From patchwork Mon Jun 12 16:56:59 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Salvatore Mesoraca X-Patchwork-Id: 9782327 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 62FEC60244 for ; Mon, 12 Jun 2017 16:59:15 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 531B0284C7 for ; Mon, 12 Jun 2017 16:59:15 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 47CBA284DA; Mon, 12 Jun 2017 16:59:15 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, GAPPY_SUBJECT, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 68D2F284C7 for ; Mon, 12 Jun 2017 16:59:14 +0000 (UTC) Received: (qmail 10192 invoked by uid 550); 12 Jun 2017 16:58:50 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 9768 invoked from network); 12 Jun 2017 16:58:45 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=gfkG2jXZejZRkfh6STqPQX5H2iR6BsPZDwALrUxA7tA=; b=nRW9l/c3894clm9txnh8jepiLXfZynn4Z3bK9tX1XUYYlYnnve3OKkUdjAS8AsPTzy Cbwe3Fv4IjVzhBlivQqiHdo1VqLvEIukLa+CYTihsWJSI4t7zHrOhdibMmlW/r1QrdTZ abS3oi/3itYu6Pozm2eKQdJOmHUelRn+pRgYx6VSzMxNLN5hw23+C+y8iBzggUy4CB6j Kd7dzZ5pDRlxsZWMacXzBD9JW56YdZs3nmJe3IGRLmK2Nd1R7RJU+kSHcv7yBcQi4bK2 Jk7oXbYkHU26hvlsEMzMgPwm5rUY+MJ3iSQ9jiNAtPraSYVLirX6IG+kgwf4luIXHRel Q8kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=gfkG2jXZejZRkfh6STqPQX5H2iR6BsPZDwALrUxA7tA=; b=DA6rfWkkTJQcjgs0xTSLrbKnjM/ZTrsKAj57rQSiYemNvcOoQEpcZnVq+Fg4Ab8Nvh yUC6Zi1PmO6A1VtjykU6Ov4Vkra7EypMsIi9T/EXOF11bIipTRVNih34pwyyVh6TZEHS C1lzoK3VzqW225GFb8fAHcE5WkDgLEIGVyYDMoCPNqys2avBrDMDa8T/kalNvQ7YZ/C6 U3E9LjleHzBX6+8vtcBkbYrAvqjcx8FyxPU9RGCgUrkn/N6Ips8YMyP0mikkK0go10vu oYq197FSPk9uKcDuhpUuSMjs3Dpj037T9ARd/zDnKTNXvQmjA/0NwmqUDPV2aXh/VrDz fQMA== X-Gm-Message-State: AODbwcDGPNNX+QEJXzyKdQ1FlPBvfaH4OoH2VTyxB0oQptx+vU3kiTdI Wv7tSy3qAyjPDQ== X-Received: by 10.28.71.91 with SMTP id u88mr8670337wma.9.1497286713868; Mon, 12 Jun 2017 09:58:33 -0700 (PDT) From: Salvatore Mesoraca To: linux-kernel@vger.kernel.org Cc: linux-security-module@vger.kernel.org, kernel-hardening@lists.openwall.com, Salvatore Mesoraca , Brad Spengler , PaX Team , Casey Schaufler , Kees Cook , James Morris , "Serge E. Hallyn" Date: Mon, 12 Jun 2017 18:56:59 +0200 Message-Id: <1497286620-15027-11-git-send-email-s.mesoraca16@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1497286620-15027-1-git-send-email-s.mesoraca16@gmail.com> References: <1497286620-15027-1-git-send-email-s.mesoraca16@gmail.com> Subject: [kernel-hardening] [PATCH 10/11] Allowing for stacking procattr support in S.A.R.A. X-Virus-Scanned: ClamAV using ClamSMTP This allow S.A.R.A. to use the procattr interface without interfering with other LSMs. This part should be reimplemented as soon as upstream procattr stacking support is available. Signed-off-by: Salvatore Mesoraca --- fs/proc/base.c | 38 ++++++++++++++++++++++++++++++++++++++ security/security.c | 20 ++++++++++++++++++-- 2 files changed, 56 insertions(+), 2 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index f1e1927..6d0fd1c 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2515,6 +2515,40 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, .llseek = generic_file_llseek, }; +#ifdef CONFIG_SECURITY_SARA +static const struct pid_entry sara_attr_dir_stuff[] = { + REG("wxprot", 0666, proc_pid_attr_operations), +}; + +static int proc_sara_attr_dir_readdir(struct file *file, + struct dir_context *ctx) +{ + return proc_pident_readdir(file, ctx, + sara_attr_dir_stuff, + ARRAY_SIZE(sara_attr_dir_stuff)); +} + +static const struct file_operations proc_sara_attr_dir_ops = { + .read = generic_read_dir, + .iterate_shared = proc_sara_attr_dir_readdir, + .llseek = generic_file_llseek, +}; + +static struct dentry *proc_sara_attr_dir_lookup(struct inode *dir, + struct dentry *dentry, unsigned int flags) +{ + return proc_pident_lookup(dir, dentry, + sara_attr_dir_stuff, + ARRAY_SIZE(sara_attr_dir_stuff)); +}; + +static const struct inode_operations proc_sara_attr_dir_inode_ops = { + .lookup = proc_sara_attr_dir_lookup, + .getattr = pid_getattr, + .setattr = proc_setattr, +}; +#endif /* CONFIG_SECURITY_SARA */ + static const struct pid_entry attr_dir_stuff[] = { REG("current", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("prev", S_IRUGO, proc_pid_attr_operations), @@ -2522,6 +2556,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, REG("fscreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("keycreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("sockcreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), +#ifdef CONFIG_SECURITY_SARA + DIR("sara", 0555, proc_sara_attr_dir_inode_ops, + proc_sara_attr_dir_ops), +#endif }; static int proc_attr_dir_readdir(struct file *file, struct dir_context *ctx) diff --git a/security/security.c b/security/security.c index cf15686..6ca93c6 100644 --- a/security/security.c +++ b/security/security.c @@ -1244,12 +1244,28 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode) int security_getprocattr(struct task_struct *p, char *name, char **value) { - return call_int_hook(getprocattr, -EINVAL, p, name, value); + struct security_hook_list *hp; + int rc; + + list_for_each_entry(hp, &security_hook_heads.getprocattr, list) { + rc = hp->hook.getprocattr(p, name, value); + if (rc != -EINVAL) + return rc; + } + return -EINVAL; } int security_setprocattr(const char *name, void *value, size_t size) { - return call_int_hook(setprocattr, -EINVAL, name, value, size); + struct security_hook_list *hp; + int rc; + + list_for_each_entry(hp, &security_hook_heads.setprocattr, list) { + rc = hp->hook.setprocattr(name, value, size); + if (rc != -EINVAL) + return rc; + } + return -EINVAL; } int security_netlink_send(struct sock *sk, struct sk_buff *skb)