| Message ID | 20241009173222.12219-2-casey@schaufler-ca.com (mailing list archive) |
|---|---|
| State | Accepted |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | LSM: Move away from secids | expand |
On Oct 9, 2024 Casey Schaufler <casey@schaufler-ca.com> wrote: > > When more than one security module is exporting data to audit and > networking sub-systems a single 32 bit integer is no longer > sufficient to represent the data. Add a structure to be used instead. > > The lsm_prop structure definition is intended to keep the LSM > specific information private to the individual security modules. > The module specific information is included in a new set of > header files under include/lsm. Each security module is allowed > to define the information included for its use in the lsm_prop. > SELinux includes a u32 secid. Smack includes a pointer into its > global label list. The conditional compilation based on feature > inclusion is contained in the include/lsm files. > > Suggested-by: Paul Moore <paul@paul-moore.com> > Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> > Cc: apparmor@lists.ubuntu.com > Cc: bpf@vger.kernel.org > Cc: selinux@vger.kernel.org > Cc: linux-security-module@vger.kernel.org > --- > include/linux/lsm/apparmor.h | 17 +++++++++++++++++ > include/linux/lsm/bpf.h | 16 ++++++++++++++++ > include/linux/lsm/selinux.h | 16 ++++++++++++++++ > include/linux/lsm/smack.h | 17 +++++++++++++++++ > include/linux/security.h | 20 ++++++++++++++++++++ > 5 files changed, 86 insertions(+) > create mode 100644 include/linux/lsm/apparmor.h > create mode 100644 include/linux/lsm/bpf.h > create mode 100644 include/linux/lsm/selinux.h > create mode 100644 include/linux/lsm/smack.h Looks good to me, thanks for the lsm_prop rename. As a FYI, I did add a line to the MAINTAINERS entry for include/linux/lsm/. -- paul-moore.com
On 10/9/24 10:32, Casey Schaufler wrote: > When more than one security module is exporting data to audit and > networking sub-systems a single 32 bit integer is no longer > sufficient to represent the data. Add a structure to be used instead. > > The lsm_prop structure definition is intended to keep the LSM > specific information private to the individual security modules. > The module specific information is included in a new set of > header files under include/lsm. Each security module is allowed > to define the information included for its use in the lsm_prop. > SELinux includes a u32 secid. Smack includes a pointer into its > global label list. The conditional compilation based on feature > inclusion is contained in the include/lsm files. > > Suggested-by: Paul Moore <paul@paul-moore.com> > Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Acked-by: John Johansen <john.johansen@canonical.com> > Cc: apparmor@lists.ubuntu.com > Cc: bpf@vger.kernel.org > Cc: selinux@vger.kernel.org > Cc: linux-security-module@vger.kernel.org > --- > include/linux/lsm/apparmor.h | 17 +++++++++++++++++ > include/linux/lsm/bpf.h | 16 ++++++++++++++++ > include/linux/lsm/selinux.h | 16 ++++++++++++++++ > include/linux/lsm/smack.h | 17 +++++++++++++++++ > include/linux/security.h | 20 ++++++++++++++++++++ > 5 files changed, 86 insertions(+) > create mode 100644 include/linux/lsm/apparmor.h > create mode 100644 include/linux/lsm/bpf.h > create mode 100644 include/linux/lsm/selinux.h > create mode 100644 include/linux/lsm/smack.h > > diff --git a/include/linux/lsm/apparmor.h b/include/linux/lsm/apparmor.h > new file mode 100644 > index 000000000000..612cbfacb072 > --- /dev/null > +++ b/include/linux/lsm/apparmor.h > @@ -0,0 +1,17 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > +/* > + * Linux Security Module interface to other subsystems. > + * AppArmor presents single pointer to an aa_label structure. > + */ > +#ifndef __LINUX_LSM_APPARMOR_H > +#define __LINUX_LSM_APPARMOR_H > + > +struct aa_label; > + > +struct lsm_prop_apparmor { > +#ifdef CONFIG_SECURITY_APPARMOR > + struct aa_label *label; > +#endif > +}; > + > +#endif /* ! __LINUX_LSM_APPARMOR_H */ > diff --git a/include/linux/lsm/bpf.h b/include/linux/lsm/bpf.h > new file mode 100644 > index 000000000000..8106e206fcef > --- /dev/null > +++ b/include/linux/lsm/bpf.h > @@ -0,0 +1,16 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > +/* > + * Linux Security Module interface to other subsystems. > + * BPF may present a single u32 value. > + */ > +#ifndef __LINUX_LSM_BPF_H > +#define __LINUX_LSM_BPF_H > +#include <linux/types.h> > + > +struct lsm_prop_bpf { > +#ifdef CONFIG_BPF_LSM > + u32 secid; > +#endif > +}; > + > +#endif /* ! __LINUX_LSM_BPF_H */ > diff --git a/include/linux/lsm/selinux.h b/include/linux/lsm/selinux.h > new file mode 100644 > index 000000000000..9455a6b5b910 > --- /dev/null > +++ b/include/linux/lsm/selinux.h > @@ -0,0 +1,16 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > +/* > + * Linux Security Module interface to other subsystems. > + * SELinux presents a single u32 value which is known as a secid. > + */ > +#ifndef __LINUX_LSM_SELINUX_H > +#define __LINUX_LSM_SELINUX_H > +#include <linux/types.h> > + > +struct lsm_prop_selinux { > +#ifdef CONFIG_SECURITY_SELINUX > + u32 secid; > +#endif > +}; > + > +#endif /* ! __LINUX_LSM_SELINUX_H */ > diff --git a/include/linux/lsm/smack.h b/include/linux/lsm/smack.h > new file mode 100644 > index 000000000000..ff730dd7a734 > --- /dev/null > +++ b/include/linux/lsm/smack.h > @@ -0,0 +1,17 @@ > +/* SPDX-License-Identifier: GPL-2.0 */ > +/* > + * Linux Security Module interface to other subsystems. > + * Smack presents a pointer into the global Smack label list. > + */ > +#ifndef __LINUX_LSM_SMACK_H > +#define __LINUX_LSM_SMACK_H > + > +struct smack_known; > + > +struct lsm_prop_smack { > +#ifdef CONFIG_SECURITY_SMACK > + struct smack_known *skp; > +#endif > +}; > + > +#endif /* ! __LINUX_LSM_SMACK_H */ > diff --git a/include/linux/security.h b/include/linux/security.h > index b86ec2afc691..555249a8d121 100644 > --- a/include/linux/security.h > +++ b/include/linux/security.h > @@ -34,6 +34,10 @@ > #include <linux/sockptr.h> > #include <linux/bpf.h> > #include <uapi/linux/lsm.h> > +#include <linux/lsm/selinux.h> > +#include <linux/lsm/smack.h> > +#include <linux/lsm/apparmor.h> > +#include <linux/lsm/bpf.h> > > struct linux_binprm; > struct cred; > @@ -152,6 +156,22 @@ enum lockdown_reason { > LOCKDOWN_CONFIDENTIALITY_MAX, > }; > > +/* scaffolding */ > +struct lsm_prop_scaffold { > + u32 secid; > +}; > + > +/* > + * Data exported by the security modules > + */ > +struct lsm_prop { > + struct lsm_prop_selinux selinux; > + struct lsm_prop_smack smack; > + struct lsm_prop_apparmor apparmor; > + struct lsm_prop_bpf bpf; > + struct lsm_prop_scaffold scaffold; > +}; > + > extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1]; > extern u32 lsm_active_cnt; > extern const struct lsm_id *lsm_idlist[];
On 10/10/2024 8:08 PM, Paul Moore wrote: > On Oct 9, 2024 Casey Schaufler <casey@schaufler-ca.com> wrote: >> When more than one security module is exporting data to audit and >> networking sub-systems a single 32 bit integer is no longer >> sufficient to represent the data. Add a structure to be used instead. >> >> The lsm_prop structure definition is intended to keep the LSM >> specific information private to the individual security modules. >> The module specific information is included in a new set of >> header files under include/lsm. Each security module is allowed >> to define the information included for its use in the lsm_prop. >> SELinux includes a u32 secid. Smack includes a pointer into its >> global label list. The conditional compilation based on feature >> inclusion is contained in the include/lsm files. >> >> Suggested-by: Paul Moore <paul@paul-moore.com> >> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> >> Cc: apparmor@lists.ubuntu.com >> Cc: bpf@vger.kernel.org >> Cc: selinux@vger.kernel.org >> Cc: linux-security-module@vger.kernel.org >> --- >> include/linux/lsm/apparmor.h | 17 +++++++++++++++++ >> include/linux/lsm/bpf.h | 16 ++++++++++++++++ >> include/linux/lsm/selinux.h | 16 ++++++++++++++++ >> include/linux/lsm/smack.h | 17 +++++++++++++++++ >> include/linux/security.h | 20 ++++++++++++++++++++ >> 5 files changed, 86 insertions(+) >> create mode 100644 include/linux/lsm/apparmor.h >> create mode 100644 include/linux/lsm/bpf.h >> create mode 100644 include/linux/lsm/selinux.h >> create mode 100644 include/linux/lsm/smack.h > Looks good to me, thanks for the lsm_prop rename. As a FYI, I did add > a line to the MAINTAINERS entry for include/linux/lsm/. Thank you. > > -- > paul-moore.com
diff --git a/include/linux/lsm/apparmor.h b/include/linux/lsm/apparmor.h new file mode 100644 index 000000000000..612cbfacb072 --- /dev/null +++ b/include/linux/lsm/apparmor.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Linux Security Module interface to other subsystems. + * AppArmor presents single pointer to an aa_label structure. + */ +#ifndef __LINUX_LSM_APPARMOR_H +#define __LINUX_LSM_APPARMOR_H + +struct aa_label; + +struct lsm_prop_apparmor { +#ifdef CONFIG_SECURITY_APPARMOR + struct aa_label *label; +#endif +}; + +#endif /* ! __LINUX_LSM_APPARMOR_H */ diff --git a/include/linux/lsm/bpf.h b/include/linux/lsm/bpf.h new file mode 100644 index 000000000000..8106e206fcef --- /dev/null +++ b/include/linux/lsm/bpf.h @@ -0,0 +1,16 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Linux Security Module interface to other subsystems. + * BPF may present a single u32 value. + */ +#ifndef __LINUX_LSM_BPF_H +#define __LINUX_LSM_BPF_H +#include <linux/types.h> + +struct lsm_prop_bpf { +#ifdef CONFIG_BPF_LSM + u32 secid; +#endif +}; + +#endif /* ! __LINUX_LSM_BPF_H */ diff --git a/include/linux/lsm/selinux.h b/include/linux/lsm/selinux.h new file mode 100644 index 000000000000..9455a6b5b910 --- /dev/null +++ b/include/linux/lsm/selinux.h @@ -0,0 +1,16 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Linux Security Module interface to other subsystems. + * SELinux presents a single u32 value which is known as a secid. + */ +#ifndef __LINUX_LSM_SELINUX_H +#define __LINUX_LSM_SELINUX_H +#include <linux/types.h> + +struct lsm_prop_selinux { +#ifdef CONFIG_SECURITY_SELINUX + u32 secid; +#endif +}; + +#endif /* ! __LINUX_LSM_SELINUX_H */ diff --git a/include/linux/lsm/smack.h b/include/linux/lsm/smack.h new file mode 100644 index 000000000000..ff730dd7a734 --- /dev/null +++ b/include/linux/lsm/smack.h @@ -0,0 +1,17 @@ +/* SPDX-License-Identifier: GPL-2.0 */ +/* + * Linux Security Module interface to other subsystems. + * Smack presents a pointer into the global Smack label list. + */ +#ifndef __LINUX_LSM_SMACK_H +#define __LINUX_LSM_SMACK_H + +struct smack_known; + +struct lsm_prop_smack { +#ifdef CONFIG_SECURITY_SMACK + struct smack_known *skp; +#endif +}; + +#endif /* ! __LINUX_LSM_SMACK_H */ diff --git a/include/linux/security.h b/include/linux/security.h index b86ec2afc691..555249a8d121 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -34,6 +34,10 @@ #include <linux/sockptr.h> #include <linux/bpf.h> #include <uapi/linux/lsm.h> +#include <linux/lsm/selinux.h> +#include <linux/lsm/smack.h> +#include <linux/lsm/apparmor.h> +#include <linux/lsm/bpf.h> struct linux_binprm; struct cred; @@ -152,6 +156,22 @@ enum lockdown_reason { LOCKDOWN_CONFIDENTIALITY_MAX, }; +/* scaffolding */ +struct lsm_prop_scaffold { + u32 secid; +}; + +/* + * Data exported by the security modules + */ +struct lsm_prop { + struct lsm_prop_selinux selinux; + struct lsm_prop_smack smack; + struct lsm_prop_apparmor apparmor; + struct lsm_prop_bpf bpf; + struct lsm_prop_scaffold scaffold; +}; + extern const char *const lockdown_reasons[LOCKDOWN_CONFIDENTIALITY_MAX+1]; extern u32 lsm_active_cnt; extern const struct lsm_id *lsm_idlist[];
When more than one security module is exporting data to audit and networking sub-systems a single 32 bit integer is no longer sufficient to represent the data. Add a structure to be used instead. The lsm_prop structure definition is intended to keep the LSM specific information private to the individual security modules. The module specific information is included in a new set of header files under include/lsm. Each security module is allowed to define the information included for its use in the lsm_prop. SELinux includes a u32 secid. Smack includes a pointer into its global label list. The conditional compilation based on feature inclusion is contained in the include/lsm files. Suggested-by: Paul Moore <paul@paul-moore.com> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> Cc: apparmor@lists.ubuntu.com Cc: bpf@vger.kernel.org Cc: selinux@vger.kernel.org Cc: linux-security-module@vger.kernel.org --- include/linux/lsm/apparmor.h | 17 +++++++++++++++++ include/linux/lsm/bpf.h | 16 ++++++++++++++++ include/linux/lsm/selinux.h | 16 ++++++++++++++++ include/linux/lsm/smack.h | 17 +++++++++++++++++ include/linux/security.h | 20 ++++++++++++++++++++ 5 files changed, 86 insertions(+) create mode 100644 include/linux/lsm/apparmor.h create mode 100644 include/linux/lsm/bpf.h create mode 100644 include/linux/lsm/selinux.h create mode 100644 include/linux/lsm/smack.h