From patchwork Thu Jun 15 16:42:55 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Salvatore Mesoraca X-Patchwork-Id: 9789339 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 31E3760384 for ; Thu, 15 Jun 2017 16:45:27 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 245DF27528 for ; Thu, 15 Jun 2017 16:45:27 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 192FF27F17; Thu, 15 Jun 2017 16:45:27 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, GAPPY_SUBJECT, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id BBB0327528 for ; Thu, 15 Jun 2017 16:45:26 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752583AbdFOQoq (ORCPT ); Thu, 15 Jun 2017 12:44:46 -0400 Received: from mail-wm0-f67.google.com ([74.125.82.67]:33983 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752017AbdFOQom (ORCPT ); Thu, 15 Jun 2017 12:44:42 -0400 Received: by mail-wm0-f67.google.com with SMTP id 70so790868wme.1; Thu, 15 Jun 2017 09:44:42 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=g1DNW0wJjTt8XnMubKnq0c3tAWvVVYq4tamdNgt1AbU=; b=UCg6gqCTyi+xcx9VhhBv5iETdJMVoFOmzoIifJzlygurqxvFnjekP8+5n76asjy28V /KK09ye/FXTa1nZU9hBIClUmGIAybJ7Z1bSHY0jlkQSQ3oYZkWjlzspotItFoh0w2oOC dZBN7htaLM01tdhdLZP422HlRGoEnuINtZpd6AGd3o3en2YK6efzzvTegZwrgSjjsIjt Lg0Fds+UzKn3KL6OkDXM93CAaCj0IIMhVp1Mz82YiMHwdlT2PuluNO/4o3LyeRQASTZS 7nnrv5ShO8LvRetpykNh3dQkRPS6Vh+uyztWXEoq2l65fp9As2WNuXbskTrjvXg5SkXM ExFw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=g1DNW0wJjTt8XnMubKnq0c3tAWvVVYq4tamdNgt1AbU=; b=XZl9dXbyR5APF2XTZXLlQrPsNCBlb8j6tIr7vj6R2OTDBngxi0pz6Mf8VTjPcAkkNg mJS8rTvaNw+QNfsqIA8bx+oDd/IxkMu+YAfouTJkzkpP9rQi83Om/bSqA4Qgu1mtRqRt P9EPLQBtudLUZiO4CjuY4mU7dRfGCKi9ejGxfU9kfIzRs/j+VOhVhl2Wnaiicap+wZ0E yaqsGFKo7gCc1TNAYG9FAIRxdwzuFKBg4RD+8aGVWSv5In3OjkcUGD8IBp2Mm522CyDK Em8bDB2P3yqcQ8u0Spepzt1hFSAFkLlvP0GE+CYDfJPfzWieVK+vv11LlkCXrGkopLAG U5Tw== X-Gm-Message-State: AKS2vOyX7pzWi8UDRa/1OQ0J+SrC11AscKNaFDst/js4frmnc5ENg6ey i/Y3D0VL/9kQDhzc9CFOrTmm X-Received: by 10.28.1.85 with SMTP id 82mr4235485wmb.88.1497545081037; Thu, 15 Jun 2017 09:44:41 -0700 (PDT) Received: from localhost ([37.176.236.94]) by smtp.gmail.com with ESMTPSA id k19sm615938wmg.9.2017.06.15.09.44.39 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 15 Jun 2017 09:44:40 -0700 (PDT) From: Salvatore Mesoraca To: linux-kernel@vger.kernel.org Cc: linux-security-module@vger.kernel.org, kernel-hardening@lists.openwall.com, Salvatore Mesoraca , Brad Spengler , PaX Team , Casey Schaufler , Kees Cook , James Morris , "Serge E. Hallyn" , linux-mm@kvack.org, x86@kernel.org, Jann Horn , Christoph Hellwig , Thomas Gleixner Subject: [RFC v2 8/9] Allowing for stacking procattr support in S.A.R.A. Date: Thu, 15 Jun 2017 18:42:55 +0200 Message-Id: <1497544976-7856-9-git-send-email-s.mesoraca16@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1497544976-7856-1-git-send-email-s.mesoraca16@gmail.com> References: <1497544976-7856-1-git-send-email-s.mesoraca16@gmail.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP This allow S.A.R.A. to use the procattr interface without interfering with other LSMs. This part should be reimplemented as soon as upstream procattr stacking support is available. Signed-off-by: Salvatore Mesoraca --- fs/proc/base.c | 38 ++++++++++++++++++++++++++++++++++++++ security/security.c | 20 ++++++++++++++++++-- 2 files changed, 56 insertions(+), 2 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index f1e1927..6d0fd1c 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2515,6 +2515,40 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, .llseek = generic_file_llseek, }; +#ifdef CONFIG_SECURITY_SARA +static const struct pid_entry sara_attr_dir_stuff[] = { + REG("wxprot", 0666, proc_pid_attr_operations), +}; + +static int proc_sara_attr_dir_readdir(struct file *file, + struct dir_context *ctx) +{ + return proc_pident_readdir(file, ctx, + sara_attr_dir_stuff, + ARRAY_SIZE(sara_attr_dir_stuff)); +} + +static const struct file_operations proc_sara_attr_dir_ops = { + .read = generic_read_dir, + .iterate_shared = proc_sara_attr_dir_readdir, + .llseek = generic_file_llseek, +}; + +static struct dentry *proc_sara_attr_dir_lookup(struct inode *dir, + struct dentry *dentry, unsigned int flags) +{ + return proc_pident_lookup(dir, dentry, + sara_attr_dir_stuff, + ARRAY_SIZE(sara_attr_dir_stuff)); +}; + +static const struct inode_operations proc_sara_attr_dir_inode_ops = { + .lookup = proc_sara_attr_dir_lookup, + .getattr = pid_getattr, + .setattr = proc_setattr, +}; +#endif /* CONFIG_SECURITY_SARA */ + static const struct pid_entry attr_dir_stuff[] = { REG("current", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("prev", S_IRUGO, proc_pid_attr_operations), @@ -2522,6 +2556,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, REG("fscreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("keycreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("sockcreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), +#ifdef CONFIG_SECURITY_SARA + DIR("sara", 0555, proc_sara_attr_dir_inode_ops, + proc_sara_attr_dir_ops), +#endif }; static int proc_attr_dir_readdir(struct file *file, struct dir_context *ctx) diff --git a/security/security.c b/security/security.c index f7df697..c6c78dd 100644 --- a/security/security.c +++ b/security/security.c @@ -1239,12 +1239,28 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode) int security_getprocattr(struct task_struct *p, char *name, char **value) { - return call_int_hook(getprocattr, -EINVAL, p, name, value); + struct security_hook_list *hp; + int rc; + + list_for_each_entry(hp, &security_hook_heads.getprocattr, list) { + rc = hp->hook.getprocattr(p, name, value); + if (rc != -EINVAL) + return rc; + } + return -EINVAL; } int security_setprocattr(const char *name, void *value, size_t size) { - return call_int_hook(setprocattr, -EINVAL, name, value, size); + struct security_hook_list *hp; + int rc; + + list_for_each_entry(hp, &security_hook_heads.setprocattr, list) { + rc = hp->hook.setprocattr(name, value, size); + if (rc != -EINVAL) + return rc; + } + return -EINVAL; } int security_netlink_send(struct sock *sk, struct sk_buff *skb)