From patchwork Fri Jun 24 23:27:47 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 9198245 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 7CFFF6075F for ; Fri, 24 Jun 2016 23:28:06 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6E3C1284CF for ; Fri, 24 Jun 2016 23:28:06 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 63412284DB; Fri, 24 Jun 2016 23:28:06 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 86D32284CF for ; Fri, 24 Jun 2016 23:28:05 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751211AbcFXX1s (ORCPT ); Fri, 24 Jun 2016 19:27:48 -0400 Received: from nm15.bullet.mail.bf1.yahoo.com ([98.139.212.174]:58331 "EHLO nm15.bullet.mail.bf1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751082AbcFXX1s (ORCPT ); Fri, 24 Jun 2016 19:27:48 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1466810866; bh=4ZktPfu1Upudt/GQ2H8PSN9nCIRZDzNTKob8vQI7clk=; h=Subject:To:References:Cc:From:Date:In-Reply-To:From:Subject; b=oMZITAC18FCxQn9rW+Imm37JLbcb2j4WFwz0y39hIr2cBqoq3/7cRsKKBJG3R8MGwAyyicKoGxJPq3HfAPWj4FPgww/uM4ffY0yK258sCz12LtYX2QLg+q3txkZXtuEXjyRHC3Skg5HXf2CSuF3f/AigRGA7h5YxOF2fy8hW1E+JmbGtxxaMQuNNX7tv+hz4Evv0HKgZ7FWPPE9MDGYNZiaMt/Mpvpy2esAiHmRubKsmuC72Bn1G+xWvNZeouWDIpkyxHTeFpWr76vUntqAlwyjhgEOcl6Pii+DOFTdq1JoWPrF8OeuwWM8biKV9Ed1qlywQD+/qhe4RWvFN/NBK0A== Received: from [98.139.170.180] by nm15.bullet.mail.bf1.yahoo.com with NNFMP; 24 Jun 2016 23:27:46 -0000 Received: from [98.139.211.200] by tm23.bullet.mail.bf1.yahoo.com with NNFMP; 24 Jun 2016 23:27:46 -0000 Received: from [127.0.0.1] by smtp209.mail.bf1.yahoo.com with NNFMP; 24 Jun 2016 23:27:46 -0000 X-Yahoo-Newman-Id: 863809.2693.bm@smtp209.mail.bf1.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: mAV68WEVM1k.LQWW4VSaQB7YljGzE04tH_oSSaQrwvYaYL2 K9RdE_tbcS9mn8EPxSLHCbNSjtNXp_xjNepWjomJNOBJLITZ9AYwq02QB2lc mzZOhtGI5d8oQOJ9AjieVfsUNU2cZda0UAPzlQqpSyXVNXCvsHXYVi38thZs FKtPge3blRmJQnUK0aza4plCm80LT16YY7SDn5tsVmvJaokLsP7q1xJdmLu3 0u3VaprKy3GrF9xkOb3cVdVeQHVOhX7tfRP6VcDr1uGZbuzCejvbc4PPz1Nu q.O21e0Ww3Z_Z2tSemVScFBSR05elIvpD6kLmINuhtvm_ZR6bMQsolOV_R5X F7wcQiUK.5dN9v4Q9k0FgqxqBeHymN52Q_ujGJreF.m8zGYuiWqJqdl.TmKa kMoLApNCzFTShqBbQGtqsqVnrsiWCdNRN23KH..DLxNTpM4ua53sDpyF0CIR IXdd8FIA_BcOVUYDoDdCsA68uduS9e8Axajh4bQGg4JQKqtw2a9f2OnsBinm H7NpnkShOr2nUjLTQM0PwDt8RfIUmJAbrU72xIUqMlH9wyo8mpXGhoaKf0LV Z4flpBZc5Ukth5TcTScKtBGg- X-Yahoo-SMTP: OIJXglSswBDfgLtXluJ6wiAYv6_cnw-- Subject: [PATCH v5 1/3] LSM: Add /sys/kernel/security/lsm To: Paul Moore , Kees Cook References: <599d0a80-0838-2baa-8ee2-7eefafc10cec@schaufler-ca.com> <4263259c-7fc4-58e4-a86d-7ba92abe510a@schaufler-ca.com> <587c9d63-bd39-5781-a7b6-6add2f63c72e@schaufler-ca.com> Cc: LSM , James Morris , John Johansen , Stephen Smalley , Tetsuo Handa , LKLM From: Casey Schaufler Message-ID: <9cc8edfb-4ae9-b382-599d-03c0eb446038@schaufler-ca.com> Date: Fri, 24 Jun 2016 16:27:47 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.1.1 MIME-Version: 1.0 In-Reply-To: <587c9d63-bd39-5781-a7b6-6add2f63c72e@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Subject: [PATCH v5 1/3] LSM: Add /sys/kernel/security/lsm I got tired of having to find indirect ways to determine what security modules are active on a system. I have added /sys/kernel/security/lsm, which contains a comma separated list of the active security modules. No more groping around in /proc/filesystems, which won't help if the module doesn't support its own filesystem. Signed-off-by: Casey Schaufler Acked-by: Paul Moore Acked-by: John Johansen --- Documentation/security/LSM.txt | 7 +++++++ include/linux/lsm_hooks.h | 12 ++++-------- security/apparmor/lsm.c | 3 ++- security/commoncap.c | 3 ++- security/inode.c | 26 ++++++++++++++++++++++++-- security/loadpin/loadpin.c | 2 +- security/security.c | 38 ++++++++++++++++++++++++++++++++++++++ security/selinux/hooks.c | 2 +- security/smack/smack_lsm.c | 2 +- security/tomoyo/tomoyo.c | 2 +- security/yama/yama_lsm.c | 2 +- 11 files changed, 82 insertions(+), 17 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/Documentation/security/LSM.txt b/Documentation/security/LSM.txt index 3db7e67..c2683f2 100644 --- a/Documentation/security/LSM.txt +++ b/Documentation/security/LSM.txt @@ -22,6 +22,13 @@ system, building their checks on top of the defined capability hooks. For more details on capabilities, see capabilities(7) in the Linux man-pages project. +A list of the active security modules can be found by reading +/sys/kernel/security/lsm. This is a comma separated list, and +will always include the capability module. The list reflects the +order in which checks are made. The capability module will always +be first, followed by any "minor" modules (e.g. Yama) and then +the one "major" module (e.g. SELinux) if there is one configured. + Based on https://lkml.org/lkml/2007/10/26/215, a new LSM is accepted into the kernel when its intent (a description of what it tries to protect against and in what cases one would expect to diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 7ae3976..0bfd441 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -1841,6 +1841,7 @@ struct security_hook_list { struct list_head list; struct list_head *head; union security_list_options hook; + char *lsm; }; /* @@ -1853,15 +1854,10 @@ struct security_hook_list { { .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } } extern struct security_hook_heads security_hook_heads; +extern char *lsm_names; -static inline void security_add_hooks(struct security_hook_list *hooks, - int count) -{ - int i; - - for (i = 0; i < count; i++) - list_add_tail_rcu(&hooks[i].list, hooks[i].head); -} +extern void security_add_hooks(struct security_hook_list *hooks, int count, + char *lsm); #ifdef CONFIG_SECURITY_SELINUX_DISABLE /* diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 2660fbc..fb0fb03 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -880,7 +880,8 @@ static int __init apparmor_init(void) aa_free_root_ns(); goto alloc_out; } - security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks)); + security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks), + "apparmor"); /* Report that AppArmor successfully initialized */ apparmor_initialized = 1; diff --git a/security/commoncap.c b/security/commoncap.c index e7fadde..d101734 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -1090,7 +1090,8 @@ struct security_hook_list capability_hooks[] = { void __init capability_add_hooks(void) { - security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks)); + security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks), + "capability"); } #endif /* CONFIG_SECURITY */ diff --git a/security/inode.c b/security/inode.c index 28414b0..235ad82 100644 --- a/security/inode.c +++ b/security/inode.c @@ -20,6 +20,7 @@ #include #include #include +#include #include static struct vfsmount *mount; @@ -208,6 +209,21 @@ void securityfs_remove(struct dentry *dentry) } EXPORT_SYMBOL_GPL(securityfs_remove); +#ifdef CONFIG_SECURITY +static struct dentry *lsm_dentry; +static ssize_t lsm_read(struct file *filp, char __user *buf, size_t count, + loff_t *ppos) +{ + return simple_read_from_buffer(buf, count, ppos, lsm_names, + strlen(lsm_names)); +} + +static const struct file_operations lsm_ops = { + .read = lsm_read, + .llseek = generic_file_llseek, +}; +#endif + static int __init securityfs_init(void) { int retval; @@ -217,9 +233,15 @@ static int __init securityfs_init(void) return retval; retval = register_filesystem(&fs_type); - if (retval) + if (retval) { sysfs_remove_mount_point(kernel_kobj, "security"); - return retval; + return retval; + } +#ifdef CONFIG_SECURITY + lsm_dentry = securityfs_create_file("lsm", S_IRUGO, NULL, NULL, + &lsm_ops); +#endif + return 0; } core_initcall(securityfs_init); diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c index 89a46f1..1d82eae 100644 --- a/security/loadpin/loadpin.c +++ b/security/loadpin/loadpin.c @@ -182,7 +182,7 @@ static struct security_hook_list loadpin_hooks[] = { void __init loadpin_add_hooks(void) { pr_info("ready to pin (currently %sabled)", enabled ? "en" : "dis"); - security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks)); + security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin"); } /* Should not be mutable after boot, so not listed in sysfs (perm == 0). */ diff --git a/security/security.c b/security/security.c index c4bb47d..1093f73 100644 --- a/security/security.c +++ b/security/security.c @@ -32,6 +32,7 @@ /* Maximum number of letters for an LSM name string */ #define SECURITY_NAME_MAX 10 +char *lsm_names; /* Boot-time LSM user choice */ static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] = CONFIG_DEFAULT_SECURITY; @@ -78,6 +79,22 @@ static int __init choose_lsm(char *str) } __setup("security=", choose_lsm); +static int lsm_append(char *new, char **result) +{ + char *cp; + + if (*result == NULL) { + *result = kstrdup(new, GFP_KERNEL); + } else { + cp = kasprintf(GFP_KERNEL, "%s,%s", *result, new); + if (cp == NULL) + return -ENOMEM; + kfree(*result); + *result = cp; + } + return 0; +} + /** * security_module_enable - Load given security module on boot ? * @module: the name of the module @@ -97,6 +114,27 @@ int __init security_module_enable(const char *module) return !strcmp(module, chosen_lsm); } +/** + * security_add_hooks - Add a modules hooks to the hook lists. + * @hooks: the hooks to add + * @count: the number of hooks to add + * @lsm: the name of the security module + * + * Each LSM has to register its hooks with the infrastructure. + */ +void __init security_add_hooks(struct security_hook_list *hooks, int count, + char *lsm) +{ + int i; + + for (i = 0; i < count; i++) { + hooks[i].lsm = lsm; + list_add_tail_rcu(&hooks[i].list, hooks[i].head); + } + if (lsm_append(lsm, &lsm_names) < 0) + panic("%s - Cannot get early memory.\n", __func__); +} + /* * Hook list operation macros. * diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index a86d537..ed3a757 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6233,7 +6233,7 @@ static __init int selinux_init(void) 0, SLAB_PANIC, NULL); avc_init(); - security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks)); + security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux"); if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET)) panic("SELinux: Unable to register AVC netcache callback\n"); diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 6777295..3577009 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4801,7 +4801,7 @@ static __init int smack_init(void) /* * Register with LSM */ - security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks)); + security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack"); return 0; } diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c index 75c9987..edc52d6 100644 --- a/security/tomoyo/tomoyo.c +++ b/security/tomoyo/tomoyo.c @@ -542,7 +542,7 @@ static int __init tomoyo_init(void) if (!security_module_enable("tomoyo")) return 0; /* register ourselves with the security framework */ - security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks)); + security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo"); printk(KERN_INFO "TOMOYO Linux initialized\n"); cred->security = &tomoyo_kernel_domain; tomoyo_mm_init(); diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c index 0309f21..f8ee60e 100644 --- a/security/yama/yama_lsm.c +++ b/security/yama/yama_lsm.c @@ -471,6 +471,6 @@ static inline void yama_init_sysctl(void) { } void __init yama_add_hooks(void) { pr_info("Yama: becoming mindful.\n"); - security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks)); + security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks), "yama"); yama_init_sysctl(); }