diff mbox series

[v5,10/16] module: Call security_kernel_post_load_data()

Message ID 20201002173828.2099543-11-keescook@chromium.org (mailing list archive)
State New, archived
Headers show
Series Introduce partial kernel_read_file() support | expand

Commit Message

Kees Cook Oct. 2, 2020, 5:38 p.m. UTC 
Now that there is an API for checking loaded contents for modules
loaded without a file, call into the LSM hooks.

Signed-off-by: Kees Cook <keescook@chromium.org>
Reviewed-by: KP Singh <kpsingh@google.com>
Acked-by: Jessica Yu <jeyu@kernel.org>
---
 kernel/module.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

Comments

James Morris Oct. 6, 2020, 5:19 p.m. UTC | #1 
On Fri, 2 Oct 2020, Kees Cook wrote:

> Now that there is an API for checking loaded contents for modules
> loaded without a file, call into the LSM hooks.
> 
> Signed-off-by: Kees Cook <keescook@chromium.org>
> Reviewed-by: KP Singh <kpsingh@google.com>
> Acked-by: Jessica Yu <jeyu@kernel.org>


Reviewed-by: James Morris <jamorris@linux.microsoft.com>
diff mbox series

Patch

diff --git a/kernel/module.c b/kernel/module.c
index f47209e0fde6..adfa21dd3842 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -3014,7 +3014,7 @@  static int copy_module_from_user(const void __user *umod, unsigned long len,
 	if (info->len < sizeof(*(info->hdr)))
 		return -ENOEXEC;
 
-	err = security_kernel_load_data(LOADING_MODULE, false);
+	err = security_kernel_load_data(LOADING_MODULE, true);
 	if (err)
 		return err;
 
@@ -3024,11 +3024,17 @@  static int copy_module_from_user(const void __user *umod, unsigned long len,
 		return -ENOMEM;
 
 	if (copy_chunked_from_user(info->hdr, umod, info->len) != 0) {
-		vfree(info->hdr);
-		return -EFAULT;
+		err = -EFAULT;
+		goto out;
 	}
 
-	return 0;
+	err = security_kernel_post_load_data((char *)info->hdr, info->len,
+					     LOADING_MODULE, "init_module");
+out:
+	if (err)
+		vfree(info->hdr);
+
+	return err;
 }
 
 static void free_copy(struct load_info *info)