From patchwork Tue Nov 21 18:26:10 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Salvatore Mesoraca X-Patchwork-Id: 10068701 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 9436E6022E for ; Tue, 21 Nov 2017 18:27:56 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8A0E3283CA for ; Tue, 21 Nov 2017 18:27:56 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7EA04298B7; Tue, 21 Nov 2017 18:27:56 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, GAPPY_SUBJECT, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 20EE7283CA for ; Tue, 21 Nov 2017 18:27:56 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751470AbdKUS1x (ORCPT ); Tue, 21 Nov 2017 13:27:53 -0500 Received: from mail-wm0-f67.google.com ([74.125.82.67]:43811 "EHLO mail-wm0-f67.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751448AbdKUS0s (ORCPT ); Tue, 21 Nov 2017 13:26:48 -0500 Received: by mail-wm0-f67.google.com with SMTP id x63so5374321wmf.2; Tue, 21 Nov 2017 10:26:47 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id:in-reply-to:references; bh=IpZhtUKQ+8pX3ph0ocepjr7bLfaXN+cOm0v5k4ukc/M=; b=q0jJcBuOxotyKg0jxTCMqEIMSyBTUEXu6IhTfh1r5zcpZUOkwNak+THDKG0/cltdgX OClkyvscyDAOBY/iJC4e72mmrXxVgNS2tpCCLU/jzEp8eTOv1u0MEftjGBnbL5Nj9zmr foQPvn3lB4Gq17pcBKHnPy6nq+UYZZ79Wp5BBQySq2wsmNh+lG3aWONB70d0+ZIVB8Te QRDaJL+sCGH8tfc4BSlCq4H3jP6OulDEi1UMpnQQv8q98x9mxhHkzCgzZSaoG6bDoMc/ JopYji/uB/PR53zPqNO6V4pyHBG9wiI2PkAXI+nveovTl71G1YoyRk1okYHBu3sH3Nq6 9q+w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=IpZhtUKQ+8pX3ph0ocepjr7bLfaXN+cOm0v5k4ukc/M=; b=VY4RF4OoBiAeAA4fO4pQQeyWqvq/rmOKrctSR2yyGREQjPSzUajQzGk4urJHF43KLA ezql3pwC1IxDv1vAn9fg6GR1z9sqEi5pUefQvoDJizOtAcXvpQR6FLwTPmaJiyQbABwf bKw6T2TxEBnNv3dm1l/sAZ1oWB1mzzq0zAGQY7yTFFI0PxELyeQNm/MEfPoc4ojmFS2t h141Crqj0Caozd6SjlXxwk/VXVa/XGvqvTxmNsgUDQ9NozQeRVdtRdBPUKK3IiGzLPP6 e0Jl8m4EfoJaf34Ik2aJq04aQNK4gjAGS/o1SgXCyx+KKvWLKV84YBPEQWqH+HgpF16V 3v/Q== X-Gm-Message-State: AJaThX5AjeWWBavyWInpqVp1kk3mU20x/T03Sw7b7WtDlT21ftnYP6CL Q+vTSvcnvjzgIg36LGk0dDiVerCWpeso4A== X-Google-Smtp-Source: AGs4zMaMhmQcDu7HmL6ZfdTvNpiCYTfYg4RTSBGlU1kc1LjO+B6zMTyrK8X93qMhTxytnmzoJC1J1A== X-Received: by 10.28.6.2 with SMTP id 2mr1952196wmg.37.1511288806591; Tue, 21 Nov 2017 10:26:46 -0800 (PST) Received: from localhost ([37.180.48.100]) by smtp.gmail.com with ESMTPSA id n143sm3533217wmd.31.2017.11.21.10.26.44 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 21 Nov 2017 10:26:46 -0800 (PST) From: Salvatore Mesoraca To: linux-kernel@vger.kernel.org Cc: linux-security-module@vger.kernel.org, kernel-hardening@lists.openwall.com, linux-mm@kvack.org, Salvatore Mesoraca , Alexander Viro , Brad Spengler , Casey Schaufler , Christoph Hellwig , James Morris , Jann Horn , Kees Cook , PaX Team , Thomas Gleixner , "Serge E. Hallyn" Subject: [RFC v4 08/10] Allowing for stacking procattr support in S.A.R.A. Date: Tue, 21 Nov 2017 19:26:10 +0100 Message-Id: <1511288772-19308-9-git-send-email-s.mesoraca16@gmail.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1511288772-19308-1-git-send-email-s.mesoraca16@gmail.com> References: <1511288772-19308-1-git-send-email-s.mesoraca16@gmail.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP This allow S.A.R.A. to use the procattr interface without interfering with other LSMs. This part should be reimplemented as soon as upstream procattr stacking support is available. Signed-off-by: Salvatore Mesoraca --- fs/proc/base.c | 38 ++++++++++++++++++++++++++++++++++++++ security/security.c | 20 ++++++++++++++++++-- 2 files changed, 56 insertions(+), 2 deletions(-) diff --git a/fs/proc/base.c b/fs/proc/base.c index 9d357b2..a8a4164 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -2560,6 +2560,40 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, .llseek = generic_file_llseek, }; +#ifdef CONFIG_SECURITY_SARA +static const struct pid_entry sara_attr_dir_stuff[] = { + REG("wxprot", 0666, proc_pid_attr_operations), +}; + +static int proc_sara_attr_dir_readdir(struct file *file, + struct dir_context *ctx) +{ + return proc_pident_readdir(file, ctx, + sara_attr_dir_stuff, + ARRAY_SIZE(sara_attr_dir_stuff)); +} + +static const struct file_operations proc_sara_attr_dir_ops = { + .read = generic_read_dir, + .iterate_shared = proc_sara_attr_dir_readdir, + .llseek = generic_file_llseek, +}; + +static struct dentry *proc_sara_attr_dir_lookup(struct inode *dir, + struct dentry *dentry, unsigned int flags) +{ + return proc_pident_lookup(dir, dentry, + sara_attr_dir_stuff, + ARRAY_SIZE(sara_attr_dir_stuff)); +}; + +static const struct inode_operations proc_sara_attr_dir_inode_ops = { + .lookup = proc_sara_attr_dir_lookup, + .getattr = pid_getattr, + .setattr = proc_setattr, +}; +#endif /* CONFIG_SECURITY_SARA */ + static const struct pid_entry attr_dir_stuff[] = { REG("current", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("prev", S_IRUGO, proc_pid_attr_operations), @@ -2567,6 +2601,10 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, REG("fscreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("keycreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), REG("sockcreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations), +#ifdef CONFIG_SECURITY_SARA + DIR("sara", 0555, proc_sara_attr_dir_inode_ops, + proc_sara_attr_dir_ops), +#endif }; static int proc_attr_dir_readdir(struct file *file, struct dir_context *ctx) diff --git a/security/security.c b/security/security.c index 21cd07e..2d00c5e 100644 --- a/security/security.c +++ b/security/security.c @@ -1273,12 +1273,28 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode) int security_getprocattr(struct task_struct *p, char *name, char **value) { - return call_int_hook(getprocattr, -EINVAL, p, name, value); + struct security_hook_list *hp; + int rc; + + list_for_each_entry(hp, &security_hook_heads.getprocattr, list) { + rc = hp->hook.getprocattr(p, name, value); + if (rc != -EINVAL) + return rc; + } + return -EINVAL; } int security_setprocattr(const char *name, void *value, size_t size) { - return call_int_hook(setprocattr, -EINVAL, name, value, size); + struct security_hook_list *hp; + int rc; + + list_for_each_entry(hp, &security_hook_heads.setprocattr, list) { + rc = hp->hook.setprocattr(name, value, size); + if (rc != -EINVAL) + return rc; + } + return -EINVAL; } int security_netlink_send(struct sock *sk, struct sk_buff *skb)