io_uring,lsm,selinux: add LSM hooks for io_uring_setup()

It is desirable to allow LSM to configure accessibility to io_uring
because it is a coarse yet very simple way to restrict access to it. So,
add an LSM for io_uring_allowed() to guard access to io_uring.

Cc: Paul Moore <paul@paul-moore.com>
Signed-off-by: Hamza Mahfooz <hamzamahfooz@linux.microsoft.com>
Acked-by: Jens Axboe <axboe@kernel.dk>
[PM: merge fuzz due to changes in preceding patches, subj tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>

diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h
index e2f1ce37c41ef086d4f6701fdddfff1b988703c9..9eb313bd0c93f82d2f2a2ddc8cbdbe6d6bf875eb 100644 (file)
--- a/include/linux/lsm_hook_defs.h
+++ b/include/linux/lsm_hook_defs.h
@@ -455,6 +455,7 @@ LSM_HOOK(int, 0, perf_event_write, struct perf_event *event)
 LSM_HOOK(int, 0, uring_override_creds, const struct cred *new)
 LSM_HOOK(int, 0, uring_sqpoll, void)
 LSM_HOOK(int, 0, uring_cmd, struct io_uring_cmd *ioucmd)
+LSM_HOOK(int, 0, uring_allowed, void)
 #endif /* CONFIG_IO_URING */
 
 LSM_HOOK(void, LSM_RET_VOID, initramfs_populated, void)

diff --git a/include/linux/security.h b/include/linux/security.h
index 980b6c207cade716a2b154cad9b4efa09be32345..3e68f8468a22bcaceeabb3a8c035ebaf78a875e8 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -2362,6 +2362,7 @@ static inline int security_perf_event_write(struct perf_event *event)
 extern int security_uring_override_creds(const struct cred *new);
 extern int security_uring_sqpoll(void);
 extern int security_uring_cmd(struct io_uring_cmd *ioucmd);
+extern int security_uring_allowed(void);
 #else
 static inline int security_uring_override_creds(const struct cred *new)
 {
@@ -2375,6 +2376,10 @@ static inline int security_uring_cmd(struct io_uring_cmd *ioucmd)
 {
        return 0;
 }
+extern int security_uring_allowed(void)
+{
+       return 0;
+}
 #endif /* CONFIG_SECURITY */
 #endif /* CONFIG_IO_URING */
 

diff --git a/io_uring/io_uring.c b/io_uring/io_uring.c
index 7e68a613f5dc25d5ae1b7abab192afcceb5f8f90..520547b6c69c662bcbbf252b054c738ccdba18bf 100644 (file)
--- a/io_uring/io_uring.c
+++ b/io_uring/io_uring.c
@@ -3800,7 +3800,7 @@ static inline int io_uring_allowed(void)
                return -EPERM;
 
        if (disabled == 0 || capable(CAP_SYS_ADMIN))
-               return 0;
+               goto allowed_lsm;
 
        io_uring_group = make_kgid(&init_user_ns, sysctl_io_uring_group);
        if (!gid_valid(io_uring_group))
@@ -3809,7 +3809,8 @@ static inline int io_uring_allowed(void)
        if (!in_group_p(io_uring_group))
                return -EPERM;
 
-       return 0;
+allowed_lsm:
+       return security_uring_allowed();
 }
 
 SYSCALL_DEFINE2(io_uring_setup, u32, entries,

diff --git a/security/security.c b/security/security.c
index 143561ebc3e896a5833714741e7e345f8b2fb96a..c9fae447327e9c9449b8aca49426256b87e28940 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -5999,6 +5999,18 @@ int security_uring_cmd(struct io_uring_cmd *ioucmd)
 {
        return call_int_hook(uring_cmd, ioucmd);
 }
+
+/**
+ * security_uring_allowed() - Check if io_uring_setup() is allowed
+ *
+ * Check whether the current task is allowed to call io_uring_setup().
+ *
+ * Return: Returns 0 if permission is granted.
+ */
+int security_uring_allowed(void)
+{
+       return call_int_hook(uring_allowed);
+}
 #endif /* CONFIG_IO_URING */
 
 /**

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 7b867dfec88baaf90dd10a1b9f6c4ce0058ad97c..fb37e87df2262a8662c78a2cc60a8faef64dca4f 100644 (file)
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -7137,6 +7137,19 @@ static int selinux_uring_cmd(struct io_uring_cmd *ioucmd)
        return avc_has_perm(current_sid(), isec->sid,
                            SECCLASS_IO_URING, IO_URING__CMD, &ad);
 }
+
+/**
+ * selinux_uring_allowed - check if io_uring_setup() can be called
+ *
+ * Check to see if the current task is allowed to call io_uring_setup().
+ */
+static int selinux_uring_allowed(void)
+{
+       u32 sid = current_sid();
+
+       return avc_has_perm(sid, sid, SECCLASS_IO_URING, IO_URING__ALLOWED,
+                           NULL);
+}
 #endif /* CONFIG_IO_URING */
 
 static const struct lsm_id selinux_lsmid = {
@@ -7390,6 +7403,7 @@ static struct security_hook_list selinux_hooks[] __ro_after_init = {
        LSM_HOOK_INIT(uring_override_creds, selinux_uring_override_creds),
        LSM_HOOK_INIT(uring_sqpoll, selinux_uring_sqpoll),
        LSM_HOOK_INIT(uring_cmd, selinux_uring_cmd),
+       LSM_HOOK_INIT(uring_allowed, selinux_uring_allowed),
 #endif
 
        /*

diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
index 03e82477dce97faa42bff3369dc838f6796d5491..8a8f3908aac888440094b2773c97b2367130b824 100644 (file)
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
@@ -177,7 +177,7 @@ const struct security_class_mapping secclass_map[] = {
        { "perf_event",
          { "open", "cpu", "kernel", "tracepoint", "read", "write", NULL } },
        { "anon_inode", { COMMON_FILE_PERMS, NULL } },
-       { "io_uring", { "override_creds", "sqpoll", "cmd", NULL } },
+       { "io_uring", { "override_creds", "sqpoll", "cmd", "allowed", NULL } },
        { "user_namespace", { "create", NULL } },
        /* last one */ { NULL, {} }
 };