security: Protection for exploiting null dereference using mmap

Add a new security check on mmap operations to see if the user is attempting
to mmap to low area of the address space.  The amount of space protected is
indicated by the new proc tunable /proc/sys/vm/mmap_min_addr and defaults to
0, preserving existing behavior.

This patch uses a new SELinux security class "memprotect."  Policy already
contains a number of allow rules like a_t self:process * (unconfined_t being
one of them) which mean that putting this check in the process class (its
best current fit) would make it useless as all user processes, which we also
want to protect against, would be allowed. By taking the memprotect name of
the new class it will also make it possible for us to move some of the other
memory protect permissions out of 'process' and into the new class next time
we bump the policy version number (which I also think is a good future idea)

Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: Eric Paris <eparis@redhat.com>
Signed-off-by: James Morris <jmorris@namei.org>

1 files changed, 12 insertions, 5 deletions

diff --git a/include/linux/security.h b/include/linux/security.h
index 9eb9e0fe0331..c11dc8aa0351 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -71,6 +71,7 @@ struct xfrm_user_sec_ctx;
 extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);
 extern int cap_netlink_recv(struct sk_buff *skb, int cap);
 
+extern unsigned long mmap_min_addr;
 /*
  * Values used in the task_security_ops calls
  */
@@ -1241,8 +1242,9 @@ struct security_operations {
         int (*file_ioctl) (struct file * file, unsigned int cmd,
                            unsigned long arg);
         int (*file_mmap) (struct file * file,
-                          unsigned long reqprot,
-                          unsigned long prot, unsigned long flags);
+                          unsigned long reqprot, unsigned long prot,
+                          unsigned long flags, unsigned long addr,
+                          unsigned long addr_only);
         int (*file_mprotect) (struct vm_area_struct * vma,
                               unsigned long reqprot,
                               unsigned long prot);
@@ -1814,9 +1816,12 @@ static inline int security_file_ioctl (struct file *file, unsigned int cmd,
 
 static inline int security_file_mmap (struct file *file, unsigned long reqprot,
                                       unsigned long prot,
-                                      unsigned long flags)
+                                      unsigned long flags,
+                                      unsigned long addr,
+                                      unsigned long addr_only)
 {
-        return security_ops->file_mmap (file, reqprot, prot, flags);
+        return security_ops->file_mmap (file, reqprot, prot, flags, addr,
+                                        addr_only);
 }
 
 static inline int security_file_mprotect (struct vm_area_struct *vma,
@@ -2489,7 +2494,9 @@ static inline int security_file_ioctl (struct file *file, unsigned int cmd,
 
 static inline int security_file_mmap (struct file *file, unsigned long reqprot,
                                       unsigned long prot,
-                                      unsigned long flags)
+                                      unsigned long flags,
+                                      unsigned long addr,
+                                      unsigned long addr_only)
 {
         return 0;
 }