[00/59] LSM: Module stacking for AppArmor

Message ID	20190409195924.1509-1-casey@schaufler-ca.com (mailing list archive)
Headers	show Return-Path: <selinux-owner@kernel.org> From: Casey Schaufler <casey@schaufler-ca.com> To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH 00/59] LSM: Module stacking for AppArmor Date: Tue, 9 Apr 2019 12:58:25 -0700 Message-Id: <20190409195924.1509-1-casey@schaufler-ca.com> Sender: selinux-owner@vger.kernel.org Precedence: bulk
Series	LSM: Module stacking for AppArmor \| expand [00/59] LSM: Module stacking for AppArmor [01/59] LSM: Infrastructure management of the superblock [02/59] LSM: Infrastructure management of the sock security [03/59] LSM: Infrastructure management of the key security blob [04/59] LSM: Create an lsm_export data structure. [05/59] LSM: Use lsm_export in the inode_getsecid hooks [06/59] LSM: Use lsm_export in the cred_getsecid hooks [07/59] LSM: Use lsm_export in the ipc_getsecid and task_getsecid hooks [08/59] LSM: Use lsm_export in the kernel_ask_as hooks [09/59] LSM: Use lsm_export in the getpeersec_dgram hooks [10/59] LSM: Use lsm_export in the audit_rule_match hooks [11/59] LSM: Fix logical operation in lsm_export checks [12/59] LSM: Use lsm_export in the secid_to_secctx hooks [13/59] LSM: Use lsm_export in the secctx_to_secid hooks [14/59] LSM: Use lsm_export in security_audit_rule_match [15/59] LSM: Use lsm_export in security_kernel_act_as [16/59] LSM: Use lsm_export in security_socket_getpeersec_dgram [17/59] LSM: Use lsm_export in security_secctx_to_secid [18/59] LSM: Use lsm_export in security_secid_to_secctx [19/59] LSM: Use lsm_export in security_ipc_getsecid [20/59] LSM: Use lsm_export in security_task_getsecid [21/59] LSM: Use lsm_export in security_inode_getsecid [22/59] LSM: Use lsm_export in security_cred_getsecid [23/59] Audit: Change audit_sig_sid to audit_sig_lsm [24/59] Audit: Convert target_sid to an lsm_export structure [25/59] Audit: Convert osid to an lsm_export structure [26/59] IMA: Clean out lsm_export scaffolding [27/59] NET: Store LSM access information in the socket blob for UDS [28/59] NET: Remove scaffolding on secmarks [29/59] NET: Remove scaffolding on new secmarks [30/59] NET: Remove netfilter scaffolding for lsm_export [31/59] Netlabel: Replace secids with lsm_export [32/59] LSM: Remove lsm_export scaffolding functions [33/59] IMA: FIXUP prototype using lsm_export [34/59] Smack: Restore the release_secctx hook [35/59] AppArmor: Remove unnecessary hook stub [36/59] LSM: Limit calls to certain module hooks [37/59] LSM: Create a data structure for a security context [38/59] LSM: Use lsm_context in secid_to_secctx hooks [39/59] LSM: Use lsm_context in secctx_to_secid hooks [40/59] LSM: Use lsm_context in inode_getsecctx hooks

Message ID

20190409195924.1509-1-casey@schaufler-ca.com (mailing list archive)

Headers

From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, jmorris@namei.org,
        linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: casey@schaufler-ca.com, keescook@chromium.org,
        john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp,
        paul@paul-moore.com, sds@tycho.nsa.gov
Subject: [PATCH 00/59] LSM: Module stacking for AppArmor
Date: Tue,  9 Apr 2019 12:58:25 -0700
Message-Id: <20190409195924.1509-1-casey@schaufler-ca.com>
Sender: selinux-owner@vger.kernel.org
Precedence: bulk

Series

LSM: Module stacking for AppArmor | expand

Message

Casey Schaufler April 9, 2019, 7:58 p.m. UTC

This patchset provides the changes required for
the AppArmor security module to stack safely with
"exclusive" security modules, those being SELinux and
Smack. 

Performance: Using a kernel compile benchmark indicates
a performance impact of 0.15% for a Fedora 29 system
with SELinux. Adding AppArmor has an additional 0.20%
impact. Fedora does not include an AppArmor profile.

A new process attribute identifies which security module
information should be reported by SO_PEERSEC and the
/proc/.../attr/current interface. This is provided by
/proc/.../attr/display. Writing the name of the security
module desired to this interface will set which LSM hooks
will be called for this information. The first security
module providing the hooks will be used by default.

The use of integer based security tokens (secids) is
generally (but not completely) replaced by a structure
lsm_export. The lsm_export structure can contain information
for each of the security modules that export information
outside the LSM layer.

The LSM interfaces that provide "secctx" text strings
have been changed to use a structure "lsm_context"
instead of a pointer/length pair. In some cases the
interfaces used a "char *" pointer and in others a
"void *". This was necessary to ensure that the correct
release mechanism for the text is used. It also makes
many of the interfaces cleaner.

The security module stacking issues around netlabel
not addressed here as they are beyond what is required 
to stack AppArmor with either SELinux or Smack.

git://github.com/cschaufler/lsm-stacking.git#stack-5.1-rc2-apparmor

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
 drivers/android/binder.c                |  25 ++-
 fs/kernfs/dir.c                         |   6 +-
 fs/kernfs/inode.c                       |  31 ++-
 fs/kernfs/kernfs-internal.h             |   3 +-
 fs/nfs/inode.c                          |  13 +-
 fs/nfs/internal.h                       |   8 +-
 fs/nfs/nfs4proc.c                       |  17 +-
 fs/nfs/nfs4xdr.c                        |  16 +-
 fs/nfsd/nfs4proc.c                      |   8 +-
 fs/nfsd/nfs4xdr.c                       |  14 +-
 fs/nfsd/vfs.c                           |   7 +-
 fs/proc/base.c                          |   1 +
 include/linux/cred.h                    |   3 +-
 include/linux/lsm_hooks.h               |  93 ++++----
 include/linux/nfs4.h                    |   8 +-
 include/linux/security.h                | 137 ++++++++----
 include/net/netlabel.h                  |  10 +-
 include/net/scm.h                       |  14 +-
 kernel/audit.c                          |  43 ++--
 kernel/audit.h                          |   9 +-
 kernel/auditfilter.c                    |   6 +-
 kernel/auditsc.c                        |  77 ++++---
 kernel/cred.c                           |  15 +-
 net/ipv4/cipso_ipv4.c                   |  13 +-
 net/ipv4/ip_sockglue.c                  |  12 +-
 net/netfilter/nf_conntrack_netlink.c    |  29 ++-
 net/netfilter/nf_conntrack_standalone.c |  16 +-
 net/netfilter/nfnetlink_queue.c         |  38 ++--
 net/netfilter/nft_meta.c                |  13 +-
 net/netfilter/xt_SECMARK.c              |  14 +-
 net/netlabel/netlabel_kapi.c            |   5 +-
 net/netlabel/netlabel_unlabeled.c       | 101 +++++----
 net/netlabel/netlabel_unlabeled.h       |   2 +-
 net/netlabel/netlabel_user.c            |  13 +-
 net/netlabel/netlabel_user.h            |   2 +-
 net/unix/af_unix.c                      |  11 +-
 security/apparmor/audit.c               |   4 +-
 security/apparmor/include/audit.h       |   2 +-
 security/apparmor/include/net.h         |   6 +-
 security/apparmor/include/secid.h       |   9 +-
 security/apparmor/lsm.c                 |  64 ++----
 security/apparmor/secid.c               |  42 ++--
 security/integrity/ima/ima.h            |  14 +-
 security/integrity/ima/ima_api.c        |   9 +-
 security/integrity/ima/ima_appraise.c   |   6 +-
 security/integrity/ima/ima_main.c       |  34 +--
 security/integrity/ima/ima_policy.c     |  19 +-
 security/security.c                     | 366 ++++++++++++++++++++++++++++----
 security/selinux/hooks.c                | 259 +++++++++++-----------
 security/selinux/include/audit.h        |   5 +-
 security/selinux/include/objsec.h       |  42 +++-
 security/selinux/netlabel.c             |  25 +--
 security/selinux/ss/services.c          |  18 +-
 security/smack/smack.h                  |  18 ++
 security/smack/smack_lsm.c              | 238 +++++++++++----------
 security/smack/smack_netfilter.c        |   8 +-
 security/smack/smackfs.c                |  12 +-
 57 files changed, 1252 insertions(+), 781 deletions(-)