{"push_id":836342237,"size":1,"distinct_size":1,"ref":"refs/heads/master","head":"3a23535c5e25328307cc935e89afefae4d9b1caa","before":"873c85a9d359ec63f3402f8590cb1c97deff3d5e","commits":[{"sha":"3a23535c5e25328307cc935e89afefae4d9b1caa","author":{"email":"96c56e33d93d5f83686c7a552b3f4f5937152d38@gmail.com","name":"UpInTheAir"},"message":"SELinux: Fix kernel BUG on empty security contexts. [Stephen Smalley]\n\nSetting an empty security context (length=0) on a file will lead to\nincorrectly dereferencing the type and other fields of the security context\nstructure, yielding a kernel BUG. As a zero-length security context is never\nvalid, just reject all such security contexts whether coming from userspace\nvia setxattr or coming from the filesystem upon a getxattr request by\nSELinux.\n\nSetting a security context value (empty or otherwise) unknown to\nSELinux in the first place is only possible for a root process\n(CAP_MAC_ADMIN), and, if running SELinux in enforcing mode, only\nif the corresponding SELinux mac_admin permission is also granted\nto the domain by policy.  In Fedora policies, this is only allowed for\nspecific domains such as livecd for setting down security contexts\nthat are not defined in the build host policy.\n\n[On Android, this can only be set by root/CAP_MAC_ADMIN processes,\nand if running SELinux in enforcing mode, only if mac_admin permission\nis granted in policy.  In Android 4.4, this would only be allowed for\nroot/CAP_MAC_ADMIN processes that are also in unconfined domains. In current\nAOSP master, mac_admin is not allowed for any domains except the recovery\nconsole which has a legitimate need for it.  The other potential vector\nis mounting a maliciously crafted filesystem for which SELinux fetches\nxattrs (e.g. an ext4 filesystem on a SDcard).  However, the end result is\nonly a local denial-of-service (DOS) due to kernel BUG.  This fix is\nqueued for 3.14.]\n\nReproducer:\nsu\nsetenforce 0\ntouch foo\nsetfattr -n security.selinux foo\n\nCaveat:\nRelabeling or removing foo after doing the above may not be possible\nwithout booting with SELinux disabled.  Any subsequent access to foo\nafter doing the above will also trigger the BUG.\n\nBUG output from Matthew Thode:\n[  473.893141] ------------[ cut here ]------------\n[  473.962110] kernel BUG at security/selinux/ss/services.c:654!\n[  473.995314] invalid opcode: 0000 [#6] SMP\n[  474.027196] Modules linked in:\n[  474.058118] CPU: 0 PID: 8138 Comm: ls Tainted: G      D   I\n3.13.0-grsec #1\n[  474.116637] Hardware name: Supermicro X8ST3/X8ST3, BIOS 2.0\n07/29/10\n[  474.149768] task: ffff8805f50cd010 ti: ffff8805f50cd488 task.ti:\nffff8805f50cd488\n[  474.183707] RIP: 0010:[<ffffffff814681c7>]  [<ffffffff814681c7>]\ncontext_struct_compute_av+0xce/0x308\n[  474.219954] RSP: 0018:ffff8805c0ac3c38  EFLAGS: 00010246\n[  474.252253] RAX: 0000000000000000 RBX: ffff8805c0ac3d94 RCX:\n0000000000000100\n[  474.287018] RDX: ffff8805e8aac000 RSI: 00000000ffffffff RDI:\nffff8805e8aaa000\n[  474.321199] RBP: ffff8805c0ac3cb8 R08: 0000000000000010 R09:\n0000000000000006\n[  474.357446] R10: 0000000000000000 R11: ffff8805c567a000 R12:\n0000000000000006\n[  474.419191] R13: ffff8805c2b74e88 R14: 00000000000001da R15:\n0000000000000000\n[  474.453816] FS:  00007f2e75220800(0000) GS:ffff88061fc00000(0000)\nknlGS:0000000000000000\n[  474.489254] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[  474.522215] CR2: 00007f2e74716090 CR3: 00000005c085e000 CR4:\n00000000000207f0\n[  474.556058] Stack:\n[  474.584325]  ffff8805c0ac3c98 ffffffff811b549b ffff8805c0ac3c98\nffff8805f1190a40\n[  474.618913]  ffff8805a6202f08 ffff8805c2b74e88 00068800d0464990\nffff8805e8aac860\n[  474.653955]  ffff8805c0ac3cb8 000700068113833a ffff880606c75060\nffff8805c0ac3d94\n[  474.690461] Call Trace:\n[  474.723779]  [<ffffffff811b549b>] ? lookup_fast+0x1cd/0x22a\n[  474.778049]  [<ffffffff81468824>] security_compute_av+0xf4/0x20b\n[  474.811398]  [<ffffffff8196f419>] avc_compute_av+0x2a/0x179\n[  474.843813]  [<ffffffff8145727b>] avc_has_perm+0x45/0xf4\n[  474.875694]  [<ffffffff81457d0e>] inode_has_perm+0x2a/0x31\n[  474.907370]  [<ffffffff81457e76>] selinux_inode_getattr+0x3c/0x3e\n[  474.938726]  [<ffffffff81455cf6>] security_inode_getattr+0x1b/0x22\n[  474.970036]  [<ffffffff811b057d>] vfs_getattr+0x19/0x2d\n[  475.000618]  [<ffffffff811b05e5>] vfs_fstatat+0x54/0x91\n[  475.030402]  [<ffffffff811b063b>] vfs_lstat+0x19/0x1b\n[  475.061097]  [<ffffffff811b077e>] SyS_newlstat+0x15/0x30\n[  475.094595]  [<ffffffff8113c5c1>] ? __audit_syscall_entry+0xa1/0xc3\n[  475.148405]  [<ffffffff8197791e>] system_call_fastpath+0x16/0x1b\n[  475.179201] Code: 00 48 85 c0 48 89 45 b8 75 02 0f 0b 48 8b 45 a0 48\n8b 3d 45 d0 b6 00 8b 40 08 89 c6 ff ce e8 d1 b0 06 00 48 85 c0 49 89 c7\n75 02 <0f> 0b 48 8b 45 b8 4c 8b 28 eb 1e 49 8d 7d 08 be 80 01 00 00 e8\n[  475.255884] RIP  [<ffffffff814681c7>]\ncontext_struct_compute_av+0xce/0x308\n[  475.296120]  RSP <ffff8805c0ac3c38>\n[  475.328734] ---[ end trace f076482e9d754adc ]---\n\n[sds:  commit message edited to note Android implications and\nto generate a unique Change-Id for gerrit]\n\nChange-Id: I4d5389f0cfa72b5f59dada45081fa47e03805413\nReported-by:  Matthew Thode <mthode@mthode.org>\nSigned-off-by: Stephen Smalley <sds@tycho.nsa.gov>\nCc: stable@vger.kernel.org\nSigned-off-by: Paul Moore <pmoore@redhat.com>\nSigned-off-by: franciscofranco <franciscofranco.1990@gmail.com>","distinct":true,"url":"https://api.github.com/repos/dwander/rework/commits/3a23535c5e25328307cc935e89afefae4d9b1caa"}]}