Use SELinux ioctl whitelist about refpolicy HOT 9 CLOSED

from refpolicy.

@doverride Most programs have no reason to use any of these hardware-specific ioctls, so they should not be allowed by default. Programs that need to use them should be explicitly allowed to use them. Ioctls are a very large attack surface, so blanketly allowing them is a bad idea in my opinion.

Android whitelists ioctls, and I suspect its list is a good one.

from refpolicy.

from refpolicy.

Did you perform tests with a Linux system? Contrary to Android, many applications use tty ioctls (TCGETS, TCSETSW, TIOCGWINSZ, etc.) with their stdout file descriptor, many changes attributes to their network sockets, etc.

It is unclear to me how much work needs to be done in order to implement ioctl restrictions that make sense on a Linux system which is not an embedded one (such as Android). If the Android list seems to be good, could you please provide a link to it?

from refpolicy.

from refpolicy.

@fishilico @doverride First, many applications do not use very many ioctls, so per-application whitelists should be doable. It does take work, but no more than creating per-application policies.

A good starting point would be to remove ioctl from some of the interfaces. My understanding is that most applications do not use filesystem ioctls, for example. In other cases, the list of ioctls is well-documented (such as TTYs) and we can whitelist a set of safe ones. In particular, TIOCSTI should not be on the whitelist, as it has been a source of numerous security problems and has few valid use cases. Another good use-case is network ioctls: while some generic ioctls should be allowed, most applications have no business calling device-specific ioctls. Since most vulnerabilities are in the latter, this significantly reduces attack surface. An even clearer case is ioctls that change network configuration: there is absolutely no reason for most applications to be calling them.

from refpolicy.

from refpolicy.

@doverride I think we can use whitelisting for some device nodes, such as PTYs. Also, I think we can just remove ioctl permissions from most filesystem interfaces. Most applications never use filesystem ioctls.

For network devices, I think we can afford to whitelist ioctls that are device-independent and non-privileged. Only certain applications should use device-dependent ioctls.

from refpolicy.

I'm open to patches that address this situation. I wouldn't mind improving things, but I'm highly skeptical, for the same reasons as already stated.

from refpolicy.