as livecd for setting down security contexts that are not defined in the build host policy. Reproducer: su setenforce 0 touch foo setfattr -n security.selinux foo Caveat: Relabeling or removing foo after doing the above may not be possible without booting with SELinux disabled. Any subsequent access to foo after doing the above will also trigger the BUG. BUG output from Matthew Thode: [ 473.893141] ------------[ cut here ]------------ [ 473.962110] kernel BUG at security/selinux/ss/services.c:654! [ 473.995314] invalid opcode: 0000 [#6] SMP [ 474.027196] Modules linked in: [ 474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G D I 3.13.0-grsec #1 [ 474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0 07/29/10 [ 474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti: ffff8805f50cd488 [ 474.183707] RIP: 0010:[<ffffffff814681c7>] [<ffffffff814681c7>] context_struct_compute_av+0xce/0x308 [ 474.219954] RSP: 0018:ffff8805c0ac3c38 EFLAGS: 00010246 [ 474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX: 0000000000000100 [ 474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI: ffff8805e8aaa000 [ 474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09: 0000000000000006 [ 474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12: 0000000000000006 [ 474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15: 0000000000000000 [ 474.453816] FS: 00007f2e75220800(0000) GS:ffff88061fc00000(0000) knlGS:0000000000000000 [ 474.489254] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4: 00000000000207f0 [ 474.556058] Stack: [ 474.584325] ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98 ffff8805f1190a40 [ 474.618913] ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990 ffff8805e8aac860 [ 474.653955] ffff8805c0ac3cb8 000700068113833a ffff880606c75060 ffff8805c0ac3d94 [ 474.690461] Call Trace: [ 474.723779] [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a [ 474.778049] [<ffffffff81468824>] security_compute_av+0xf4/0x20b [ 474.811398] [<ffffffff8196f419>] avc_compute_av+0x2a/0x179 [ 474.843813] [<ffffffff8145727b>] avc_has_perm+0x45/0xf4 [ 474.875694] [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31 [ 474.907370] [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e [ 474.938726] [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22 [ 474.970036] [<ffffffff811b057d>] vfs_getattr+0x19/0x2d [ 475.000618] [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91 [ 475.030402] [<ffffffff811b063b>] vfs_lstat+0x19/0x1b [ 475.061097] [<ffffffff811b077e>] SyS_newlstat+0x15/0x30 [ 475.094595] [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3 [ 475.148405] [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b [ 475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48 8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7 75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8 [ 475.255884] RIP [<ffffffff814681c7>] context_struct_compute_av+0xce/0x308 [ 475.296120] RSP <ffff8805c0ac3c38> [ 475.328734] ---[ end trace f076482e9d754adc ]--- Reported-by: Matthew Thode <mthode@mthode.org> Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov> Cc: stable@vger.kernel.org Signed-off-by: Paul Moore <pmoore@redhat.com>
1 parent 6a96e15
gpio-it8761e.c
/*
* GPIO interface for IT8761E Super I/O chip
*
* Author: Denis Turischev <denis@compulab.co.il>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License 2 as published
* by the Free Software Foundation.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program; see the file COPYING. If not, write to
* the Free Software Foundation, 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
#include <linux/io.h>
#include <linux/errno.h>
#include <linux/ioport.h>
#include <linux/gpio.h>
#define SIO_CHIP_ID 0x8761
#define CHIP_ID_HIGH_BYTE 0x20
#define CHIP_ID_LOW_BYTE 0x21
static u8 ports[2] = { 0x2e, 0x4e };
static u8 port;
static DEFINE_SPINLOCK(sio_lock);
#define GPIO_NAME "it8761-gpio"
#define GPIO_BA_HIGH_BYTE 0x60
#define GPIO_BA_LOW_BYTE 0x61
#define GPIO_IOSIZE 4
#define GPIO1X_IO 0xf0
#define GPIO2X_IO 0xf1
static u16 gpio_ba;
static u8 read_reg(u8 addr, u8 port)
{
outb(addr, port);
return inb(port + 1);
}
static void write_reg(u8 data, u8 addr, u8 port)
{
outb(addr, port);
outb(data, port + 1);
}
static void enter_conf_mode(u8 port)
{
outb(0x87, port);
outb(0x61, port);
outb(0x55, port);
outb((port == 0x2e) ? 0x55 : 0xaa, port);
}
static void exit_conf_mode(u8 port)
{
outb(0x2, port);
outb(0x2, port + 1);
}
static void enter_gpio_mode(u8 port)
{
write_reg(0x2, 0x7, port);
}
static int it8761e_gpio_get(struct gpio_chip *gc, unsigned gpio_num)
{
u16 reg;
u8 bit;
bit = gpio_num % 8;
reg = (gpio_num >= 8) ? gpio_ba + 1 : gpio_ba;
return !!(inb(reg) & (1 << bit));
}
static int it8761e_gpio_direction_in(struct gpio_chip *gc, unsigned gpio_num)
{
u8 curr_dirs;
u8 io_reg, bit;
bit = gpio_num % 8;
io_reg = (gpio_num >= 8) ? GPIO2X_IO : GPIO1X_IO;
spin_lock(&sio_lock);
enter_conf_mode(port);
enter_gpio_mode(port);
curr_dirs = read_reg(io_reg, port);
if (curr_dirs & (1 << bit))
write_reg(curr_dirs & ~(1 << bit), io_reg, port);
exit_conf_mode(port);
spin_unlock(&sio_lock);
return 0;
}
static void it8761e_gpio_set(struct gpio_chip *gc,
unsigned gpio_num, int val)
{
u8 curr_vals, bit;
u16 reg;
bit = gpio_num % 8;
reg = (gpio_num >= 8) ? gpio_ba + 1 : gpio_ba;
spin_lock(&sio_lock);
curr_vals = inb(reg);
if (val)
outb(curr_vals | (1 << bit) , reg);
else
outb(curr_vals & ~(1 << bit), reg);
spin_unlock(&sio_lock);
}
static int it8761e_gpio_direction_out(struct gpio_chip *gc,
unsigned gpio_num, int val)
{
u8 curr_dirs, io_reg, bit;
bit = gpio_num % 8;
io_reg = (gpio_num >= 8) ? GPIO2X_IO : GPIO1X_IO;
it8761e_gpio_set(gc, gpio_num, val);
spin_lock(&sio_lock);
enter_conf_mode(port);
enter_gpio_mode(port);
curr_dirs = read_reg(io_reg, port);
if (!(curr_dirs & (1 << bit)))
write_reg(curr_dirs | (1 << bit), io_reg, port);
exit_conf_mode(port);
spin_unlock(&sio_lock);
return 0;
}
static struct gpio_chip it8761e_gpio_chip = {
.label = GPIO_NAME,
.owner = THIS_MODULE,
.get = it8761e_gpio_get,
.direction_input = it8761e_gpio_direction_in,
.set = it8761e_gpio_set,
.direction_output = it8761e_gpio_direction_out,
};
static int __init it8761e_gpio_init(void)
{
int i, id, err;
/* chip and port detection */
for (i = 0; i < ARRAY_SIZE(ports); i++) {
spin_lock(&sio_lock);
enter_conf_mode(ports[i]);
id = (read_reg(CHIP_ID_HIGH_BYTE, ports[i]) << 8) +
read_reg(CHIP_ID_LOW_BYTE, ports[i]);
exit_conf_mode(ports[i]);
spin_unlock(&sio_lock);
if (id == SIO_CHIP_ID) {
port = ports[i];
break;
}
}
if (!port)
return -ENODEV;
/* fetch GPIO base address */
enter_conf_mode(port);
enter_gpio_mode(port);
gpio_ba = (read_reg(GPIO_BA_HIGH_BYTE, port) << 8) +
read_reg(GPIO_BA_LOW_BYTE, port);
exit_conf_mode(port);
if (!request_region(gpio_ba, GPIO_IOSIZE, GPIO_NAME))
return -EBUSY;
it8761e_gpio_chip.base = -1;
it8761e_gpio_chip.ngpio = 16;
err = gpiochip_add(&it8761e_gpio_chip);
if (err < 0)
goto gpiochip_add_err;
return 0;
gpiochip_add_err:
release_region(gpio_ba, GPIO_IOSIZE);
gpio_ba = 0;
return err;
}
static void __exit it8761e_gpio_exit(void)
{
if (gpio_ba) {
int ret = gpiochip_remove(&it8761e_gpio_chip);
WARN(ret, "%s(): gpiochip_remove() failed, ret=%d\n",
__func__, ret);
release_region(gpio_ba, GPIO_IOSIZE);
gpio_ba = 0;
}
}
module_init(it8761e_gpio_init);
module_exit(it8761e_gpio_exit);
MODULE_AUTHOR("Denis Turischev <denis@compulab.co.il>");
MODULE_DESCRIPTION("GPIO interface for IT8761E Super I/O chip");
MODULE_LICENSE("GPL");
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...