| Message ID | 20220418145945.38797-5-casey@schaufler-ca.com (mailing list archive) |
|---|---|
| State | Changes Requested |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | [v35,01/29] integrity: disassociate ima_filter_rule from security_audit_rule | expand |
On 4/18/22 07:59, Casey Schaufler wrote: > Provide interfaces to map LSM slot numbers and LSM names. > Update the LSM registration code to save this information. > > Acked-by: Paul Moore <paul@paul-moore.com> > Reviewed-by: Kees Cook <keescook@chromium.org> > Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Reviewed-by: John Johansen <john.johansen@canonical.com> > --- > include/linux/security.h | 4 ++++ > security/security.c | 45 ++++++++++++++++++++++++++++++++++++++++ > 2 files changed, 49 insertions(+) > > diff --git a/include/linux/security.h b/include/linux/security.h > index ed51baa94a30..d00870d2b416 100644 > --- a/include/linux/security.h > +++ b/include/linux/security.h > @@ -195,6 +195,10 @@ static inline bool lsmblob_equal(const struct lsmblob *bloba, > return !memcmp(bloba, blobb, sizeof(*bloba)); > } > > +/* Map lsm names to blob slot numbers */ > +extern int lsm_name_to_slot(char *name); > +extern const char *lsm_slot_to_name(int slot); > + > /* These functions are in security/commoncap.c */ > extern int cap_capable(const struct cred *cred, struct user_namespace *ns, > int cap, unsigned int opts); > diff --git a/security/security.c b/security/security.c > index 49fa61028da2..d1ddbb857af1 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -477,6 +477,50 @@ static int lsm_append(const char *new, char **result) > * Current index to use while initializing the lsmblob secid list. > */ > static int lsm_slot __lsm_ro_after_init; > +static struct lsm_id *lsm_slotlist[LSMBLOB_ENTRIES] __lsm_ro_after_init; > + > +/** > + * lsm_name_to_slot - Report the slot number for a security module > + * @name: name of the security module > + * > + * Look up the slot number for the named security module. > + * Returns the slot number or LSMBLOB_INVALID if @name is not > + * a registered security module name. > + */ > +int lsm_name_to_slot(char *name) > +{ > + int i; > + > + for (i = 0; i < lsm_slot; i++) > + if (strcmp(lsm_slotlist[i]->lsm, name) == 0) > + return i; > + > + return LSMBLOB_INVALID; > +} > + > +/** > + * lsm_slot_to_name - Get the name of the security module in a slot > + * @slot: index into the interface LSM slot list. > + * > + * Provide the name of the security module associated with > + * a interface LSM slot. > + * > + * If @slot is LSMBLOB_INVALID return the value > + * for slot 0 if it has been set, otherwise NULL. > + * > + * Returns a pointer to the name string or NULL. > + */ > +const char *lsm_slot_to_name(int slot) > +{ > + if (slot == LSMBLOB_INVALID) > + slot = 0; > + else if (slot >= LSMBLOB_ENTRIES || slot < 0) > + return NULL; > + > + if (lsm_slotlist[slot] == NULL) > + return NULL; > + return lsm_slotlist[slot]->lsm; > +} > > /** > * security_add_hooks - Add a modules hooks to the hook lists. > @@ -498,6 +542,7 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, > if (lsmid->slot == LSMBLOB_NEEDED) { > if (lsm_slot >= LSMBLOB_ENTRIES) > panic("%s Too many LSMs registered.\n", __func__); > + lsm_slotlist[lsm_slot] = lsmid; > lsmid->slot = lsm_slot++; > init_debug("%s assigned lsmblob slot %d\n", lsmid->lsm, > lsmid->slot);
diff --git a/include/linux/security.h b/include/linux/security.h index ed51baa94a30..d00870d2b416 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -195,6 +195,10 @@ static inline bool lsmblob_equal(const struct lsmblob *bloba, return !memcmp(bloba, blobb, sizeof(*bloba)); } +/* Map lsm names to blob slot numbers */ +extern int lsm_name_to_slot(char *name); +extern const char *lsm_slot_to_name(int slot); + /* These functions are in security/commoncap.c */ extern int cap_capable(const struct cred *cred, struct user_namespace *ns, int cap, unsigned int opts); diff --git a/security/security.c b/security/security.c index 49fa61028da2..d1ddbb857af1 100644 --- a/security/security.c +++ b/security/security.c @@ -477,6 +477,50 @@ static int lsm_append(const char *new, char **result) * Current index to use while initializing the lsmblob secid list. */ static int lsm_slot __lsm_ro_after_init; +static struct lsm_id *lsm_slotlist[LSMBLOB_ENTRIES] __lsm_ro_after_init; + +/** + * lsm_name_to_slot - Report the slot number for a security module + * @name: name of the security module + * + * Look up the slot number for the named security module. + * Returns the slot number or LSMBLOB_INVALID if @name is not + * a registered security module name. + */ +int lsm_name_to_slot(char *name) +{ + int i; + + for (i = 0; i < lsm_slot; i++) + if (strcmp(lsm_slotlist[i]->lsm, name) == 0) + return i; + + return LSMBLOB_INVALID; +} + +/** + * lsm_slot_to_name - Get the name of the security module in a slot + * @slot: index into the interface LSM slot list. + * + * Provide the name of the security module associated with + * a interface LSM slot. + * + * If @slot is LSMBLOB_INVALID return the value + * for slot 0 if it has been set, otherwise NULL. + * + * Returns a pointer to the name string or NULL. + */ +const char *lsm_slot_to_name(int slot) +{ + if (slot == LSMBLOB_INVALID) + slot = 0; + else if (slot >= LSMBLOB_ENTRIES || slot < 0) + return NULL; + + if (lsm_slotlist[slot] == NULL) + return NULL; + return lsm_slotlist[slot]->lsm; +} /** * security_add_hooks - Add a modules hooks to the hook lists. @@ -498,6 +542,7 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, if (lsmid->slot == LSMBLOB_NEEDED) { if (lsm_slot >= LSMBLOB_ENTRIES) panic("%s Too many LSMs registered.\n", __func__); + lsm_slotlist[lsm_slot] = lsmid; lsmid->slot = lsm_slot++; init_debug("%s assigned lsmblob slot %d\n", lsmid->lsm, lsmid->slot);