From patchwork Wed Nov 13 00:08:57 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11240507 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 0137F14E5 for ; Wed, 13 Nov 2019 00:09:58 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id D50D421D7F for ; Wed, 13 Nov 2019 00:09:57 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="cWNgmiPu" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727021AbfKMAJ5 (ORCPT ); Tue, 12 Nov 2019 19:09:57 -0500 Received: from sonic313-15.consmr.mail.ne1.yahoo.com ([66.163.185.38]:42027 "EHLO sonic313-15.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727189AbfKMAJ5 (ORCPT ); Tue, 12 Nov 2019 19:09:57 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573603795; bh=Uch5FeLojZqD7t2WLz34beHxU2ee3C06hYp8rOB512g=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=cWNgmiPuaFnstqmn+8+JfnjqmUwEEuYaXiwyvxtWC2aI1y0jVvL6u0cjMjv+CEaoulh4xN20PkCJpFynysD1VruTzCORinSeAb99uzQfAGlPqQnlPqM7VGlY1nT9Zrni5nnFjqRmud8XTIwN7L/XgW35JG0HSNgfiJX0z1EIQua+H+Fbwo954oae6nGhcHS5j3xFpcTck+HbhGRFm18COtnV2p62HUU7kwbxpLos1yRILHHCsUBcXs9MZIdf8c2Exy1HB7G+D51Nr1TVZ23WvIkOffL0p5pmII32RyrWliE/GPShQeh+0wyBn+KlLUM8eE/BYrH3DXsloNEOqfbdeA== X-YMail-OSG: 0MaaMNIVM1mEiIVBJvRslAHBxw3jCM8znhuHELoFqr8OM9hAeB.uwxdtbXAXtKg BTrwsqedvA03WNaxIVYMYWtBEeK0Rgh6kdBeXl_rKTN2BPAwXQ0rlzJWMAtjBdwkJTXMWL1L_XqI 5vIlHWiwk7tgjxZJGgcNx7A_UeWQ1uD9iUiGNyA8FPyMy2NiJWmdQFxRPsVI24fqxNbSLJCVqOoX sIai8Drf5skkUWFy4nmKacjd8aokYQVNIPUMvhE13tkYMc7DvIztmpU2S0QUhklmdAcgGZSli_p9 ZAHzt8WBhAVMlDnhZxpvZJo_08pZeToiswORB9jWQxKxzCf9HQmSTOnAywLvceuH1SBD07RqVjuL 547Q1IhzkOWPdkbJBYk4iB8Vi751wyfFQXZsyFgIhDpx6HjpcJjqYPJt6lOSN_Cv6IPISGyzV8xP 5jtiOBDOUPTTxinT4AJ4Efd7jYCFdnbX2J1WhCx74omewBbWklAOGqE1DLpFLiVKhh1lYXpEUBfU xyPlO48qw5lua_LMpnFU80YPP9Xwimnv6o2jT8a5L.UYly.BFf.ABXMiHDaAI0VxPC.d8vSlIFvI Tvwqt3o7JUDylUe5fU75xhyoRY8uQUVBDROAizvEWo8OZ4n8BLdafsb9XoBcKwAbIk_pZmbIi7Rr 9Cx7b1UlvANKTQSdhf1JRKOa1RyTCV1hXOgNijfG.JogYoXK0qMfJZJ6tj310MPybxDs4yxJqZgj zbyy9aeyz2rZu_WjdrcCEWbM30jBMpYluXj90yz7sL8hcpmM8SEU2JVTfbAO7qKrHnhNDVT_nbAl jv6VyaDxeBIq2fKw0sjX__rIoWNdKa3xn0hoyiDg9A4akLdCgymWOOWd8rzn_UrfwV09LSVP9iHO Tg9o8CIaXa5nSmIenVWTeaz3USIE7oSYunfK25Nm7bnFTB7QL5u_CgoTMZvYKAES.KITOkobPWaW DD4WJU.LST9kJzAh8qsLYTjbzBd4EnLlmQjFTYz4t0wwsnyZAHLEeY1Lx.isEd9qYySNWPEysWCe BUC4Cjaeic.n98kW6zNFu07JrQcVpo8bqZ87zvfIEOT8HUrUs15gGdGQz05ruSWvMrBBeh_v.4sv WmmsrFTtY8FbBF5nBSPXbcxvsI_ZpeKZwbct595ToAO4Z2nZHk57GYwgGjwfYb9BTWmrgJrOpdl6 qyhO9afPnlzsyZSQJEa9IOhfHnX7cKai0N.OLlCD_YT4G8fulyN9b_d0RwbwEEqLVlSxNZe6Wrrl VtqEFqW8AKRIimVLHUB3yATBTais_8Mdt2P86iC3R96bwFFTcMcZu5aK0FVu8LmlXxYiD6rdZgXc SqhsjTmHG7W1JqColwJ1ozAQUZS.SI27k7d4p1ep9SoDbznmFA4VN17ZJ.bd4hrhmcjcOeXZZP6m VCCyjErdbLmcqEkLvsJTVzEC1PlgKTBHIz9ZQCQM- Received: from sonic.gate.mail.ne1.yahoo.com by sonic313.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 00:09:55 +0000 Received: by smtp432.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID a194c842b715663bc900de4e5d395aa8; Wed, 13 Nov 2019 00:09:51 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov, linux-audit@redhat.com, linux-integrity@vger.kernel.org Subject: [PATCH 09/25] LSM: Use lsmblob in security_task_getsecid Date: Tue, 12 Nov 2019 16:08:57 -0800 Message-Id: <20191113000913.5414-10-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113000913.5414-1-casey@schaufler-ca.com> References: <20191113000913.5414-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Change the security_task_getsecid() interface to fill in a lsmblob structure instead of a u32 secid in support of LSM stacking. Audit interfaces will need to collect all possible secids for possible reporting. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler cc: linux-audit@redhat.com cc: linux-integrity@vger.kernel.org --- drivers/android/binder.c | 4 +-- include/linux/security.h | 7 ++--- kernel/audit.c | 11 ++++---- kernel/auditfilter.c | 4 +-- kernel/auditsc.c | 18 ++++++++----- net/netlabel/netlabel_unlabeled.c | 5 +++- net/netlabel/netlabel_user.h | 6 ++++- security/integrity/ima/ima_appraise.c | 4 ++- security/integrity/ima/ima_main.c | 39 ++++++++++++++++----------- security/security.c | 12 ++++++--- 10 files changed, 68 insertions(+), 42 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 5f4702b4c507..3a7fcdc8dbe2 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -3108,12 +3108,10 @@ static void binder_transaction(struct binder_proc *proc, t->priority = task_nice(current); if (target_node && target_node->txn_security_ctx) { - u32 secid; struct lsmblob blob; size_t added_size; - security_task_getsecid(proc->tsk, &secid); - lsmblob_init(&blob, secid); + security_task_getsecid(proc->tsk, &blob); ret = security_secid_to_secctx(&blob, &secctx, &secctx_sz); if (ret) { return_error = BR_FAILED_REPLY; diff --git a/include/linux/security.h b/include/linux/security.h index 9519b4fb43ae..67f95a335b5d 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -447,7 +447,7 @@ int security_task_fix_setuid(struct cred *new, const struct cred *old, int security_task_setpgid(struct task_struct *p, pid_t pgid); int security_task_getpgid(struct task_struct *p); int security_task_getsid(struct task_struct *p); -void security_task_getsecid(struct task_struct *p, u32 *secid); +void security_task_getsecid(struct task_struct *p, struct lsmblob *blob); int security_task_setnice(struct task_struct *p, int nice); int security_task_setioprio(struct task_struct *p, int ioprio); int security_task_getioprio(struct task_struct *p); @@ -1099,9 +1099,10 @@ static inline int security_task_getsid(struct task_struct *p) return 0; } -static inline void security_task_getsecid(struct task_struct *p, u32 *secid) +static inline void security_task_getsecid(struct task_struct *p, + struct lsmblob *blob) { - *secid = 0; + lsmblob_init(blob, 0); } static inline int security_task_setnice(struct task_struct *p, int nice) diff --git a/kernel/audit.c b/kernel/audit.c index 2f8e89eaf3e5..fd29186ae977 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -2062,14 +2062,12 @@ int audit_log_task_context(struct audit_buffer *ab) char *ctx = NULL; unsigned len; int error; - u32 sid; struct lsmblob blob; - security_task_getsecid(current, &sid); - if (!sid) + security_task_getsecid(current, &blob); + if (!lsmblob_is_set(&blob)) return 0; - lsmblob_init(&blob, sid); error = security_secid_to_secctx(&blob, &ctx, &len); if (error) { if (error != -EINVAL) @@ -2276,6 +2274,7 @@ int audit_set_loginuid(kuid_t loginuid) int audit_signal_info(int sig, struct task_struct *t) { kuid_t uid = current_uid(), auid; + struct lsmblob blob; if (auditd_test_task(t) && (sig == SIGTERM || sig == SIGHUP || @@ -2286,7 +2285,9 @@ int audit_signal_info(int sig, struct task_struct *t) audit_sig_uid = auid; else audit_sig_uid = uid; - security_task_getsecid(current, &audit_sig_sid); + security_task_getsecid(current, &blob); + /* scaffolding until audit_sig_sid is converted */ + audit_sig_sid = blob.secid[0]; } return audit_signal_info_syscall(t); diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 356db1dd276c..19cfbe716f9d 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1324,7 +1324,6 @@ int audit_filter(int msgtype, unsigned int listtype) for (i = 0; i < e->rule.field_count; i++) { struct audit_field *f = &e->rule.fields[i]; pid_t pid; - u32 sid; struct lsmblob blob; switch (f->type) { @@ -1355,8 +1354,7 @@ int audit_filter(int msgtype, unsigned int listtype) case AUDIT_SUBJ_SEN: case AUDIT_SUBJ_CLR: if (f->lsm_rule) { - security_task_getsecid(current, &sid); - lsmblob_init(&blob, sid); + security_task_getsecid(current, &blob); result = security_audit_rule_match( &blob, f->type, f->op, f->lsm_rule); diff --git a/kernel/auditsc.c b/kernel/auditsc.c index ce8bf2d8f8d2..cccb681ad081 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -444,7 +444,6 @@ static int audit_filter_rules(struct task_struct *tsk, { const struct cred *cred; int i, need_sid = 1; - u32 sid; struct lsmblob blob; unsigned int sessionid; @@ -641,10 +640,9 @@ static int audit_filter_rules(struct task_struct *tsk, logged upon error */ if (f->lsm_rule) { if (need_sid) { - security_task_getsecid(tsk, &sid); + security_task_getsecid(tsk, &blob); need_sid = 0; } - lsmblob_init(&blob, sid); result = security_audit_rule_match(&blob, f->type, f->op, @@ -2382,12 +2380,15 @@ int __audit_sockaddr(int len, void *a) void __audit_ptrace(struct task_struct *t) { struct audit_context *context = audit_context(); + struct lsmblob blob; context->target_pid = task_tgid_nr(t); context->target_auid = audit_get_loginuid(t); context->target_uid = task_uid(t); context->target_sessionid = audit_get_sessionid(t); - security_task_getsecid(t, &context->target_sid); + security_task_getsecid(t, &blob); + /* scaffolding - until target_sid is converted */ + context->target_sid = blob.secid[0]; memcpy(context->target_comm, t->comm, TASK_COMM_LEN); } @@ -2403,6 +2404,7 @@ int audit_signal_info_syscall(struct task_struct *t) struct audit_aux_data_pids *axp; struct audit_context *ctx = audit_context(); kuid_t t_uid = task_uid(t); + struct lsmblob blob; if (!audit_signals || audit_dummy_context()) return 0; @@ -2414,7 +2416,9 @@ int audit_signal_info_syscall(struct task_struct *t) ctx->target_auid = audit_get_loginuid(t); ctx->target_uid = t_uid; ctx->target_sessionid = audit_get_sessionid(t); - security_task_getsecid(t, &ctx->target_sid); + security_task_getsecid(t, &blob); + /* scaffolding until target_sid is converted */ + ctx->target_sid = blob.secid[0]; memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN); return 0; } @@ -2435,7 +2439,9 @@ int audit_signal_info_syscall(struct task_struct *t) axp->target_auid[axp->pid_count] = audit_get_loginuid(t); axp->target_uid[axp->pid_count] = t_uid; axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t); - security_task_getsecid(t, &axp->target_sid[axp->pid_count]); + security_task_getsecid(t, &blob); + /* scaffolding until target_sid is converted */ + axp->target_sid[axp->pid_count] = blob.secid[0]; memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN); axp->pid_count++; diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c index 0cda17cb44a0..e279b81d9545 100644 --- a/net/netlabel/netlabel_unlabeled.c +++ b/net/netlabel/netlabel_unlabeled.c @@ -1539,11 +1539,14 @@ int __init netlbl_unlabel_defconf(void) int ret_val; struct netlbl_dom_map *entry; struct netlbl_audit audit_info; + struct lsmblob blob; /* Only the kernel is allowed to call this function and the only time * it is called is at bootup before the audit subsystem is reporting * messages so don't worry to much about these values. */ - security_task_getsecid(current, &audit_info.secid); + security_task_getsecid(current, &blob); + /* scaffolding until audit_info.secid is converted */ + audit_info.secid = blob.secid[0]; audit_info.loginuid = GLOBAL_ROOT_UID; audit_info.sessionid = 0; diff --git a/net/netlabel/netlabel_user.h b/net/netlabel/netlabel_user.h index 3c67afce64f1..438b5db6c714 100644 --- a/net/netlabel/netlabel_user.h +++ b/net/netlabel/netlabel_user.h @@ -34,7 +34,11 @@ static inline void netlbl_netlink_auditinfo(struct sk_buff *skb, struct netlbl_audit *audit_info) { - security_task_getsecid(current, &audit_info->secid); + struct lsmblob blob; + + security_task_getsecid(current, &blob); + /* scaffolding until secid is converted */ + audit_info->secid = blob.secid[0]; audit_info->loginuid = audit_get_loginuid(current); audit_info->sessionid = audit_get_sessionid(current); } diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 136ae4e0ee92..7288a574459b 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -48,11 +48,13 @@ bool is_ima_appraise_enabled(void) int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func) { u32 secid; + struct lsmblob blob; if (!ima_appraise) return 0; - security_task_getsecid(current, &secid); + security_task_getsecid(current, &blob); + lsmblob_secid(&blob, &secid); return ima_match_policy(inode, current_cred(), secid, func, mask, IMA_APPRAISE | IMA_HASH, NULL, NULL); } diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 60027c643ecd..cac654c2faaf 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -380,12 +380,13 @@ static int process_measurement(struct file *file, const struct cred *cred, */ int ima_file_mmap(struct file *file, unsigned long prot) { - u32 secid; + struct lsmblob blob; if (file && (prot & PROT_EXEC)) { - security_task_getsecid(current, &secid); - return process_measurement(file, current_cred(), secid, NULL, - 0, MAY_EXEC, MMAP_CHECK); + security_task_getsecid(current, &blob); + /* scaffolding - until process_measurement changes */ + return process_measurement(file, current_cred(), blob.secid[0], + NULL, 0, MAY_EXEC, MMAP_CHECK); } return 0; @@ -408,10 +409,12 @@ int ima_bprm_check(struct linux_binprm *bprm) { int ret; u32 secid; + struct lsmblob blob; - security_task_getsecid(current, &secid); - ret = process_measurement(bprm->file, current_cred(), secid, NULL, 0, - MAY_EXEC, BPRM_CHECK); + security_task_getsecid(current, &blob); + /* scaffolding until process_measurement changes */ + ret = process_measurement(bprm->file, current_cred(), blob.secid[0], + NULL, 0, MAY_EXEC, BPRM_CHECK); if (ret) return ret; @@ -432,10 +435,11 @@ int ima_bprm_check(struct linux_binprm *bprm) */ int ima_file_check(struct file *file, int mask) { - u32 secid; + struct lsmblob blob; - security_task_getsecid(current, &secid); - return process_measurement(file, current_cred(), secid, NULL, 0, + security_task_getsecid(current, &blob); + /* scaffolding until process_measurement changes */ + return process_measurement(file, current_cred(), blob.secid[0], NULL, 0, mask & (MAY_READ | MAY_WRITE | MAY_EXEC | MAY_APPEND), FILE_CHECK); } @@ -544,7 +548,7 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size, enum kernel_read_file_id read_id) { enum ima_hooks func; - u32 secid; + struct lsmblob blob; if (!file && read_id == READING_FIRMWARE) { if ((ima_appraise & IMA_APPRAISE_FIRMWARE) && @@ -566,9 +570,10 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size, } func = read_idmap[read_id] ?: FILE_CHECK; - security_task_getsecid(current, &secid); - return process_measurement(file, current_cred(), secid, buf, size, - MAY_READ, func); + security_task_getsecid(current, &blob); + /* scaffolding until process_measurement changes */ + return process_measurement(file, current_cred(), blob.secid[0], buf, + size, MAY_READ, func); } /** @@ -687,11 +692,13 @@ static void process_buffer_measurement(const void *buf, int size, void ima_kexec_cmdline(const void *buf, int size) { u32 secid; + struct lsmblob blob; if (buf && size != 0) { - security_task_getsecid(current, &secid); + security_task_getsecid(current, &blob); + /* scaffolding */ process_buffer_measurement(buf, size, "kexec-cmdline", - current_cred(), secid); + current_cred(), blob.secid[0]); } } diff --git a/security/security.c b/security/security.c index b60c6a51f622..e1f216d453bf 100644 --- a/security/security.c +++ b/security/security.c @@ -1700,10 +1700,16 @@ int security_task_getsid(struct task_struct *p) return call_int_hook(task_getsid, 0, p); } -void security_task_getsecid(struct task_struct *p, u32 *secid) +void security_task_getsecid(struct task_struct *p, struct lsmblob *blob) { - *secid = 0; - call_void_hook(task_getsecid, p, secid); + struct security_hook_list *hp; + + lsmblob_init(blob, 0); + hlist_for_each_entry(hp, &security_hook_heads.task_getsecid, list) { + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot)) + continue; + hp->hook.task_getsecid(p, &blob->secid[hp->lsmid->slot]); + } } EXPORT_SYMBOL(security_task_getsecid); From patchwork Wed Nov 13 00:08:58 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11240513 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id C795A13BD for ; Wed, 13 Nov 2019 00:09:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id A7DB421A49 for ; Wed, 13 Nov 2019 00:09:59 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="ffcaCBgt" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727211AbfKMAJ7 (ORCPT ); Tue, 12 Nov 2019 19:09:59 -0500 Received: from sonic306-28.consmr.mail.ne1.yahoo.com ([66.163.189.90]:37594 "EHLO sonic306-28.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727199AbfKMAJ7 (ORCPT ); Tue, 12 Nov 2019 19:09:59 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573603797; bh=IV/8fV3RewhDG+57mk0yypWNQe7gvXfW8jZ3Ya363tw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=ffcaCBgtk6LEqPFLDi6KI7VsE/y7FTHgenROpJzc8o7AC45gwqqFeYYh7ZbHWVfp/qFOFrypKkMkM4QgWTwZQmrF1WVj5A4ubitk9QUD/NxPWIPEeh0twerpbGyIR44/Bqd81DWlxtPk53qfc03IscaPC63Km1Hm64hr601SnjwFQhUVjs2zpWsH64VCuKrbQt7cnwAvRNOM3I6uGpNA3GkPt2QP90Bnfm8rqRUryRob7oRFQGo5LaLxDo9YmnY82MqjvFnbji9MnKCL36HGEFNcXnVpVouoeWzxjJW0YqdveTGs7ug46rjMPO6URvoC4cCpVLWxFqpFmB+v17p9UQ== X-YMail-OSG: mjrhndcVM1mcUIO_IW57vE4_6UFqmlONISQ3zimXfL3EcLSpZXYBLWB0bujfx0q nTEkGbz3.5lxAXNymSQK9mvxY3w9Fgh48qjbdWTX.FbXkXrLej0yWg1m5bsX1S8JCziu0reXx8qR NQjvVdMRNimzgbGi_jqqSp2AiFECfw_a9T90SeEaqX1YZufIO9dovIlmceFw8zKzBWRA8lAx9jmt wSUnJ710b82s.zVXke0sC00ioYIeqF6xRCbkYjmlBB_ApzutjhH1Wp6_bjbyo95d1J3FGmX1PPPZ cBTuRQii.wrk_GX8P3v.N84TXBJB56kzsXc9PIXqhHNOLmMHHJnI1Bnsa0HHxEgOHgsonCNgqQM9 h3VNyHc1SQWuPM4dlvY2RvdAXZFL_WRybNWO_7P2dxb4ln4mrLCLsosngGfDB0kugoDMBVrKVpbt IsHAtei1BatThmZ7kiCQBIVVXoo_ZVABp1njVYENOMeWj8QysiM_rrnZVW1RyS14zUz_Ulv0zCPU 0ccJFnUIKYOa2EbrEaMnNOh_1ASFqwTrB1XwOjYYMaPhgWdctLKrQIDkrkRl2s_Fl16U_uqpOJNZ EB3qLH9zydlsbrc7nKWY02GA.dfW52NRSpZldl4.yEfcupKo2VShh0XNs6zslTjCi0xyPLThgFGp Y1Qhf1yowhw46EG1_ExpoY9OTbi6S8enc3BbGCztutUOlEwpAL0BEKln_nMJGuI9IWvmdefnQ7qd 5DYMzrxGixZGsX6vPHijkXG7x5HnFxvWxu5V_UohD3SJbfbV3E9kpAS7rv3z2xaRWAGzWWHnnf6C thkjnEmvwE36U0Rn4JnKEuPn0VE_iLqtEkHaN0Vl6Pcu0dZ3klf2RTjCiXfTi3tClkuOeUh1Cyec XsVMe6jiaL3haTZMCAeyQYlAQJXuacT5Pg0C2DdjFqML0Fv0H_41TRyoJ24YqdBPkyyDETRsw6.Y DrsfM9fhk.T.SXgCy3.Bz80PyNPZeox7.66FiJW3Mo1ysdCBheM080m89pw3rXAqSNGEE31pNdsL uZHtO.fDJlf6C6azlHdYxCmVjwauthvHsTD.zGNk_ply7RKPKzOZrcIcVwl5729c6uys2zcF1fuc aax9m4e1d3rWL2ncTrT9v9S2esbi0wjIKxDFuELR9_936KmiWi7usMgRWyxg0vE7j1KD3BJh91Nv tplSMxdssIja1yc7UMq5j3ollu6C_Y03PuQ4iQ2ryEt3Y8DoZ8.COtrLRN.cmmM5amGbPMuHXOVx ZwSkzFCEFymXUZqBqsmuigBX1VGISX5kvC3jucrqTffmbO3hWhkDK9mSWN9zFL5tFv0CNn.ZZH2W 7ovpn7h5c_7P5bHfLKwoo1Zt9cjCn9HPZ3e18dVom.bJnUA1GGwjEPMR4gvp4uO4znFlzupeGXFK DJjK325VTIeEsTjeXBGx8rGx4QyQWyn23ulHVlw-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 00:09:57 +0000 Received: by smtp432.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID a194c842b715663bc900de4e5d395aa8; Wed, 13 Nov 2019 00:09:54 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov, linux-audit@redhat.com, linux-integrity@vger.kernel.org Subject: [PATCH 10/25] LSM: Use lsmblob in security_inode_getsecid Date: Tue, 12 Nov 2019 16:08:58 -0800 Message-Id: <20191113000913.5414-11-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113000913.5414-1-casey@schaufler-ca.com> References: <20191113000913.5414-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Change the security_inode_getsecid() interface to fill in a lsmblob structure instead of a u32 secid. This allows for its callers to gather data from all registered LSMs. Data is provided for IMA and audit. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler cc: linux-audit@redhat.com cc: linux-integrity@vger.kernel.org --- include/linux/security.h | 7 ++++--- kernel/auditsc.c | 6 +++++- security/integrity/ima/ima_policy.c | 4 +--- security/security.c | 11 +++++++++-- 4 files changed, 19 insertions(+), 9 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 67f95a335b5d..a845254fc415 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -407,7 +407,7 @@ int security_inode_killpriv(struct dentry *dentry); int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc); int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags); int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size); -void security_inode_getsecid(struct inode *inode, u32 *secid); +void security_inode_getsecid(struct inode *inode, struct lsmblob *blob); int security_inode_copy_up(struct dentry *src, struct cred **new); int security_inode_copy_up_xattr(const char *name); int security_kernfs_init_security(struct kernfs_node *kn_dir, @@ -922,9 +922,10 @@ static inline int security_inode_listsecurity(struct inode *inode, char *buffer, return 0; } -static inline void security_inode_getsecid(struct inode *inode, u32 *secid) +static inline void security_inode_getsecid(struct inode *inode, + struct lsmblob *blob) { - *secid = 0; + lsmblob_init(blob, 0); } static inline int security_inode_copy_up(struct dentry *src, struct cred **new) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index cccb681ad081..5752e51883d5 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1931,13 +1931,17 @@ static void audit_copy_inode(struct audit_names *name, const struct dentry *dentry, struct inode *inode, unsigned int flags) { + struct lsmblob blob; + name->ino = inode->i_ino; name->dev = inode->i_sb->s_dev; name->mode = inode->i_mode; name->uid = inode->i_uid; name->gid = inode->i_gid; name->rdev = inode->i_rdev; - security_inode_getsecid(inode, &name->osid); + security_inode_getsecid(inode, &blob); + /* scaffolding until osid is updated */ + name->osid = blob.secid[0]; if (flags & AUDIT_INODE_NOEVAL) { name->fcap_ver = -1; return; diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 7711cc6a3fe3..c5417045e165 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -413,7 +413,6 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, return false; for (i = 0; i < MAX_LSM_RULES; i++) { int rc = 0; - u32 osid; struct lsmblob blob; if (!rule->lsm[i].rule) @@ -423,8 +422,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, case LSM_OBJ_USER: case LSM_OBJ_ROLE: case LSM_OBJ_TYPE: - security_inode_getsecid(inode, &osid); - lsmblob_init(&blob, osid); + security_inode_getsecid(inode, &blob); rc = security_filter_rule_match(&blob, rule->lsm[i].type, Audit_equal, diff --git a/security/security.c b/security/security.c index e1f216d453bf..bd279a24adfc 100644 --- a/security/security.c +++ b/security/security.c @@ -1386,9 +1386,16 @@ int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer } EXPORT_SYMBOL(security_inode_listsecurity); -void security_inode_getsecid(struct inode *inode, u32 *secid) +void security_inode_getsecid(struct inode *inode, struct lsmblob *blob) { - call_void_hook(inode_getsecid, inode, secid); + struct security_hook_list *hp; + + lsmblob_init(blob, 0); + hlist_for_each_entry(hp, &security_hook_heads.inode_getsecid, list) { + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot)) + continue; + hp->hook.inode_getsecid(inode, &blob->secid[hp->lsmid->slot]); + } } int security_inode_copy_up(struct dentry *src, struct cred **new) From patchwork Wed Nov 13 00:08:59 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11240521 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id BB18F18B6 for ; Wed, 13 Nov 2019 00:10:00 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 9B18A2196E for ; Wed, 13 Nov 2019 00:10:00 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="Foz60bTo" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727065AbfKMAKA (ORCPT ); Tue, 12 Nov 2019 19:10:00 -0500 Received: from sonic313-15.consmr.mail.ne1.yahoo.com ([66.163.185.38]:34896 "EHLO sonic313-15.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727210AbfKMAKA (ORCPT ); Tue, 12 Nov 2019 19:10:00 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573603798; bh=HCCg6h+FVGpUDOzChI/0u/Itu+cOitTV+BqJf27OtHM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=Foz60bToLLySd3L+O5FPW4eE5b2d9Y1lsgRYyczX8K+tZfZ6ZDIN3b9V/gGF9dxxkGAoAl31R6MR4bDEzSpAyEg2RcNJ//Nd0PMWWsHug0nSyNrOT0mnjmLJY5ep39Yw1TQgVzjsOgGAzXGB9pSeSbcF50aoqyAiZpYxMMsxru8qxaWurqXK9h1yCeA/aanHK9icTMRscQwQ7HlcmT8URaskZxSwtFZddQVgjwY+HJASy4Js4sO51QGhsmTdCCzoxrmpon/PrGPW8ijuBBvW1WfwKa2Y1ZmKveaeZiO0bQsSA7ie0WsMYiOQHeZG1I+M0378829dTk3hR3rNQPwj2Q== X-YMail-OSG: mWkj9uoVM1kc0s7XxG.KGm0WxzQEYEf9lg28DY6dyVKXRFuWQwQFDC.Bi1tZ7l7 FFIhIBP6PBLUn1vk1MYkQBEi2XA8pB68BgL1AjnhqEjuaSN6pC8VZ2u29Nahz9fGqy50SIZse2B4 k3SExeTXP.4lOYCnDCfIoS3zaPQbCE.usLl6WJuXbluYGRpZqZHXymZFSPTCnbwEdAGHo.gBDrUg .cuk63k9F9c4hCD8DR.hkPrQJhyWXKaNbzbUL85Wcaq_mExUKFOMJWTcXpTfbQRN4DaM6LcScs3n IcntEdjDK0L5UAettO4llKPJEP6wGHzXWL4XqHq9s3Ut_oNVKCNLtfA2Lv3BD7gHlbEHi0qTTRV0 BDwG2qe4TuFLhE.JFFA9qmTQ_0qjtNzlU1cyMFAwNhOBmAbeX11BaW3EfD46VS677QKGa5m4HYw0 Z.z2UUAoAj1122LhSzRXTd8JBuD8SCIGCWeT.YTNbE9Fgcn_LdthaXghxrTccVCogBPcvphWGSYp iAuQ9pC9uqon8h2MxnYDAj.xJpoqXHNk0WHRfX_trPTt69EaTzDa4xNbzNkT4AtsT2Pxqju63zWQ 1orior9T296Ii9Y3OD2moXvoZ0qOhoB0q4QMQHeB12C4p7.Wvzur.Y63aYPZZ11Y_9SGJ0ZVqHl3 xDMMjIm9uSi.Z.yyLXdgrMl1roEbvlKrWGy4Y_5xjNYh5jklklTTpoLqDf3M8oCT9VeyVUhB2O9N 7chXFSQ2SNsPqJtXm7BcpbjBob_k2YL2yH2bNqEURWXq2ABHr8lxbnv2MYAYhtmArBNU4jx0Anb0 ORURhC4UQNhrYm5cmUvVDkuwXlLbOz_oyYEUqW7GLad8LvnjsJzEeqhExqUChraIMcrt3_daEocd OHJOqLbhj4HK1X4INwvwaWcPRVAz7NeZtcTjGAXsYKWCMpoSMlSVhK7wyZB0_7Z596T8NXENZLdO bFBU1VnD8oKfyRqKiWJj7sSAeD47ZS9Nlo4TCSkeWglHYp55zjJR8947Jf0Yv2L4bUZABhxBZEEQ gOxb._5i3EYwSsws2nqmqF382yl8ckC37rb0mU49HbFWJCuBhWQG5rWTO7VPeQF4v5y9mb2PnmO3 6KTXEZTFPajNZJCfMzT8m3e7PVqhqY.j70rYwVygaUOCCmjAYY.0KhM3efH4AvdF6Tg5lYBBjVKr D27CJVZ501.GgURM9TwXpPShe346FZJ1H7NxeUrpCCONLHMplUcQPFEAQTGBz5GbKk5dTyAnCXI6 5AF8R6.d3l7F8CyVfFdayt6op0ec8cTzTXVgM8LGzwUcx7yUrOhPyeJ7c7Kdlbg40Mnwo50suZ7O 8fbpOEgM9Bt5cq5wkceI4zQGzOAiNFBn9IJ8J1BG.9iFnEBq.7famBWm2ludp_l.10e3QCNGI_p. 8eir9oBw3dhHgCEH7rJNJrU5RXZ7P6g9f Received: from sonic.gate.mail.ne1.yahoo.com by sonic313.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 00:09:58 +0000 Received: by smtp432.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID a194c842b715663bc900de4e5d395aa8; Wed, 13 Nov 2019 00:09:56 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov, linux-audit@redhat.com, linux-integrity@vger.kernel.org Subject: [PATCH 11/25] LSM: Use lsmblob in security_cred_getsecid Date: Tue, 12 Nov 2019 16:08:59 -0800 Message-Id: <20191113000913.5414-12-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113000913.5414-1-casey@schaufler-ca.com> References: <20191113000913.5414-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Change the security_cred_getsecid() interface to fill in a lsmblob instead of a u32 secid. The associated data elements in the audit sub-system are changed from a secid to a lsmblob to accommodate multiple possible LSM audit users. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler cc: linux-audit@redhat.com cc: linux-integrity@vger.kernel.org --- include/linux/security.h | 2 +- kernel/audit.c | 19 +++++++----------- kernel/audit.h | 5 +++-- kernel/auditsc.c | 33 +++++++++++-------------------- security/integrity/ima/ima_main.c | 8 ++++---- security/security.c | 12 ++++++++--- 6 files changed, 36 insertions(+), 43 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index a845254fc415..f7bc7aef95cb 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -434,7 +434,7 @@ int security_cred_alloc_blank(struct cred *cred, gfp_t gfp); void security_cred_free(struct cred *cred); int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp); void security_transfer_creds(struct cred *new, const struct cred *old); -void security_cred_getsecid(const struct cred *c, u32 *secid); +void security_cred_getsecid(const struct cred *c, struct lsmblob *blob); int security_kernel_act_as(struct cred *new, struct lsmblob *blob); int security_kernel_create_files_as(struct cred *new, struct inode *inode); int security_kernel_module_request(char *kmod_name); diff --git a/kernel/audit.c b/kernel/audit.c index fd29186ae977..ba9f78e36d1e 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -124,7 +124,7 @@ static u32 audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME; /* The identity of the user shutting down the audit system. */ kuid_t audit_sig_uid = INVALID_UID; pid_t audit_sig_pid = -1; -u32 audit_sig_sid = 0; +struct lsmblob audit_sig_lsm; /* Records can be lost in several ways: 0) [suppressed in audit_alloc] @@ -1416,23 +1416,21 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) } case AUDIT_SIGNAL_INFO: len = 0; - if (audit_sig_sid) { - struct lsmblob blob; - - lsmblob_init(&blob, audit_sig_sid); - err = security_secid_to_secctx(&blob, &ctx, &len); + if (lsmblob_is_set(&audit_sig_lsm)) { + err = security_secid_to_secctx(&audit_sig_lsm, &ctx, + &len); if (err) return err; } sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL); if (!sig_data) { - if (audit_sig_sid) + if (lsmblob_is_set(&audit_sig_lsm)) security_release_secctx(ctx, len); return -ENOMEM; } sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid); sig_data->pid = audit_sig_pid; - if (audit_sig_sid) { + if (lsmblob_is_set(&audit_sig_lsm)) { memcpy(sig_data->ctx, ctx, len); security_release_secctx(ctx, len); } @@ -2274,7 +2272,6 @@ int audit_set_loginuid(kuid_t loginuid) int audit_signal_info(int sig, struct task_struct *t) { kuid_t uid = current_uid(), auid; - struct lsmblob blob; if (auditd_test_task(t) && (sig == SIGTERM || sig == SIGHUP || @@ -2285,9 +2282,7 @@ int audit_signal_info(int sig, struct task_struct *t) audit_sig_uid = auid; else audit_sig_uid = uid; - security_task_getsecid(current, &blob); - /* scaffolding until audit_sig_sid is converted */ - audit_sig_sid = blob.secid[0]; + security_task_getsecid(current, &audit_sig_lsm); } return audit_signal_info_syscall(t); diff --git a/kernel/audit.h b/kernel/audit.h index 6fb7160412d4..af9bc09e656c 100644 --- a/kernel/audit.h +++ b/kernel/audit.h @@ -9,6 +9,7 @@ #include #include #include +#include #include #include @@ -134,7 +135,7 @@ struct audit_context { kuid_t target_auid; kuid_t target_uid; unsigned int target_sessionid; - u32 target_sid; + struct lsmblob target_lsm; char target_comm[TASK_COMM_LEN]; struct audit_tree_refs *trees, *first_trees; @@ -329,7 +330,7 @@ extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len); extern pid_t audit_sig_pid; extern kuid_t audit_sig_uid; -extern u32 audit_sig_sid; +extern struct lsmblob audit_sig_lsm; extern int audit_filter(int msgtype, unsigned int listtype); diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 5752e51883d5..c1e3ac8eb1ad 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -112,7 +112,7 @@ struct audit_aux_data_pids { kuid_t target_auid[AUDIT_AUX_PIDS]; kuid_t target_uid[AUDIT_AUX_PIDS]; unsigned int target_sessionid[AUDIT_AUX_PIDS]; - u32 target_sid[AUDIT_AUX_PIDS]; + struct lsmblob target_lsm[AUDIT_AUX_PIDS]; char target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN]; int pid_count; }; @@ -957,14 +957,14 @@ static inline void audit_free_context(struct audit_context *context) } static int audit_log_pid_context(struct audit_context *context, pid_t pid, - kuid_t auid, kuid_t uid, unsigned int sessionid, - u32 sid, char *comm) + kuid_t auid, kuid_t uid, + unsigned int sessionid, + struct lsmblob *blob, char *comm) { struct audit_buffer *ab; char *ctx = NULL; u32 len; int rc = 0; - struct lsmblob blob; ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID); if (!ab) @@ -973,9 +973,8 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid, audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid, from_kuid(&init_user_ns, auid), from_kuid(&init_user_ns, uid), sessionid); - if (sid) { - lsmblob_init(&blob, sid); - if (security_secid_to_secctx(&blob, &ctx, &len)) { + if (lsmblob_is_set(blob)) { + if (security_secid_to_secctx(blob, &ctx, &len)) { audit_log_format(ab, " obj=(none)"); rc = 1; } else { @@ -1546,7 +1545,7 @@ static void audit_log_exit(void) axs->target_auid[i], axs->target_uid[i], axs->target_sessionid[i], - axs->target_sid[i], + &axs->target_lsm[i], axs->target_comm[i])) call_panic = 1; } @@ -1555,7 +1554,7 @@ static void audit_log_exit(void) audit_log_pid_context(context, context->target_pid, context->target_auid, context->target_uid, context->target_sessionid, - context->target_sid, context->target_comm)) + &context->target_lsm, context->target_comm)) call_panic = 1; if (context->pwd.dentry && context->pwd.mnt) { @@ -1733,7 +1732,7 @@ void __audit_syscall_exit(int success, long return_code) context->aux = NULL; context->aux_pids = NULL; context->target_pid = 0; - context->target_sid = 0; + lsmblob_init(&context->target_lsm, 0); context->sockaddr_len = 0; context->type = 0; context->fds[0] = -1; @@ -2384,15 +2383,12 @@ int __audit_sockaddr(int len, void *a) void __audit_ptrace(struct task_struct *t) { struct audit_context *context = audit_context(); - struct lsmblob blob; context->target_pid = task_tgid_nr(t); context->target_auid = audit_get_loginuid(t); context->target_uid = task_uid(t); context->target_sessionid = audit_get_sessionid(t); - security_task_getsecid(t, &blob); - /* scaffolding - until target_sid is converted */ - context->target_sid = blob.secid[0]; + security_task_getsecid(t, &context->target_lsm); memcpy(context->target_comm, t->comm, TASK_COMM_LEN); } @@ -2408,7 +2404,6 @@ int audit_signal_info_syscall(struct task_struct *t) struct audit_aux_data_pids *axp; struct audit_context *ctx = audit_context(); kuid_t t_uid = task_uid(t); - struct lsmblob blob; if (!audit_signals || audit_dummy_context()) return 0; @@ -2420,9 +2415,7 @@ int audit_signal_info_syscall(struct task_struct *t) ctx->target_auid = audit_get_loginuid(t); ctx->target_uid = t_uid; ctx->target_sessionid = audit_get_sessionid(t); - security_task_getsecid(t, &blob); - /* scaffolding until target_sid is converted */ - ctx->target_sid = blob.secid[0]; + security_task_getsecid(t, &ctx->target_lsm); memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN); return 0; } @@ -2443,9 +2436,7 @@ int audit_signal_info_syscall(struct task_struct *t) axp->target_auid[axp->pid_count] = audit_get_loginuid(t); axp->target_uid[axp->pid_count] = t_uid; axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t); - security_task_getsecid(t, &blob); - /* scaffolding until target_sid is converted */ - axp->target_sid[axp->pid_count] = blob.secid[0]; + security_task_getsecid(t, &axp->target_lsm[axp->pid_count]); memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN); axp->pid_count++; diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index cac654c2faaf..305a00a6b087 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -408,7 +408,6 @@ int ima_file_mmap(struct file *file, unsigned long prot) int ima_bprm_check(struct linux_binprm *bprm) { int ret; - u32 secid; struct lsmblob blob; security_task_getsecid(current, &blob); @@ -418,9 +417,10 @@ int ima_bprm_check(struct linux_binprm *bprm) if (ret) return ret; - security_cred_getsecid(bprm->cred, &secid); - return process_measurement(bprm->file, bprm->cred, secid, NULL, 0, - MAY_EXEC, CREDS_CHECK); + security_cred_getsecid(bprm->cred, &blob); + /* scaffolding until process_measurement changes */ + return process_measurement(bprm->file, bprm->cred, blob.secid[0], + NULL, 0, MAY_EXEC, CREDS_CHECK); } /** diff --git a/security/security.c b/security/security.c index bd279a24adfc..3aba440624f9 100644 --- a/security/security.c +++ b/security/security.c @@ -1615,10 +1615,16 @@ void security_transfer_creds(struct cred *new, const struct cred *old) call_void_hook(cred_transfer, new, old); } -void security_cred_getsecid(const struct cred *c, u32 *secid) +void security_cred_getsecid(const struct cred *c, struct lsmblob *blob) { - *secid = 0; - call_void_hook(cred_getsecid, c, secid); + struct security_hook_list *hp; + + lsmblob_init(blob, 0); + hlist_for_each_entry(hp, &security_hook_heads.cred_getsecid, list) { + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot)) + continue; + hp->hook.cred_getsecid(c, &blob->secid[hp->lsmid->slot]); + } } EXPORT_SYMBOL(security_cred_getsecid); From patchwork Wed Nov 13 00:09:00 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11240531 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 2099E1850 for ; Wed, 13 Nov 2019 00:10:09 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id EC4E621A49 for ; Wed, 13 Nov 2019 00:10:08 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="XAxAW2HC" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726977AbfKMAKI (ORCPT ); Tue, 12 Nov 2019 19:10:08 -0500 Received: from sonic315-27.consmr.mail.ne1.yahoo.com ([66.163.190.153]:34510 "EHLO sonic315-27.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727104AbfKMAKI (ORCPT ); Tue, 12 Nov 2019 19:10:08 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573603806; bh=FYxlMd2GXASX0hT4D9+5hQ2oTZcSBQP8pqujkxGfOEQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=XAxAW2HCx1FTJDmWqUOBKx/wZZvwhseUFVJz2aqsm+8Wb1F93YI3NJsIYeqSrj6nk4pA+uuAZUHDRXb4pUJoKMxSZGIT1IxUJS8dg88L/W99uv1Qi34weEp9fDh+VNoiQhD31P3BKfnnVZwr9aRsafIil8U+8PNlxytBVWwS53P0rX5g1PJyScGPx0MoL0P1oedm3dCk7QO9Y2bcdcxnjOvRwQEKTOocfbck22kzcyePiBANuHoOKXbjR7EUr4x92uVZtFsDUUghXXATu6lDt5DCxAgKjahVC0N1vLimbYzcGmgAQu4Bs8ET1JTBTNBNiPENehLLj+6A3Bx1OfqV2w== X-YMail-OSG: x43czz0VM1l83mN5x91mJPQKY4DPumKxKtVIKgrBwoDqctR0f8IXjrOTaEixBJt qB9mSp2lPPH_qmKPAV3VRc0Ny5j37e.om1EyKIOsFxuWRgWVoUv4JUFVBaA9CJ9nYMADVvpVrI2L Ww4NXpq2AsjlsqOxnZuMKlesRGR1_OePDpJgsAEG2sjAW.5lVPMttINhMphN48RHNIk_frtptgoL VskFLaixiZUQ.wD7EoSyfM.WXomgb_OcRuzGPidX08apx7hZ64_gHotbaGRtEvTxMT6ccfQBhSBJ OZwLTwniHZ6N06USv.abRwBPwokh563rnM8MojYyqtXIwA9VjKQ4WVZOscwP7y9Rb4hEry6sWEXm G7MtEGjIxES38T0ednvO.ov4BU78zLVCeHOvN_SpGdCPrHWzxzSimJEpI8XrWT5nwJMdH0dxCjP_ hs_cG4P37gH7j745DhTQTW26cZHp5ugHRVQn3GC2MM0RpteWXeShAscThPcXhhdyLHws1v1PF2XC mSw9ZqUrIKBF6X3nKeuGo6jxI_RoI.a9sSrve4oFKgzpYBNJ.Sz87Ztp4UUH5g0tG6uQezE0aDZL edAFPg39GrmtgyUn2cFWvGddBW8ROxT.gG1EmPbbK16m.8XATO18z1zIzqhglMc_U7QFeYShrbyw bwZHttOSt21KPEzTsx8IyA1YcORKFUnv5btxRdXoIUWbyecuNe9zKLnPKv6UjIHDpfLGyCO3Aj6k wxb7k5GD.HJfy0KyGrviyVmQBHGX9vezddVj7DLqL_VBuq.d7rJ7WUwOmCuZ2YGNwTbpeB065sRR O2uCnghFTIMQU8iAgVRRPldJAj.G45QGK0KfBS4TAPuexl8S7FhdbTrZYbg99__S3JyiNfVJnEg. 7B4rDciM0K49dt1E_WRHBw3K2CyM58QErhSe49vz5Nyx89iWddKqlV3tHmFfAIqyanHvD7oPwQ9w ncqJbuBPjCksz.a7LJhr1Lgcbke2gKLx0JWzQ22xpVSFNwoxU_lPS9Fxf0G1vatSrqza4ZBVg_3m hsZx5Cn1FFRVIdJkIiyZ_5If9DcXBP59uogdRbQvoz9wf2poz1X_XzdhY0EZetNUrzmFXwtJlw7a 9RDTVK.Vw.Z.T84CezQEc5nhriavyTZtgW7.FQ430NA.SQ8BzUXDC9u3D.AopZKDtNQGNRnlhioh XbEjBrcQKyen.wNixvx8wnv_khmth5ybPwlIa1tJHtZfdnqSU5MtgMKscdHNfflkwRr2Z0rhnnLY pL8rTYFkqWu9X1idbayb_WDA.ejZGkZa5vIPPiSLobA3xe8mlFoHUyKjqJkL9iozNrwXo6uyJhOA E_X6DBEwkt4tjR75WNgKsr2OS5fpcSWrmM4ajkXp1JJaIOY159iFqRPqWGMUpGiW.oFao50p2rOy LB7LmCxiTYECj_gGwT8sUTBNilK5oRYRk309g Received: from sonic.gate.mail.ne1.yahoo.com by sonic315.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 00:10:06 +0000 Received: by smtp428.mail.ne1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 93aa6347d771200c823c70ba6657789f; Wed, 13 Nov 2019 00:10:04 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov, linux-audit@redhat.com, linux-integrity@vger.kernel.org Subject: [PATCH 12/25] IMA: Change internal interfaces to use lsmblobs Date: Tue, 12 Nov 2019 16:09:00 -0800 Message-Id: <20191113000913.5414-13-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113000913.5414-1-casey@schaufler-ca.com> References: <20191113000913.5414-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org The IMA interfaces ima_get_action() and ima_match_policy() call LSM functions that use lsmblobs. Change the IMA functions to pass the lsmblob to be compatible with the LSM functions. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler cc: linux-audit@redhat.com cc: linux-integrity@vger.kernel.org --- security/integrity/ima/ima.h | 11 ++++---- security/integrity/ima/ima_api.c | 10 +++---- security/integrity/ima/ima_appraise.c | 4 +-- security/integrity/ima/ima_main.c | 38 +++++++++++---------------- security/integrity/ima/ima_policy.c | 12 ++++----- 5 files changed, 34 insertions(+), 41 deletions(-) diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 5bcd6011ef8c..4226622f50b1 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -205,9 +205,9 @@ extern const char *const func_tokens[]; struct modsig; /* LIM API function definitions */ -int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid, - int mask, enum ima_hooks func, int *pcr, - struct ima_template_desc **template_desc); +int ima_get_action(struct inode *inode, const struct cred *cred, + struct lsmblob *blob, int mask, enum ima_hooks func, + int *pcr, struct ima_template_desc **template_desc); int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func); int ima_collect_measurement(struct integrity_iint_cache *iint, struct file *file, void *buf, loff_t size, @@ -229,8 +229,9 @@ void ima_free_template_entry(struct ima_template_entry *entry); const char *ima_d_path(const struct path *path, char **pathbuf, char *filename); /* IMA policy related functions */ -int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid, - enum ima_hooks func, int mask, int flags, int *pcr, +int ima_match_policy(struct inode *inode, const struct cred *cred, + struct lsmblob *blob, enum ima_hooks func, int mask, + int flags, int *pcr, struct ima_template_desc **template_desc); void ima_init_policy(void); void ima_update_policy(void); diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c index 610759fe63b8..1ab769fa7df6 100644 --- a/security/integrity/ima/ima_api.c +++ b/security/integrity/ima/ima_api.c @@ -163,7 +163,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename, * ima_get_action - appraise & measure decision based on policy. * @inode: pointer to inode to measure * @cred: pointer to credentials structure to validate - * @secid: secid of the task being validated + * @blob: LSM data of the task being validated * @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC, * MAY_APPEND) * @func: caller identifier @@ -181,15 +181,15 @@ void ima_add_violation(struct file *file, const unsigned char *filename, * Returns IMA_MEASURE, IMA_APPRAISE mask. * */ -int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid, - int mask, enum ima_hooks func, int *pcr, - struct ima_template_desc **template_desc) +int ima_get_action(struct inode *inode, const struct cred *cred, + struct lsmblob *blob, int mask, enum ima_hooks func, + int *pcr, struct ima_template_desc **template_desc) { int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE | IMA_HASH; flags &= ima_policy_flag; - return ima_match_policy(inode, cred, secid, func, mask, flags, pcr, + return ima_match_policy(inode, cred, blob, func, mask, flags, pcr, template_desc); } diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 7288a574459b..bc04c6f4bb20 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -47,15 +47,13 @@ bool is_ima_appraise_enabled(void) */ int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func) { - u32 secid; struct lsmblob blob; if (!ima_appraise) return 0; security_task_getsecid(current, &blob); - lsmblob_secid(&blob, &secid); - return ima_match_policy(inode, current_cred(), secid, func, mask, + return ima_match_policy(inode, current_cred(), &blob, func, mask, IMA_APPRAISE | IMA_HASH, NULL, NULL); } diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 305a00a6b087..a8e7e11b1c84 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -190,8 +190,8 @@ void ima_file_free(struct file *file) } static int process_measurement(struct file *file, const struct cred *cred, - u32 secid, char *buf, loff_t size, int mask, - enum ima_hooks func) + struct lsmblob *blob, char *buf, loff_t size, + int mask, enum ima_hooks func) { struct inode *inode = file_inode(file); struct integrity_iint_cache *iint = NULL; @@ -214,7 +214,7 @@ static int process_measurement(struct file *file, const struct cred *cred, * bitmask based on the appraise/audit/measurement policy. * Included is the appraise submask. */ - action = ima_get_action(inode, cred, secid, mask, func, &pcr, + action = ima_get_action(inode, cred, blob, mask, func, &pcr, &template_desc); violation_check = ((func == FILE_CHECK || func == MMAP_CHECK) && (ima_policy_flag & IMA_MEASURE)); @@ -384,8 +384,7 @@ int ima_file_mmap(struct file *file, unsigned long prot) if (file && (prot & PROT_EXEC)) { security_task_getsecid(current, &blob); - /* scaffolding - until process_measurement changes */ - return process_measurement(file, current_cred(), blob.secid[0], + return process_measurement(file, current_cred(), &blob, NULL, 0, MAY_EXEC, MMAP_CHECK); } @@ -411,16 +410,14 @@ int ima_bprm_check(struct linux_binprm *bprm) struct lsmblob blob; security_task_getsecid(current, &blob); - /* scaffolding until process_measurement changes */ - ret = process_measurement(bprm->file, current_cred(), blob.secid[0], - NULL, 0, MAY_EXEC, BPRM_CHECK); + ret = process_measurement(bprm->file, current_cred(), &blob, NULL, 0, + MAY_EXEC, BPRM_CHECK); if (ret) return ret; security_cred_getsecid(bprm->cred, &blob); - /* scaffolding until process_measurement changes */ - return process_measurement(bprm->file, bprm->cred, blob.secid[0], - NULL, 0, MAY_EXEC, CREDS_CHECK); + return process_measurement(bprm->file, bprm->cred, &blob, NULL, 0, + MAY_EXEC, CREDS_CHECK); } /** @@ -438,8 +435,7 @@ int ima_file_check(struct file *file, int mask) struct lsmblob blob; security_task_getsecid(current, &blob); - /* scaffolding until process_measurement changes */ - return process_measurement(file, current_cred(), blob.secid[0], NULL, 0, + return process_measurement(file, current_cred(), &blob, NULL, 0, mask & (MAY_READ | MAY_WRITE | MAY_EXEC | MAY_APPEND), FILE_CHECK); } @@ -571,9 +567,8 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size, func = read_idmap[read_id] ?: FILE_CHECK; security_task_getsecid(current, &blob); - /* scaffolding until process_measurement changes */ - return process_measurement(file, current_cred(), blob.secid[0], buf, - size, MAY_READ, func); + return process_measurement(file, current_cred(), &blob, buf, size, + MAY_READ, func); } /** @@ -632,13 +627,14 @@ int ima_load_data(enum kernel_load_data_id id) * @size: size of buffer(in bytes). * @eventname: event name to be used for the buffer entry. * @cred: a pointer to a credentials structure for user validation. - * @secid: the secid of the task to be validated. + * @blob: the LSM data of the task to be validated. * * Based on policy, the buffer is measured into the ima log. */ static void process_buffer_measurement(const void *buf, int size, const char *eventname, - const struct cred *cred, u32 secid) + const struct cred *cred, + struct lsmblob *blob) { int ret = 0; struct ima_template_entry *entry = NULL; @@ -656,7 +652,7 @@ static void process_buffer_measurement(const void *buf, int size, int pcr = CONFIG_IMA_MEASURE_PCR_IDX; int action = 0; - action = ima_get_action(NULL, cred, secid, 0, KEXEC_CMDLINE, &pcr, + action = ima_get_action(NULL, cred, blob, 0, KEXEC_CMDLINE, &pcr, &template_desc); if (!(action & IMA_MEASURE)) return; @@ -691,14 +687,12 @@ static void process_buffer_measurement(const void *buf, int size, */ void ima_kexec_cmdline(const void *buf, int size) { - u32 secid; struct lsmblob blob; if (buf && size != 0) { security_task_getsecid(current, &blob); - /* scaffolding */ process_buffer_measurement(buf, size, "kexec-cmdline", - current_cred(), blob.secid[0]); + current_cred(), &blob); } } diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index c5417045e165..e863c0d0f9b7 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -368,7 +368,7 @@ int ima_lsm_policy_change(struct notifier_block *nb, unsigned long event, * Returns true on rule match, false on failure. */ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, - const struct cred *cred, u32 secid, + const struct cred *cred, struct lsmblob *blob, enum ima_hooks func, int mask) { int i; @@ -431,7 +431,6 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, case LSM_SUBJ_USER: case LSM_SUBJ_ROLE: case LSM_SUBJ_TYPE: - lsmblob_init(&blob, secid); rc = security_filter_rule_match(&blob, rule->lsm[i].type, Audit_equal, @@ -475,7 +474,7 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func) * @inode: pointer to an inode for which the policy decision is being made * @cred: pointer to a credentials structure for which the policy decision is * being made - * @secid: LSM secid of the task to be validated + * @blob: LSM data of the task to be validated * @func: IMA hook identifier * @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC) * @pcr: set the pcr to extend @@ -488,8 +487,9 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func) * list when walking it. Reads are many orders of magnitude more numerous * than writes so ima_match_policy() is classical RCU candidate. */ -int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid, - enum ima_hooks func, int mask, int flags, int *pcr, +int ima_match_policy(struct inode *inode, const struct cred *cred, + struct lsmblob *blob, enum ima_hooks func, int mask, + int flags, int *pcr, struct ima_template_desc **template_desc) { struct ima_rule_entry *entry; @@ -504,7 +504,7 @@ int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid, if (!(entry->action & actmask)) continue; - if (!ima_match_rules(entry, inode, cred, secid, func, mask)) + if (!ima_match_rules(entry, inode, cred, blob, func, mask)) continue; action |= entry->flags & IMA_ACTION_FLAGS; From patchwork Wed Nov 13 00:09:02 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11240541 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9838D14E5 for ; Wed, 13 Nov 2019 00:10:12 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 67546222BD for ; Wed, 13 Nov 2019 00:10:12 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="fmVHO0LP" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727241AbfKMAKL (ORCPT ); Tue, 12 Nov 2019 19:10:11 -0500 Received: from sonic313-15.consmr.mail.ne1.yahoo.com ([66.163.185.38]:33571 "EHLO sonic313-15.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727224AbfKMAKL (ORCPT ); Tue, 12 Nov 2019 19:10:11 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573603809; bh=3DGCbwEZhoi3LiQz+TuVsl3UVgwOsrdqkddkSVfW48A=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=fmVHO0LPrnMpk7ToUGOIacXoYHQFdCUEX37vMgOqzUZoTt2TaugKilq/27O1biEq9aRCb7LjtUCWTWwcnE/zDDefjaGCqg88A6MS8dLKr4thvrb5fmUOLmCT15kGBg8EIC0akzNTGLOAL74VqApfJGe5s/Y/FLY3egSPw3s3x2PYL3lxdVQ6fORtvz0AfjlOomw9FgughYsTNDBQO3G/UXYxg6TVO9oBQLWOSrhkXCWAY+PWTIB9xkqNKxU1B76fvwm7+hSnA0T++n/VT9oAB0M52vVRRpad95iFP8VJNvzyTIJWjyhOcgvAmtyKWeYYkvTfvt6Y1krW5QMWwiWUDA== X-YMail-OSG: 8KtC9ZMVM1nTzkyQOaFOxS9SSmb7JcPjiogDHcmzm3EefHyHeEKO_xI.0.vf6Vp FcHzcZ_o1tO4mWpIdzC69bYcDN_Zx3D2ygN3mwftF.fCviUv4tz7E6vlDAqn5wnwYUGasycBrwD2 kzxNSwdHTT6cXfLzfsHgdbwaG.2SDGQYRD7oQFb4gVVZUug7hdPU.OPg42xeeLyx.iVZp3xtV_2H CU_P4TkImo.VC3uor5s29fkMFU6.NmzEbUu1i5gZQ43KdR1Jv2d9vNURdxWrYlPlGbm7keT8i2kd 6mr_rNickBwznwizg7syrppRD3LGkJxnigeUVlB93fQcpPIxQK_zsw9uDTAEjgonuidB7qa4Uvve g8QhjR_Ekxgc3JM7CmTbmVzABBrHtECKgjoAubBYL_y4Ho771HVZijh4Dl7Ch_FB6iCWcW62FL0b xs0uBDsEY.25fxMBpiZv_kH...PAvHZAR5upV2cG.FYgHElTA1EkWjspD1yd.c.SKUqg4o1PRAKE skEAfnbK90A_D415f7E9CSGiTVVe6Se_VNJ3BS6_CsPmPP6McMmpkW6bIg69LZNfToiJJSK1wUa6 gXPFeittizuE4EMB4tyvOhQdTI_aeiSvSD.2DxJoOWcqeIE5r40i5_n2l20w1NComYJEkNdrFIMs a_KSrhLrh3ntPy1XXxq87147z9E6VOF5nWLwYdPaKKY3v0_HbhPWiUDrEldtZIAqepLxdvWZ5a3H hg57OdNZIGRIFv4JBmQ1Lq3VAYwNTuM8kNkpZARtt7yVCwBqD6Ap_fN3GAnCw30mvuvMg5BZZEB7 K9V.DONXuRQvQ58CwHwtSpWk7.2LAGnjJ.AMFAIdFVO0NVDVx9ybp00sJgTTNTaysiqM7FcpDgfv c3zHO4NZ36EZSy6S4fnaOG_ULI2McmwsesSFY4lfB57TXBZwclIDYaLrtPGHLfTWnsZOh9p0Gfj5 dNuHAr1LAcYGaJwyjmWiyLNnrF7bXIbxXeTGUUIUxuszBnjVUUCvWfZ1JXrJwDiL70b4WNS_7axG YkWm6i.UYvduKQP8Xb0uVU4uEfPvSatE1Qd18AhfLh9_2axZivFGYgduY1iIsoZHsVfVrNDfeWBc onfuxHsOnUWqwdQ7UFPrAmJASFTLGGI5Qgp81zUxZxBXOgg3LARpI6ROuywFb02v2W0wNa9vSK6N Rpp7eC7DxOvQjehCf73UpG0PlUoeoFG0wrmtFSFJZlRzQ1VHyKDCLUyABiloZrUFQsPbV_d1aVxZ 8_KMfRm5b.twCy1L9G437rXasGSmZVSbUJ84sxQP1fbAiP6ZqHJ65mc1c1gyau25qmuyYc9eThgP .NzNU1cJOmpffmlAclhXlwkaJmHuscfO5BSARACQHEWpB5R9w7admzGt3js.lLH4nm3iW945wNuG O3ZpLxS1ExZDy5OFyEAhsWhnAoh7PRb8tSDt2_0ob Received: from sonic.gate.mail.ne1.yahoo.com by sonic313.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 00:10:09 +0000 Received: by smtp428.mail.ne1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 93aa6347d771200c823c70ba6657789f; Wed, 13 Nov 2019 00:10:07 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov, linux-audit@redhat.com, linux-integrity@vger.kernel.org, netdev@vger.kernel.org Subject: [PATCH 14/25] LSM: Ensure the correct LSM context releaser Date: Tue, 12 Nov 2019 16:09:02 -0800 Message-Id: <20191113000913.5414-15-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113000913.5414-1-casey@schaufler-ca.com> References: <20191113000913.5414-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: linux-integrity-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-integrity@vger.kernel.org Add a new lsmcontext data structure to hold all the information about a "security context", including the string, its size and which LSM allocated the string. The allocation information is necessary because LSMs have different policies regarding the lifecycle of these strings. SELinux allocates and destroys them on each use, whereas Smack provides a pointer to an entry in a list that never goes away. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler cc: linux-audit@redhat.com cc: linux-integrity@vger.kernel.org cc: netdev@vger.kernel.org --- drivers/android/binder.c | 10 +++++-- fs/ceph/xattr.c | 6 +++- fs/nfs/nfs4proc.c | 8 +++-- fs/nfsd/nfs4xdr.c | 7 +++-- include/linux/security.h | 39 +++++++++++++++++++++++-- include/net/scm.h | 5 +++- kernel/audit.c | 14 ++++++--- kernel/auditsc.c | 12 ++++++-- net/ipv4/ip_sockglue.c | 4 ++- net/netfilter/nf_conntrack_netlink.c | 4 ++- net/netfilter/nf_conntrack_standalone.c | 4 ++- net/netfilter/nfnetlink_queue.c | 13 ++++++--- net/netlabel/netlabel_unlabeled.c | 19 +++++++++--- net/netlabel/netlabel_user.c | 4 ++- security/security.c | 18 ++++++++---- security/smack/smack_lsm.c | 14 ++++++--- 16 files changed, 141 insertions(+), 40 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 3a7fcdc8dbe2..49b84b6fafd9 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -2865,6 +2865,7 @@ static void binder_transaction(struct binder_proc *proc, int t_debug_id = atomic_inc_return(&binder_last_id); char *secctx = NULL; u32 secctx_sz = 0; + struct lsmcontext scaff; /* scaffolding */ e = binder_transaction_log_add(&binder_transaction_log); e->debug_id = t_debug_id; @@ -3161,7 +3162,8 @@ static void binder_transaction(struct binder_proc *proc, t->security_ctx = 0; WARN_ON(1); } - security_release_secctx(secctx, secctx_sz); + lsmcontext_init(&scaff, secctx, secctx_sz, 0); + security_release_secctx(&scaff); secctx = NULL; } t->buffer->debug_id = t->debug_id; @@ -3494,8 +3496,10 @@ static void binder_transaction(struct binder_proc *proc, binder_alloc_free_buf(&target_proc->alloc, t->buffer); err_binder_alloc_buf_failed: err_bad_extra_size: - if (secctx) - security_release_secctx(secctx, secctx_sz); + if (secctx) { + lsmcontext_init(&scaff, secctx, secctx_sz, 0); + security_release_secctx(&scaff); + } err_get_secctx_failed: kfree(tcomplete); binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c index cb18ee637cb7..ad501b5cad2c 100644 --- a/fs/ceph/xattr.c +++ b/fs/ceph/xattr.c @@ -1271,12 +1271,16 @@ int ceph_security_init_secctx(struct dentry *dentry, umode_t mode, void ceph_release_acl_sec_ctx(struct ceph_acl_sec_ctx *as_ctx) { +#ifdef CONFIG_CEPH_FS_SECURITY_LABEL + struct lsmcontext scaff; /* scaffolding */ +#endif #ifdef CONFIG_CEPH_FS_POSIX_ACL posix_acl_release(as_ctx->acl); posix_acl_release(as_ctx->default_acl); #endif #ifdef CONFIG_CEPH_FS_SECURITY_LABEL - security_release_secctx(as_ctx->sec_ctx, as_ctx->sec_ctxlen); + lsmcontext_init(&scaff, as_ctx->sec_ctx, as_ctx->sec_ctxlen, 0); + security_release_secctx(&scaff); #endif if (as_ctx->pagelist) ceph_pagelist_release(as_ctx->pagelist); diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c index caacf5e7f5e1..74e9f4b7cc07 100644 --- a/fs/nfs/nfs4proc.c +++ b/fs/nfs/nfs4proc.c @@ -131,8 +131,12 @@ nfs4_label_init_security(struct inode *dir, struct dentry *dentry, static inline void nfs4_label_release_security(struct nfs4_label *label) { - if (label) - security_release_secctx(label->label, label->len); + struct lsmcontext scaff; /* scaffolding */ + + if (label) { + lsmcontext_init(&scaff, label->label, label->len, 0); + security_release_secctx(&scaff); + } } static inline u32 *nfs4_bitmask(struct nfs_server *server, struct nfs4_label *label) { diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c index 533d0fc3c96b..b17aad082bde 100644 --- a/fs/nfsd/nfs4xdr.c +++ b/fs/nfsd/nfs4xdr.c @@ -2421,6 +2421,7 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp, int err; struct nfs4_acl *acl = NULL; #ifdef CONFIG_NFSD_V4_SECURITY_LABEL + struct lsmcontext scaff; /* scaffolding */ void *context = NULL; int contextlen; #endif @@ -2923,8 +2924,10 @@ nfsd4_encode_fattr(struct xdr_stream *xdr, struct svc_fh *fhp, out: #ifdef CONFIG_NFSD_V4_SECURITY_LABEL - if (context) - security_release_secctx(context, contextlen); + if (context) { + lsmcontext_init(&scaff, context, contextlen, 0); /*scaffolding*/ + security_release_secctx(&scaff); + } #endif /* CONFIG_NFSD_V4_SECURITY_LABEL */ kfree(acl); if (tempfh) { diff --git a/include/linux/security.h b/include/linux/security.h index f7bc7aef95cb..9bb11d9f1348 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -126,6 +126,41 @@ enum lockdown_reason { LOCKDOWN_CONFIDENTIALITY_MAX, }; +/* + * A "security context" is the text representation of + * the information used by LSMs. + * This structure contains the string, its length, and which LSM + * it is useful for. + */ +struct lsmcontext { + char *context; /* Provided by the module */ + u32 len; + int slot; /* Identifies the module */ +}; + +/** + * lsmcontext_init - initialize an lsmcontext structure. + * @cp: Pointer to the context to initialize + * @context: Initial context, or NULL + * @size: Size of context, or 0 + * @slot: Which LSM provided the context + * + * Fill in the lsmcontext from the provided information. + * This is a scaffolding function that will be removed when + * lsmcontext integration is complete. + */ +static inline void lsmcontext_init(struct lsmcontext *cp, char *context, + u32 size, int slot) +{ + cp->slot = slot; + cp->context = context; + + if (context == NULL || size == 0) + cp->len = 0; + else + cp->len = strlen(context); +} + /* * Data exported by the security modules * @@ -496,7 +531,7 @@ int security_ismaclabel(const char *name); int security_secid_to_secctx(struct lsmblob *blob, char **secdata, u32 *seclen); int security_secctx_to_secid(const char *secdata, u32 seclen, struct lsmblob *blob); -void security_release_secctx(char *secdata, u32 seclen); +void security_release_secctx(struct lsmcontext *cp); void security_inode_invalidate_secctx(struct inode *inode); int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen); int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen); @@ -1310,7 +1345,7 @@ static inline int security_secctx_to_secid(const char *secdata, return -EOPNOTSUPP; } -static inline void security_release_secctx(char *secdata, u32 seclen) +static inline void security_release_secctx(struct lsmcontext *cp) { } diff --git a/include/net/scm.h b/include/net/scm.h index 31ae605fcc0a..30ba801c91bd 100644 --- a/include/net/scm.h +++ b/include/net/scm.h @@ -92,6 +92,7 @@ static __inline__ int scm_send(struct socket *sock, struct msghdr *msg, #ifdef CONFIG_SECURITY_NETWORK static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm) { + struct lsmcontext context; char *secdata; u32 seclen; int err; @@ -102,7 +103,9 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc if (!err) { put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, seclen, secdata); - security_release_secctx(secdata, seclen); + /*scaffolding*/ + lsmcontext_init(&context, secdata, seclen, 0); + security_release_secctx(&context); } } } diff --git a/kernel/audit.c b/kernel/audit.c index ba9f78e36d1e..35970e7191b6 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1180,6 +1180,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) struct audit_sig_info *sig_data; char *ctx = NULL; u32 len; + struct lsmcontext scaff; /* scaffolding */ err = audit_netlink_ok(skb, msg_type); if (err) @@ -1424,15 +1425,18 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) } sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL); if (!sig_data) { - if (lsmblob_is_set(&audit_sig_lsm)) - security_release_secctx(ctx, len); + if (lsmblob_is_set(&audit_sig_lsm)) { + lsmcontext_init(&scaff, ctx, len, 0); + security_release_secctx(&scaff); + } return -ENOMEM; } sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid); sig_data->pid = audit_sig_pid; if (lsmblob_is_set(&audit_sig_lsm)) { memcpy(sig_data->ctx, ctx, len); - security_release_secctx(ctx, len); + lsmcontext_init(&scaff, ctx, len, 0); + security_release_secctx(&scaff); } audit_send_reply(skb, seq, AUDIT_SIGNAL_INFO, 0, 0, sig_data, sizeof(*sig_data) + len); @@ -2061,6 +2065,7 @@ int audit_log_task_context(struct audit_buffer *ab) unsigned len; int error; struct lsmblob blob; + struct lsmcontext scaff; /* scaffolding */ security_task_getsecid(current, &blob); if (!lsmblob_is_set(&blob)) @@ -2074,7 +2079,8 @@ int audit_log_task_context(struct audit_buffer *ab) } audit_log_format(ab, " subj=%s", ctx); - security_release_secctx(ctx, len); + lsmcontext_init(&scaff, ctx, len, 0); + security_release_secctx(&scaff); return 0; error_path: diff --git a/kernel/auditsc.c b/kernel/auditsc.c index c1e3ac8eb1ad..8790e7aafa7d 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -962,6 +962,7 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid, struct lsmblob *blob, char *comm) { struct audit_buffer *ab; + struct lsmcontext lsmcxt; char *ctx = NULL; u32 len; int rc = 0; @@ -979,7 +980,8 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid, rc = 1; } else { audit_log_format(ab, " obj=%s", ctx); - security_release_secctx(ctx, len); + lsmcontext_init(&lsmcxt, ctx, len, 0); /*scaffolding*/ + security_release_secctx(&lsmcxt); } } audit_log_format(ab, " ocomm="); @@ -1192,6 +1194,7 @@ static void audit_log_fcaps(struct audit_buffer *ab, struct audit_names *name) static void show_special(struct audit_context *context, int *call_panic) { + struct lsmcontext lsmcxt; struct audit_buffer *ab; int i; @@ -1225,7 +1228,8 @@ static void show_special(struct audit_context *context, int *call_panic) *call_panic = 1; } else { audit_log_format(ab, " obj=%s", ctx); - security_release_secctx(ctx, len); + lsmcontext_init(&lsmcxt, ctx, len, 0); + security_release_secctx(&lsmcxt); } } if (context->ipc.has_perm) { @@ -1371,6 +1375,7 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n, char *ctx = NULL; u32 len; struct lsmblob blob; + struct lsmcontext lsmcxt; lsmblob_init(&blob, n->osid); if (security_secid_to_secctx(&blob, &ctx, &len)) { @@ -1379,7 +1384,8 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n, *call_panic = 2; } else { audit_log_format(ab, " obj=%s", ctx); - security_release_secctx(ctx, len); + lsmcontext_init(&lsmcxt, ctx, len, 0); /* scaffolding */ + security_release_secctx(&lsmcxt); } } diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 1ca97d0cb4a9..96d56a30ecca 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -130,6 +130,7 @@ static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb, static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) { + struct lsmcontext context; struct lsmblob lb; char *secdata; u32 seclen; @@ -144,7 +145,8 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) return; put_cmsg(msg, SOL_IP, SCM_SECURITY, seclen, secdata); - security_release_secctx(secdata, seclen); + lsmcontext_init(&context, secdata, seclen, 0); /* scaffolding */ + security_release_secctx(&context); } static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb) diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index 0412f6744185..78791e015d8b 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -332,6 +332,7 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct) int len, ret; char *secctx; struct lsmblob blob; + struct lsmcontext context; lsmblob_init(&blob, ct->secmark); ret = security_secid_to_secctx(&blob, &secctx, &len); @@ -349,7 +350,8 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct) ret = 0; nla_put_failure: - security_release_secctx(secctx, len); + lsmcontext_init(&context, secctx, len, 0); /* scaffolding */ + security_release_secctx(&context); return ret; } #else diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c index 183a85412155..8601fcb99f7a 100644 --- a/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c @@ -176,6 +176,7 @@ static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct) u32 len; char *secctx; struct lsmblob blob; + struct lsmcontext context; lsmblob_init(&blob, ct->secmark); ret = security_secid_to_secctx(&blob, &secctx, &len); @@ -184,7 +185,8 @@ static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct) seq_printf(s, "secctx=%s ", secctx); - security_release_secctx(secctx, len); + lsmcontext_init(&context, secctx, len, 0); /* scaffolding */ + security_release_secctx(&context); } #else static inline void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct) diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c index bfa7f12fde99..cc3ef03ee198 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -395,6 +395,7 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, enum ip_conntrack_info uninitialized_var(ctinfo); struct nfnl_ct_hook *nfnl_ct; bool csum_verify; + struct lsmcontext scaff; /* scaffolding */ char *secdata = NULL; u32 seclen = 0; @@ -625,8 +626,10 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, } nlh->nlmsg_len = skb->len; - if (seclen) - security_release_secctx(secdata, seclen); + if (seclen) { + lsmcontext_init(&scaff, secdata, seclen, 0); + security_release_secctx(&scaff); + } return skb; nla_put_failure: @@ -634,8 +637,10 @@ nfqnl_build_packet_message(struct net *net, struct nfqnl_instance *queue, kfree_skb(skb); net_err_ratelimited("nf_queue: error creating packet message\n"); nlmsg_failure: - if (seclen) - security_release_secctx(secdata, seclen); + if (seclen) { + lsmcontext_init(&scaff, secdata, seclen, 0); + security_release_secctx(&scaff); + } return NULL; } diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c index e279b81d9545..288c005b44c7 100644 --- a/net/netlabel/netlabel_unlabeled.c +++ b/net/netlabel/netlabel_unlabeled.c @@ -373,6 +373,7 @@ int netlbl_unlhsh_add(struct net *net, struct net_device *dev; struct netlbl_unlhsh_iface *iface; struct audit_buffer *audit_buf = NULL; + struct lsmcontext context; char *secctx = NULL; u32 secctx_len; struct lsmblob blob; @@ -443,7 +444,9 @@ int netlbl_unlhsh_add(struct net *net, &secctx, &secctx_len) == 0) { audit_log_format(audit_buf, " sec_obj=%s", secctx); - security_release_secctx(secctx, secctx_len); + /* scaffolding */ + lsmcontext_init(&context, secctx, secctx_len, 0); + security_release_secctx(&context); } audit_log_format(audit_buf, " res=%u", ret_val == 0 ? 1 : 0); audit_log_end(audit_buf); @@ -474,6 +477,7 @@ static int netlbl_unlhsh_remove_addr4(struct net *net, struct netlbl_unlhsh_addr4 *entry; struct audit_buffer *audit_buf; struct net_device *dev; + struct lsmcontext context; char *secctx; u32 secctx_len; struct lsmblob blob; @@ -502,7 +506,9 @@ static int netlbl_unlhsh_remove_addr4(struct net *net, security_secid_to_secctx(&blob, &secctx, &secctx_len) == 0) { audit_log_format(audit_buf, " sec_obj=%s", secctx); - security_release_secctx(secctx, secctx_len); + /* scaffolding */ + lsmcontext_init(&context, secctx, secctx_len, 0); + security_release_secctx(&context); } audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0); audit_log_end(audit_buf); @@ -539,6 +545,7 @@ static int netlbl_unlhsh_remove_addr6(struct net *net, struct netlbl_unlhsh_addr6 *entry; struct audit_buffer *audit_buf; struct net_device *dev; + struct lsmcontext context; char *secctx; u32 secctx_len; struct lsmblob blob; @@ -566,7 +573,8 @@ static int netlbl_unlhsh_remove_addr6(struct net *net, security_secid_to_secctx(&blob, &secctx, &secctx_len) == 0) { audit_log_format(audit_buf, " sec_obj=%s", secctx); - security_release_secctx(secctx, secctx_len); + lsmcontext_init(&context, secctx, secctx_len, 0); + security_release_secctx(&context); } audit_log_format(audit_buf, " res=%u", entry != NULL ? 1 : 0); audit_log_end(audit_buf); @@ -1080,6 +1088,7 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd, int ret_val = -ENOMEM; struct netlbl_unlhsh_walk_arg *cb_arg = arg; struct net_device *dev; + struct lsmcontext context; void *data; u32 secid; char *secctx; @@ -1147,7 +1156,9 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd, NLBL_UNLABEL_A_SECCTX, secctx_len, secctx); - security_release_secctx(secctx, secctx_len); + /* scaffolding */ + lsmcontext_init(&context, secctx, secctx_len, 0); + security_release_secctx(&context); if (ret_val != 0) goto list_cb_failure; diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c index 893301ae0131..ef139d8ae7cd 100644 --- a/net/netlabel/netlabel_user.c +++ b/net/netlabel/netlabel_user.c @@ -84,6 +84,7 @@ struct audit_buffer *netlbl_audit_start_common(int type, struct netlbl_audit *audit_info) { struct audit_buffer *audit_buf; + struct lsmcontext context; char *secctx; u32 secctx_len; struct lsmblob blob; @@ -103,7 +104,8 @@ struct audit_buffer *netlbl_audit_start_common(int type, if (audit_info->secid != 0 && security_secid_to_secctx(&blob, &secctx, &secctx_len) == 0) { audit_log_format(audit_buf, " subj=%s", secctx); - security_release_secctx(secctx, secctx_len); + lsmcontext_init(&context, secctx, secctx_len, 0);/*scaffolding*/ + security_release_secctx(&context); } return audit_buf; diff --git a/security/security.c b/security/security.c index c2874f6587d2..c05ef9d0c8ed 100644 --- a/security/security.c +++ b/security/security.c @@ -2144,17 +2144,23 @@ int security_secctx_to_secid(const char *secdata, u32 seclen, } EXPORT_SYMBOL(security_secctx_to_secid); -void security_release_secctx(char *secdata, u32 seclen) +void security_release_secctx(struct lsmcontext *cp) { struct security_hook_list *hp; - int *display = current->security; + bool found = false; hlist_for_each_entry(hp, &security_hook_heads.release_secctx, list) - if (display == NULL || *display == LSMBLOB_INVALID || - *display == hp->lsmid->slot) { - hp->hook.release_secctx(secdata, seclen); - return; + if (cp->slot == hp->lsmid->slot) { + hp->hook.release_secctx(cp->context, cp->len); + found = true; + break; } + + memset(cp, 0, sizeof(*cp)); + + if (!found) + pr_warn("%s context \"%s\" from slot %d not released\n", + __func__, cp->context, cp->slot); } EXPORT_SYMBOL(security_release_secctx); diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index aac8cb0de733..4e464e5e942e 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4483,11 +4483,16 @@ static int smack_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) return 0; } -/* - * There used to be a smack_release_secctx hook - * that did nothing back when hooks were in a vector. - * Now that there's a list such a hook adds cost. +/** + * smack_release_secctx - do everything necessary to free a context + * @secdata: Unused + * @seclen: Unused + * + * Do nothing but hold a slot in the hooks list. */ +static void smack_release_secctx(char *secdata, u32 seclen) +{ +} static int smack_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) { @@ -4730,6 +4735,7 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(ismaclabel, smack_ismaclabel), LSM_HOOK_INIT(secid_to_secctx, smack_secid_to_secctx), LSM_HOOK_INIT(secctx_to_secid, smack_secctx_to_secid), + LSM_HOOK_INIT(release_secctx, smack_release_secctx), LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx), LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx), LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx),