From patchwork Thu Jun 15 16:42:55 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Salvatore Mesoraca X-Patchwork-Id: 9789347 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 4F2DA60384 for ; Thu, 15 Jun 2017 16:45:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4205D284F5 for ; Thu, 15 Jun 2017 16:45:41 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 36DA92853A; Thu, 15 Jun 2017 16:45:41 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.1 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, GAPPY_SUBJECT, RCVD_IN_DNSWL_MED, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from mother.openwall.net (mother.openwall.net [195.42.179.200]) by mail.wl.linuxfoundation.org (Postfix) with SMTP id 5E11D284F5 for ; Thu, 15 Jun 2017 16:45:40 +0000 (UTC) Received: (qmail 27919 invoked by uid 550); 15 Jun 2017 16:45:03 -0000 Mailing-List: contact kernel-hardening-help@lists.openwall.com; run by ezmlm Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-ID: Delivered-To: mailing list kernel-hardening@lists.openwall.com Received: (qmail 26084 invoked from network); 15 Jun 2017 16:44:52 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=g1DNW0wJjTt8XnMubKnq0c3tAWvVVYq4tamdNgt1AbU=; b=UCg6gqCTyi+xcx9VhhBv5iETdJMVoFOmzoIifJzlygurqxvFnjekP8+5n76asjy28V /KK09ye/FXTa1nZU9hBIClUmGIAybJ7Z1bSHY0jlkQSQ3oYZkWjlzspotItFoh0w2oOC dZBN7htaLM01tdhdLZP422HlRGoEnuINtZpd6AGd3o3en2YK6efzzvTegZwrgSjjsIjt Lg0Fds+UzKn3KL6OkDXM93CAaCj0IIMhVp1Mz82YiMHwdlT2PuluNO/4o3LyeRQASTZS 7nnrv5ShO8LvRetpykNh3dQkRPS6Vh+uyztWXEoq2l65fp9As2WNuXbskTrjvXg5SkXM ExFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=g1DNW0wJjTt8XnMubKnq0c3tAWvVVYq4tamdNgt1AbU=; b=NQ9gm+e444JxvNeEl5fzFZHp7MnnBBVSeLK3QlT+GvQF4DTY9utUpQlx6L0MytwECJ twXelLuwoXaO3QEQkzYQxnsgnW5leURgc1j3qNGKldvihv2rPGLgUFnsVT9ZNun441Vo wGspdTebEEoAopOJnO3DEglfpPmQGPZAkgPy6ZWNby6rmanKjzLTE8YRW0tIcEYziq+N ZpFcBtif3IN8HaIynVw6fVV6JKy/q3KE9irRfctw8L9tfaduOBWPpYghd/d9s0JgKdl+ Mqwbo0bfNJf1p5LLwzUXZnoQd/Jnuvc/KJKwoyz69hvB9dx+2rjJQ6g36Cjh7jQuFCvX DE5Q== X-Gm-Message-State: AKS2vOwHcfierUzMMGh8DOByr7M1Sti8laNMmcTWFUe/EoSAHhuNZX1d Il/iJ/um/tiDAA== X-Received: by 10.28.1.85 with SMTP id 82mr4235485wmb.88.1497545081037; Thu, 15 Jun 2017 09:44:41 -0700 (PDT) From: Salvatore Mesoraca To: linux-kernel@vger.kernel.org Cc: linux-security-module@vger.kernel.org, kernel-hardening@lists.openwall.com, Salvatore Mesoraca , Brad Spengler , PaX Team , Casey Schaufler , Kees Cook , James Morris , "Serge E. Hallyn" , linux-mm@kvack.org, x86@kernel.org, Jann Horn , Christoph Hellwig , Thomas Gleixner Date: Thu, 15 Jun 2017 18:42:55 +0200 Message-Id: <1497544976-7856-9-git-send-email-s.mesoraca16@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1497544976-7856-1-git-send-email-s.mesoraca16@gmail.com> References: <1497544976-7856-1-git-send-email-s.mesoraca16@gmail.com> Subject: [kernel-hardening] [RFC v2 8/9] Allowing for stacking procattr support in S.A.R.A. X-Virus-Scanned: ClamAV using ClamSMTP This allow S.A.R.A. to use the procattr interface without interfering with other LSMs. This part should be reimplemented as soon as upstream procattr stacking support is available. Signed-off-by: Salvatore Mesoraca --- fs/proc/base.c | 38 ++++++++++++++++++++++++++++++++++++++ security/security.c | 20 ++++++++++++++++++-- 2 files changed, 56 insertions(+), 2 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index f1e1927..6d0fd1c 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2515,6 +2515,40 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, .llseek = generic_file_llseek, }; +#ifdef CONFIG_SECURITY_SARA +static const struct pid_entry sara_attr_dir_stuff[] = { + REG("wxprot", 0666, proc_pid_attr_operations), +}; + +static int proc_sara_attr_dir_readdir(struct file *file, + struct dir_context *ctx) +{ + return proc_pident_readdir(file, ctx, + sara_attr_dir_stuff, + ARRAY_SIZE(sara_attr_dir_stuff)); +} + +static const struct file_operations proc_sara_attr_dir_ops = { + .read = generic_read_dir, + .iterate_shared = proc_sara_attr_dir_readdir, + .llseek = generic_file_llseek, +}; + +static struct dentry *proc_sara_attr_dir_lookup(struct inode *dir, + struct dentry *dentry, unsigned int flags) +{ + return proc_pident_lookup(dir, dentry, + sara_attr_dir_stuff, + ARRAY_SIZE(sara_attr_dir_stuff)); +}; + +static const struct inode_operations proc_sara_attr_dir_inode_ops = { + .lookup = proc_sara_attr_dir_lookup, + .getattr = pid_getattr, + .setattr = proc_setattr, +}; +#endif /* CONFIG_SECURITY_SARA */ + static const struct pid_entry attr_dir_stuff[] = { REG("current", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("prev", S_IRUGO, proc_pid_attr_operations), @@ -2522,6 +2556,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, REG("fscreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("keycreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("sockcreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), +#ifdef CONFIG_SECURITY_SARA + DIR("sara", 0555, proc_sara_attr_dir_inode_ops, + proc_sara_attr_dir_ops), +#endif }; static int proc_attr_dir_readdir(struct file *file, struct dir_context *ctx) diff --git a/security/security.c b/security/security.c index f7df697..c6c78dd 100644 --- a/security/security.c +++ b/security/security.c @@ -1239,12 +1239,28 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode) int security_getprocattr(struct task_struct *p, char *name, char **value) { - return call_int_hook(getprocattr, -EINVAL, p, name, value); + struct security_hook_list *hp; + int rc; + + list_for_each_entry(hp, &security_hook_heads.getprocattr, list) { + rc = hp->hook.getprocattr(p, name, value); + if (rc != -EINVAL) + return rc; + } + return -EINVAL; } int security_setprocattr(const char *name, void *value, size_t size) { - return call_int_hook(setprocattr, -EINVAL, name, value, size); + struct security_hook_list *hp; + int rc; + + list_for_each_entry(hp, &security_hook_heads.setprocattr, list) { + rc = hp->hook.setprocattr(name, value, size); + if (rc != -EINVAL) + return rc; + } + return -EINVAL; } int security_netlink_send(struct sock *sk, struct sk_buff *skb)