From patchwork Fri Jun 7 14:17:48 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Howells X-Patchwork-Id: 10981911 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0B10713AD for ; Fri, 7 Jun 2019 14:18:04 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id F024128C4E for ; Fri, 7 Jun 2019 14:18:03 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id E48B928C58; Fri, 7 Jun 2019 14:18:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 5BBA128C4E for ; Fri, 7 Jun 2019 14:18:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729302AbfFGOSA (ORCPT ); Fri, 7 Jun 2019 10:18:00 -0400 Received: from mx1.redhat.com ([209.132.183.28]:63617 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728719AbfFGOR7 (ORCPT ); Fri, 7 Jun 2019 10:17:59 -0400 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id EE8AE31760FD; Fri, 7 Jun 2019 14:17:53 +0000 (UTC) Received: from warthog.procyon.org.uk (ovpn-120-173.rdu2.redhat.com [10.10.120.173]) by smtp.corp.redhat.com (Postfix) with ESMTP id 3B7737FEA9; Fri, 7 Jun 2019 14:17:49 +0000 (UTC) Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 Subject: [PATCH 03/13] security: Add hooks to rule on setting a watch [ver #4] From: David Howells To: viro@zeniv.linux.org.uk Cc: Casey Schaufler , Stephen Smalley , linux-security-module@vger.kernel.org, dhowells@redhat.com, raven@themaw.net, linux-fsdevel@vger.kernel.org, linux-api@vger.kernel.org, linux-block@vger.kernel.org, keyrings@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Date: Fri, 07 Jun 2019 15:17:48 +0100 Message-ID: <155991706847.15579.4702772917586301113.stgit@warthog.procyon.org.uk> In-Reply-To: <155991702981.15579.6007568669839441045.stgit@warthog.procyon.org.uk> References: <155991702981.15579.6007568669839441045.stgit@warthog.procyon.org.uk> User-Agent: StGit/unknown-version MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.41]); Fri, 07 Jun 2019 14:17:59 +0000 (UTC) Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Add security hooks that will allow an LSM to rule on whether or not a watch may be set. More than one hook is required as the watches watch different types of object. Signed-off-by: David Howells cc: Casey Schaufler cc: Stephen Smalley cc: linux-security-module@vger.kernel.org --- include/linux/lsm_hooks.h | 38 ++++++++++++++++++++++++++++++++++++++ include/linux/security.h | 25 +++++++++++++++++++++++++ security/security.c | 23 +++++++++++++++++++++++ 3 files changed, 86 insertions(+) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 2474c3f785ca..0543449c0f6e 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -1420,6 +1420,32 @@ * @ctx is a pointer in which to place the allocated security context. * @ctxlen points to the place to put the length of @ctx. * + * Security hooks for the general notification queue: + * + * @watch_mount: + * Check to see if a process is allowed to watch for mount topology change + * notifications on a mount subtree. + * @watch: The watch object + * @path: The root of the subtree to watch. + * + * @watch_sb: + * Check to see if a process is allowed to watch for event notifications + * from a superblock. + * @watch: The watch object + * @sb: The superblock to watch. + * + * @watch_key: + * Check to see if a process is allowed to watch for event notifications + * from a key or keyring. + * @watch: The watch object + * @key: The key to watch. + * + * @watch_devices: + * Check to see if a process is allowed to watch for event notifications + * from devices (as a global set). + * @watch: The watch object + * + * * Security hooks for using the eBPF maps and programs functionalities through * eBPF syscalls. * @@ -1698,6 +1724,12 @@ union security_list_options { int (*inode_notifysecctx)(struct inode *inode, void *ctx, u32 ctxlen); int (*inode_setsecctx)(struct dentry *dentry, void *ctx, u32 ctxlen); int (*inode_getsecctx)(struct inode *inode, void **ctx, u32 *ctxlen); +#ifdef CONFIG_WATCH_QUEUE + int (*watch_mount)(struct watch *watch, struct path *path); + int (*watch_sb)(struct watch *watch, struct super_block *sb); + int (*watch_key)(struct watch *watch, struct key *key); + int (*watch_devices)(struct watch *watch); +#endif /* CONFIG_WATCH_QUEUE */ #ifdef CONFIG_SECURITY_NETWORK int (*unix_stream_connect)(struct sock *sock, struct sock *other, @@ -1977,6 +2009,12 @@ struct security_hook_heads { struct hlist_head inode_notifysecctx; struct hlist_head inode_setsecctx; struct hlist_head inode_getsecctx; +#ifdef CONFIG_WATCH_QUEUE + struct hlist_head watch_mount; + struct hlist_head watch_sb; + struct hlist_head watch_key; + struct hlist_head watch_devices; +#endif /* CONFIG_WATCH_QUEUE */ #ifdef CONFIG_SECURITY_NETWORK struct hlist_head unix_stream_connect; struct hlist_head unix_may_send; diff --git a/include/linux/security.h b/include/linux/security.h index 23c8b602c0ab..ac3bf6b5f87b 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -58,6 +58,7 @@ struct fs_context; struct fs_parameter; enum fs_value_type; struct fsinfo_kparams; +struct watch; /* Default (no) options for the capable function */ #define CAP_OPT_NONE 0x0 @@ -396,6 +397,12 @@ void security_inode_invalidate_secctx(struct inode *inode); int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen); int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen); +#ifdef CONFIG_WATCH_QUEUE +int security_watch_mount(struct watch *watch, struct path *path); +int security_watch_sb(struct watch *watch, struct super_block *sb); +int security_watch_key(struct watch *watch, struct key *key); +int security_watch_devices(struct watch *watch); +#endif /* CONFIG_WATCH_QUEUE */ #else /* CONFIG_SECURITY */ static inline int call_lsm_notifier(enum lsm_event event, void *data) @@ -1215,6 +1222,24 @@ static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32 { return -EOPNOTSUPP; } +#ifdef CONFIG_WATCH_QUEUE +static inline int security_watch_mount(struct watch *watch, struct path *path) +{ + return 0; +} +static inline int security_watch_sb(struct watch *watch, struct super_block *sb) +{ + return 0; +} +static inline int security_watch_key(struct watch *watch, struct key *key) +{ + return 0; +} +static inline int security_watch_devices(struct watch *watch) +{ + return 0; +} +#endif /* CONFIG_WATCH_QUEUE */ #endif /* CONFIG_SECURITY */ #ifdef CONFIG_SECURITY_NETWORK diff --git a/security/security.c b/security/security.c index 3af886e8fced..ee2f8539a0d5 100644 --- a/security/security.c +++ b/security/security.c @@ -1929,6 +1929,29 @@ int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) } EXPORT_SYMBOL(security_inode_getsecctx); +#ifdef CONFIG_WATCH_QUEUE +int security_watch_mount(struct watch *watch, struct path *path) +{ + return call_int_hook(watch_mount, 0, watch, path); +} + +int security_watch_sb(struct watch *watch, struct super_block *sb) +{ + return call_int_hook(watch_sb, 0, watch, sb); +} + +int security_watch_key(struct watch *watch, struct key *key) +{ + return call_int_hook(watch_key, 0, watch, key); +} + +int security_watch_devices(struct watch *watch) +{ + return call_int_hook(watch_devices, 0, watch); +} + +#endif /* CONFIG_WATCH_QUEUE */ + #ifdef CONFIG_SECURITY_NETWORK int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)