Skip to content

Commit 37f670a

Browse files
cschauflerpcmoore
cschaufler
authored and
pcmoore
committed
lsm: use lsm_prop in security_current_getsecid
Change the security_current_getsecid_subj() and security_task_getsecid_obj() interfaces to fill in a lsm_prop structure instead of a u32 secid. Audit interfaces will need to collect all possible security data for possible reporting. Cc: linux-integrity@vger.kernel.org Cc: audit@vger.kernel.org Cc: selinux@vger.kernel.org Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> [PM: subject line tweak] Signed-off-by: Paul Moore <paul@paul-moore.com>
1 parent e4f6822 commit 37f670a

File tree

16 files changed

+139
-108
lines changed

16 files changed

+139
-108
lines changed

‎include/linux/lsm_hook_defs.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -235,9 +235,9 @@ LSM_HOOK(int, 0, task_fix_setgroups, struct cred *new, const struct cred * old)
235235
LSM_HOOK(int, 0, task_setpgid, struct task_struct *p, pid_t pgid)
236236
LSM_HOOK(int, 0, task_getpgid, struct task_struct *p)
237237
LSM_HOOK(int, 0, task_getsid, struct task_struct *p)
238-
LSM_HOOK(void, LSM_RET_VOID, current_getsecid_subj, u32 *secid)
239-
LSM_HOOK(void, LSM_RET_VOID, task_getsecid_obj,
240-
struct task_struct *p, u32 *secid)
238+
LSM_HOOK(void, LSM_RET_VOID, current_getlsmprop_subj, struct lsm_prop *prop)
239+
LSM_HOOK(void, LSM_RET_VOID, task_getlsmprop_obj,
240+
struct task_struct *p, struct lsm_prop *prop)
241241
LSM_HOOK(int, 0, task_setnice, struct task_struct *p, int nice)
242242
LSM_HOOK(int, 0, task_setioprio, struct task_struct *p, int ioprio)
243243
LSM_HOOK(int, 0, task_getioprio, struct task_struct *p)

‎include/linux/security.h

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -507,8 +507,8 @@ int security_task_fix_setgroups(struct cred *new, const struct cred *old);
507507
int security_task_setpgid(struct task_struct *p, pid_t pgid);
508508
int security_task_getpgid(struct task_struct *p);
509509
int security_task_getsid(struct task_struct *p);
510-
void security_current_getsecid_subj(u32 *secid);
511-
void security_task_getsecid_obj(struct task_struct *p, u32 *secid);
510+
void security_current_getlsmprop_subj(struct lsm_prop *prop);
511+
void security_task_getlsmprop_obj(struct task_struct *p, struct lsm_prop *prop);
512512
int security_task_setnice(struct task_struct *p, int nice);
513513
int security_task_setioprio(struct task_struct *p, int ioprio);
514514
int security_task_getioprio(struct task_struct *p);
@@ -1305,14 +1305,15 @@ static inline int security_task_getsid(struct task_struct *p)
13051305
return 0;
13061306
}
13071307

1308-
static inline void security_current_getsecid_subj(u32 *secid)
1308+
static inline void security_current_getlsmprop_subj(struct lsm_prop *prop)
13091309
{
1310-
*secid = 0;
1310+
lsmprop_init(prop);
13111311
}
13121312

1313-
static inline void security_task_getsecid_obj(struct task_struct *p, u32 *secid)
1313+
static inline void security_task_getlsmprop_obj(struct task_struct *p,
1314+
struct lsm_prop *prop)
13141315
{
1315-
*secid = 0;
1316+
lsmprop_init(prop);
13161317
}
13171318

13181319
static inline int security_task_setnice(struct task_struct *p, int nice)

‎kernel/audit.c

Lines changed: 5 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -2179,16 +2179,16 @@ void audit_log_key(struct audit_buffer *ab, char *key)
21792179

21802180
int audit_log_task_context(struct audit_buffer *ab)
21812181
{
2182+
struct lsm_prop prop;
21822183
char *ctx = NULL;
21832184
unsigned len;
21842185
int error;
2185-
u32 sid;
21862186

2187-
security_current_getsecid_subj(&sid);
2188-
if (!sid)
2187+
security_current_getlsmprop_subj(&prop);
2188+
if (!lsmprop_is_set(&prop))
21892189
return 0;
21902190

2191-
error = security_secid_to_secctx(sid, &ctx, &len);
2191+
error = security_lsmprop_to_secctx(&prop, &ctx, &len);
21922192
if (error) {
21932193
if (error != -EINVAL)
21942194
goto error_path;
@@ -2405,8 +2405,7 @@ int audit_signal_info(int sig, struct task_struct *t)
24052405
audit_sig_uid = auid;
24062406
else
24072407
audit_sig_uid = uid;
2408-
/* scaffolding */
2409-
security_current_getsecid_subj(&audit_sig_lsm.scaffold.secid);
2408+
security_current_getlsmprop_subj(&audit_sig_lsm);
24102409
}
24112410

24122411
return audit_signal_info_syscall(t);

‎kernel/auditfilter.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1371,8 +1371,7 @@ int audit_filter(int msgtype, unsigned int listtype)
13711371
case AUDIT_SUBJ_CLR:
13721372
if (f->lsm_rule) {
13731373
/* scaffolding */
1374-
security_current_getsecid_subj(
1375-
&prop.scaffold.secid);
1374+
security_current_getlsmprop_subj(&prop);
13761375
result = security_audit_rule_match(
13771376
&prop, f->type, f->op,
13781377
f->lsm_rule);

‎kernel/auditsc.c

Lines changed: 14 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -470,7 +470,6 @@ static int audit_filter_rules(struct task_struct *tsk,
470470
{
471471
const struct cred *cred;
472472
int i, need_sid = 1;
473-
u32 sid;
474473
struct lsm_prop prop = { };
475474
unsigned int sessionid;
476475

@@ -675,15 +674,14 @@ static int audit_filter_rules(struct task_struct *tsk,
675674
* fork()/copy_process() in which case
676675
* the new @tsk creds are still a dup
677676
* of @current's creds so we can still
678-
* use security_current_getsecid_subj()
677+
* use
678+
* security_current_getlsmprop_subj()
679679
* here even though it always refs
680680
* @current's creds
681681
*/
682-
security_current_getsecid_subj(&sid);
682+
security_current_getlsmprop_subj(&prop);
683683
need_sid = 0;
684684
}
685-
/* scaffolding */
686-
prop.scaffold.secid = sid;
687685
result = security_audit_rule_match(&prop,
688686
f->type,
689687
f->op,
@@ -2730,12 +2728,15 @@ int __audit_sockaddr(int len, void *a)
27302728
void __audit_ptrace(struct task_struct *t)
27312729
{
27322730
struct audit_context *context = audit_context();
2731+
struct lsm_prop prop;
27332732

27342733
context->target_pid = task_tgid_nr(t);
27352734
context->target_auid = audit_get_loginuid(t);
27362735
context->target_uid = task_uid(t);
27372736
context->target_sessionid = audit_get_sessionid(t);
2738-
security_task_getsecid_obj(t, &context->target_sid);
2737+
security_task_getlsmprop_obj(t, &prop);
2738+
/* scaffolding */
2739+
context->target_sid = prop.scaffold.secid;
27392740
memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
27402741
}
27412742

@@ -2751,6 +2752,7 @@ int audit_signal_info_syscall(struct task_struct *t)
27512752
struct audit_aux_data_pids *axp;
27522753
struct audit_context *ctx = audit_context();
27532754
kuid_t t_uid = task_uid(t);
2755+
struct lsm_prop prop;
27542756

27552757
if (!audit_signals || audit_dummy_context())
27562758
return 0;
@@ -2762,7 +2764,9 @@ int audit_signal_info_syscall(struct task_struct *t)
27622764
ctx->target_auid = audit_get_loginuid(t);
27632765
ctx->target_uid = t_uid;
27642766
ctx->target_sessionid = audit_get_sessionid(t);
2765-
security_task_getsecid_obj(t, &ctx->target_sid);
2767+
security_task_getlsmprop_obj(t, &prop);
2768+
/* scaffolding */
2769+
ctx->target_sid = prop.scaffold.secid;
27662770
memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
27672771
return 0;
27682772
}
@@ -2783,7 +2787,9 @@ int audit_signal_info_syscall(struct task_struct *t)
27832787
axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
27842788
axp->target_uid[axp->pid_count] = t_uid;
27852789
axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t);
2786-
security_task_getsecid_obj(t, &axp->target_sid[axp->pid_count]);
2790+
security_task_getlsmprop_obj(t, &prop);
2791+
/* scaffolding */
2792+
axp->target_sid[axp->pid_count] = prop.scaffold.secid;
27872793
memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
27882794
axp->pid_count++;
27892795

‎net/netlabel/netlabel_unlabeled.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1534,11 +1534,14 @@ int __init netlbl_unlabel_defconf(void)
15341534
int ret_val;
15351535
struct netlbl_dom_map *entry;
15361536
struct netlbl_audit audit_info;
1537+
struct lsm_prop prop;
15371538

15381539
/* Only the kernel is allowed to call this function and the only time
15391540
* it is called is at bootup before the audit subsystem is reporting
15401541
* messages so don't worry to much about these values. */
1541-
security_current_getsecid_subj(&audit_info.secid);
1542+
security_current_getlsmprop_subj(&prop);
1543+
/* scaffolding */
1544+
audit_info.secid = prop.scaffold.secid;
15421545
audit_info.loginuid = GLOBAL_ROOT_UID;
15431546
audit_info.sessionid = 0;
15441547

‎net/netlabel/netlabel_user.h

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,11 @@
3232
*/
3333
static inline void netlbl_netlink_auditinfo(struct netlbl_audit *audit_info)
3434
{
35-
security_current_getsecid_subj(&audit_info->secid);
35+
struct lsm_prop prop;
36+
37+
security_current_getlsmprop_subj(&prop);
38+
/* scaffolding */
39+
audit_info->secid = prop.scaffold.secid;
3640
audit_info->loginuid = audit_get_loginuid(current);
3741
audit_info->sessionid = audit_get_sessionid(current);
3842
}

‎security/apparmor/lsm.c

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -982,17 +982,24 @@ static void apparmor_bprm_committed_creds(const struct linux_binprm *bprm)
982982
return;
983983
}
984984

985-
static void apparmor_current_getsecid_subj(u32 *secid)
985+
static void apparmor_current_getlsmprop_subj(struct lsm_prop *prop)
986986
{
987987
struct aa_label *label = __begin_current_label_crit_section();
988-
*secid = label->secid;
988+
989+
prop->apparmor.label = label;
990+
/* scaffolding */
991+
prop->scaffold.secid = label->secid;
989992
__end_current_label_crit_section(label);
990993
}
991994

992-
static void apparmor_task_getsecid_obj(struct task_struct *p, u32 *secid)
995+
static void apparmor_task_getlsmprop_obj(struct task_struct *p,
996+
struct lsm_prop *prop)
993997
{
994998
struct aa_label *label = aa_get_task_label(p);
995-
*secid = label->secid;
999+
1000+
prop->apparmor.label = label;
1001+
/* scaffolding */
1002+
prop->scaffold.secid = label->secid;
9961003
aa_put_label(label);
9971004
}
9981005

@@ -1503,8 +1510,9 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = {
15031510

15041511
LSM_HOOK_INIT(task_free, apparmor_task_free),
15051512
LSM_HOOK_INIT(task_alloc, apparmor_task_alloc),
1506-
LSM_HOOK_INIT(current_getsecid_subj, apparmor_current_getsecid_subj),
1507-
LSM_HOOK_INIT(task_getsecid_obj, apparmor_task_getsecid_obj),
1513+
LSM_HOOK_INIT(current_getlsmprop_subj,
1514+
apparmor_current_getlsmprop_subj),
1515+
LSM_HOOK_INIT(task_getlsmprop_obj, apparmor_task_getlsmprop_obj),
15081516
LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
15091517
LSM_HOOK_INIT(task_kill, apparmor_task_kill),
15101518
LSM_HOOK_INIT(userns_create, apparmor_userns_create),

‎security/integrity/ima/ima.h

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -369,7 +369,7 @@ static inline void ima_process_queued_keys(void) {}
369369

370370
/* LIM API function definitions */
371371
int ima_get_action(struct mnt_idmap *idmap, struct inode *inode,
372-
const struct cred *cred, u32 secid, int mask,
372+
const struct cred *cred, struct lsm_prop *prop, int mask,
373373
enum ima_hooks func, int *pcr,
374374
struct ima_template_desc **template_desc,
375375
const char *func_data, unsigned int *allowed_algos);
@@ -400,8 +400,8 @@ const char *ima_d_path(const struct path *path, char **pathbuf, char *filename);
400400

401401
/* IMA policy related functions */
402402
int ima_match_policy(struct mnt_idmap *idmap, struct inode *inode,
403-
const struct cred *cred, u32 secid, enum ima_hooks func,
404-
int mask, int flags, int *pcr,
403+
const struct cred *cred, struct lsm_prop *prop,
404+
enum ima_hooks func, int mask, int flags, int *pcr,
405405
struct ima_template_desc **template_desc,
406406
const char *func_data, unsigned int *allowed_algos);
407407
void ima_init_policy(void);

‎security/integrity/ima/ima_api.c

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -165,7 +165,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
165165
* @idmap: idmap of the mount the inode was found from
166166
* @inode: pointer to the inode associated with the object being validated
167167
* @cred: pointer to credentials structure to validate
168-
* @secid: secid of the task being validated
168+
* @prop: properties of the task being validated
169169
* @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC,
170170
* MAY_APPEND)
171171
* @func: caller identifier
@@ -187,7 +187,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
187187
*
188188
*/
189189
int ima_get_action(struct mnt_idmap *idmap, struct inode *inode,
190-
const struct cred *cred, u32 secid, int mask,
190+
const struct cred *cred, struct lsm_prop *prop, int mask,
191191
enum ima_hooks func, int *pcr,
192192
struct ima_template_desc **template_desc,
193193
const char *func_data, unsigned int *allowed_algos)
@@ -196,7 +196,7 @@ int ima_get_action(struct mnt_idmap *idmap, struct inode *inode,
196196

197197
flags &= ima_policy_flag;
198198

199-
return ima_match_policy(idmap, inode, cred, secid, func, mask,
199+
return ima_match_policy(idmap, inode, cred, prop, func, mask,
200200
flags, pcr, template_desc, func_data,
201201
allowed_algos);
202202
}

0 commit comments

Comments
 (0)