From patchwork Mon Jun 12 16:56:59 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Salvatore Mesoraca X-Patchwork-Id: 9782335 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id D512360244 for ; Mon, 12 Jun 2017 16:59:33 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id C4CA6284C7 for ; Mon, 12 Jun 2017 16:59:33 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id B9B13284DA; Mon, 12 Jun 2017 16:59:33 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, GAPPY_SUBJECT, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 58F94284C7 for ; Mon, 12 Jun 2017 16:59:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754089AbdFLQ7c (ORCPT ); Mon, 12 Jun 2017 12:59:32 -0400 Received: from mail-wr0-f196.google.com ([209.85.128.196]:34534 "EHLO mail-wr0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753764AbdFLQ6f (ORCPT ); Mon, 12 Jun 2017 12:58:35 -0400 Received: by mail-wr0-f196.google.com with SMTP id u101so23337462wrc.1; Mon, 12 Jun 2017 09:58:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=gfkG2jXZejZRkfh6STqPQX5H2iR6BsPZDwALrUxA7tA=; b=nRW9l/c3894clm9txnh8jepiLXfZynn4Z3bK9tX1XUYYlYnnve3OKkUdjAS8AsPTzy Cbwe3Fv4IjVzhBlivQqiHdo1VqLvEIukLa+CYTihsWJSI4t7zHrOhdibMmlW/r1QrdTZ abS3oi/3itYu6Pozm2eKQdJOmHUelRn+pRgYx6VSzMxNLN5hw23+C+y8iBzggUy4CB6j Kd7dzZ5pDRlxsZWMacXzBD9JW56YdZs3nmJe3IGRLmK2Nd1R7RJU+kSHcv7yBcQi4bK2 Jk7oXbYkHU26hvlsEMzMgPwm5rUY+MJ3iSQ9jiNAtPraSYVLirX6IG+kgwf4luIXHRel Q8kw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=gfkG2jXZejZRkfh6STqPQX5H2iR6BsPZDwALrUxA7tA=; b=L1nBIBIsOTn2zAclVfQGaXhRc2I9bmQaedNZv8Gpo6Hu/gURSdSp653KtArgGBziPh TCk9nNlBU5XFsy0F4fkxbkTG7Mz2c0n5CZnGhLqZNW5th8JjUyE9oEjCzDpRvY/VHXoV Ix9GWTC7vzg00UByiutgj2fQJDh6tK8np+5T/fal9noVDaaBw8hDujDEZJUSUaidThkX F85j9ML63U8fTEdoqF+CicodMLg8xCs3yadKMNBWZ8hUatlPXyzB7LpRjhj9oRys86dl yT/vNviWx3zld2C6A7GGy3GU5H5q0JEy9qX7iPg8EbJIrM3f8jQqc+DpXFkAZamNMzuP Z1Kw== X-Gm-Message-State: AODbwcCFy/kciZpwztw34bsj6ARrE3XOD7ITKAuLHeCLkDkqelZlpUiY 5lbtx56F1NeASYQrXJVSVgH9 X-Received: by 10.28.71.91 with SMTP id u88mr8670337wma.9.1497286713868; Mon, 12 Jun 2017 09:58:33 -0700 (PDT) Received: from localhost ([109.112.0.253]) by smtp.gmail.com with ESMTPSA id n2sm20925973wrn.30.2017.06.12.09.58.32 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 12 Jun 2017 09:58:33 -0700 (PDT) From: Salvatore Mesoraca To: linux-kernel@vger.kernel.org Cc: linux-security-module@vger.kernel.org, kernel-hardening@lists.openwall.com, Salvatore Mesoraca , Brad Spengler , PaX Team , Casey Schaufler , Kees Cook , James Morris , "Serge E. Hallyn" Subject: [PATCH 10/11] Allowing for stacking procattr support in S.A.R.A. Date: Mon, 12 Jun 2017 18:56:59 +0200 Message-Id: <1497286620-15027-11-git-send-email-s.mesoraca16@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1497286620-15027-1-git-send-email-s.mesoraca16@gmail.com> References: <1497286620-15027-1-git-send-email-s.mesoraca16@gmail.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP This allow S.A.R.A. to use the procattr interface without interfering with other LSMs. This part should be reimplemented as soon as upstream procattr stacking support is available. Signed-off-by: Salvatore Mesoraca --- fs/proc/base.c | 38 ++++++++++++++++++++++++++++++++++++++ security/security.c | 20 ++++++++++++++++++-- 2 files changed, 56 insertions(+), 2 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index f1e1927..6d0fd1c 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2515,6 +2515,40 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, .llseek = generic_file_llseek, }; +#ifdef CONFIG_SECURITY_SARA +static const struct pid_entry sara_attr_dir_stuff[] = { + REG("wxprot", 0666, proc_pid_attr_operations), +}; + +static int proc_sara_attr_dir_readdir(struct file *file, + struct dir_context *ctx) +{ + return proc_pident_readdir(file, ctx, + sara_attr_dir_stuff, + ARRAY_SIZE(sara_attr_dir_stuff)); +} + +static const struct file_operations proc_sara_attr_dir_ops = { + .read = generic_read_dir, + .iterate_shared = proc_sara_attr_dir_readdir, + .llseek = generic_file_llseek, +}; + +static struct dentry *proc_sara_attr_dir_lookup(struct inode *dir, + struct dentry *dentry, unsigned int flags) +{ + return proc_pident_lookup(dir, dentry, + sara_attr_dir_stuff, + ARRAY_SIZE(sara_attr_dir_stuff)); +}; + +static const struct inode_operations proc_sara_attr_dir_inode_ops = { + .lookup = proc_sara_attr_dir_lookup, + .getattr = pid_getattr, + .setattr = proc_setattr, +}; +#endif /* CONFIG_SECURITY_SARA */ + static const struct pid_entry attr_dir_stuff[] = { REG("current", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("prev", S_IRUGO, proc_pid_attr_operations), @@ -2522,6 +2556,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, REG("fscreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("keycreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("sockcreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), +#ifdef CONFIG_SECURITY_SARA + DIR("sara", 0555, proc_sara_attr_dir_inode_ops, + proc_sara_attr_dir_ops), +#endif }; static int proc_attr_dir_readdir(struct file *file, struct dir_context *ctx) diff --git a/security/security.c b/security/security.c index cf15686..6ca93c6 100644 --- a/security/security.c +++ b/security/security.c @@ -1244,12 +1244,28 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode) int security_getprocattr(struct task_struct *p, char *name, char **value) { - return call_int_hook(getprocattr, -EINVAL, p, name, value); + struct security_hook_list *hp; + int rc; + + list_for_each_entry(hp, &security_hook_heads.getprocattr, list) { + rc = hp->hook.getprocattr(p, name, value); + if (rc != -EINVAL) + return rc; + } + return -EINVAL; } int security_setprocattr(const char *name, void *value, size_t size) { - return call_int_hook(setprocattr, -EINVAL, name, value, size); + struct security_hook_list *hp; + int rc; + + list_for_each_entry(hp, &security_hook_heads.setprocattr, list) { + rc = hp->hook.setprocattr(name, value, size); + if (rc != -EINVAL) + return rc; + } + return -EINVAL; } int security_netlink_send(struct sock *sk, struct sk_buff *skb)