From patchwork Wed Nov 13 16:50:47 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11242293 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 8DDE91510 for ; Wed, 13 Nov 2019 16:51:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3884F206CC for ; Wed, 13 Nov 2019 16:51:28 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="E7QvjHuv" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728612AbfKMQv3 (ORCPT ); Wed, 13 Nov 2019 11:51:29 -0500 Received: from sonic313-14.consmr.mail.ne1.yahoo.com ([66.163.185.37]:34895 "EHLO sonic313-14.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728594AbfKMQv3 (ORCPT ); Wed, 13 Nov 2019 11:51:29 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573663882; bh=9MZzR0Xx/JpXwxs3apQVPWaGX8pyWgvPtTmFeWS/vto=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=E7QvjHuvbstPTT/fXM8SL4Oe75VepGg5bvG3hEn5JJOPnz8ZScn8ygyCOKBfwI7uk98e31PZtf/jVa9CgchYn1IHRsAbEgmqJqOn+/yURLnsCxGA4q+JSVhKOebVVRtQIe4eOM6/N6cjkAXyomBP6WVg3mWZ5ax4udzvu4nxI4EMR0Wyy7W8adAkiQ0AEOQtv/WOyumYzEmcYgdKjGZe/ifXKuJXDJFaLHoZkF6QK7seYQxFSTAagv7gVBmP/LPacp3+P5q7kmvjyH4WWvuXUm939wOu52dha8liAbf+5r+uHOXwU+91fdkMl1Jb+semCGvEXB20JaL1EW4fK77oIA== X-YMail-OSG: C4s8O2wVM1kVEf.2Wub9Wd4Am0bgsaFNGKm.90SN8jMDYTg.7oSHBZyrreocemK NwElMg1InjrCpbQUwXP8F88SFdPpNBZGsNwU._dmrM89BHUQNgboISyIeChbpXcIzCdUvSmUV4zl w8QjaUsevEgBzIPAiJIJeTuMsh3uoEEFtTYpXmPKtxHQkz_RtxsBzPEvEycJXMjBlCX3SKF.1Gsz sVH8dHynX24YehmfaOBNCtRSBkoR9_cHAwqgrCftcvnRDb8lv4fZO0.f4VXFqzfRYrTP42bMCdHC q_iMDhwqU0.dUJKtmoANGZ6_QEncGkDVbIINFd9BIzNj0dYp8mmyVYTgtjhC_sTXoHsKjt9qWYIY T.Exrbe9Fcr5kctYEdmwwSxpN4ijMQblBDuMLkalHRPOcRYpkTCGEkwIPit.zZf67FLB0pjHEVqf qF8GCF3kcvFYNehD7k2iuVf79Aaf4O7OIxIraRpMXgUCAZATpPbsX.cHmr4d_DkWQmoPI5oJlWqT kyId3M3FL1liJAbuaDxuaY3Hxd6vqH0HzNeSZioM0mfpwSl2rnBO4EphqroddZh9rpbUhqOqrLoO 2.i3LGLEctlQxO08kiiKqKbisMTAeI35ebkMkjKafFb0C0rJo8VFTkvH0dWpa3H1lXUbBH4Rii6Z ylKZpKRdTZ2YqZaSF4JLwFD_MToc5glImov5Qkjz_.ydV.Yw6dcfX6gY3RLYdQgxKeQ6nrl5.5JP UAIs_ouGh.7tDhS54epmYqNy3Pid5_MGQyrhC5PpZk5m9PRru2hN9Tp2fFTDaS3abh25z9XTG5DG MYNDYdrUfCg9j.bkq0OESc9TMgIxV7_xR0X3TVf_K7boWLq5r7NKGQNl5CCivzsUK94ZC_QLDk2K 2068M_SzjeqCNqpvz8tnmvTMS79FMei9jn3wYzJ4.4A7Xkv7_s6Mb7AovRjmmWtnFZiqOCvdMjyB 8pHYXV.uqjlesZb5gufQ9gXEMF4P9DrtH41F1FFOlnOrlgsr4kTjNz7aoDooFketx_AitK526R7k VYjmzoMpDmNrUaY1z9Er373.1HGDb7zV6X2i96uTEaZlPmrcfmY.8Yb51JXKefNPZzoLaToE.l4Y oFmH57insbDtkxL78Es8Cn2pUknQnjUArkyfPYgYrgZS2lmcB6E.KkzccIJHJQloxLfIt8F_wgz4 mzZjn7NWL8r_Vt9Gv11gjC1oIJRQBncEyF0zGfCD3pAMbEQsqkPcqGIUg9uPIYAecZzMZ1cWxNlB SSazhPFJW6P4t4o7RYqkQox8nN3dR2KZ6Kjp5hrCzZTlFCEBqhQ8XODoEzoehbC._PdNHStTZQjv xd9f9.9E62rPS0yeQ.HcZlT6zFgYrFzuzyiG6UMx1Wg1UDMvUSCxICYincn0kDmGkvh82pLkVoif NP6SFXBuzg4hgN44uOPvemKN0l9w- Received: from sonic.gate.mail.ne1.yahoo.com by sonic313.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 16:51:22 +0000 Received: by smtp411.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID e948f3a250728d7566d3e2a83137ba19; Wed, 13 Nov 2019 16:51:16 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH v11 01/25] LSM: Infrastructure management of the sock security Date: Wed, 13 Nov 2019 08:50:47 -0800 Message-Id: <20191113165111.6744-2-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113165111.6744-1-casey@schaufler-ca.com> References: <20191113165111.6744-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Move management of the sock->sk_security blob out of the individual security modules and into the security infrastructure. Instead of allocating the blobs from within the modules the modules tell the infrastructure how much space is required, and the space is allocated there. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 1 + security/apparmor/include/net.h | 6 ++- security/apparmor/lsm.c | 38 ++++----------- security/security.c | 36 +++++++++++++- security/selinux/hooks.c | 78 +++++++++++++++---------------- security/selinux/include/objsec.h | 5 ++ security/selinux/netlabel.c | 23 ++++----- security/smack/smack.h | 5 ++ security/smack/smack_lsm.c | 64 ++++++++++++------------- security/smack/smack_netfilter.c | 8 ++-- 10 files changed, 144 insertions(+), 120 deletions(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index a3763247547c..13a67fd1a767 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -2080,6 +2080,7 @@ struct lsm_blob_sizes { int lbs_cred; int lbs_file; int lbs_inode; + int lbs_sock; int lbs_ipc; int lbs_msg_msg; int lbs_task; diff --git a/security/apparmor/include/net.h b/security/apparmor/include/net.h index 2431c011800d..5b6f52c62058 100644 --- a/security/apparmor/include/net.h +++ b/security/apparmor/include/net.h @@ -51,7 +51,11 @@ struct aa_sk_ctx { struct aa_label *peer; }; -#define SK_CTX(X) ((X)->sk_security) +static inline struct aa_sk_ctx *aa_sock(const struct sock *sk) +{ + return sk->sk_security + apparmor_blob_sizes.lbs_sock; +} + #define SOCK_ctx(X) SOCK_INODE(X)->i_security #define DEFINE_AUDIT_NET(NAME, OP, SK, F, T, P) \ struct lsm_network_audit NAME ## _net = { .sk = (SK), \ diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index ec3a928af829..4093fa231671 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -753,33 +753,15 @@ static int apparmor_task_kill(struct task_struct *target, struct kernel_siginfo return error; } -/** - * apparmor_sk_alloc_security - allocate and attach the sk_security field - */ -static int apparmor_sk_alloc_security(struct sock *sk, int family, gfp_t flags) -{ - struct aa_sk_ctx *ctx; - - ctx = kzalloc(sizeof(*ctx), flags); - if (!ctx) - return -ENOMEM; - - SK_CTX(sk) = ctx; - - return 0; -} - /** * apparmor_sk_free_security - free the sk_security field */ static void apparmor_sk_free_security(struct sock *sk) { - struct aa_sk_ctx *ctx = SK_CTX(sk); + struct aa_sk_ctx *ctx = aa_sock(sk); - SK_CTX(sk) = NULL; aa_put_label(ctx->label); aa_put_label(ctx->peer); - kfree(ctx); } /** @@ -788,8 +770,8 @@ static void apparmor_sk_free_security(struct sock *sk) static void apparmor_sk_clone_security(const struct sock *sk, struct sock *newsk) { - struct aa_sk_ctx *ctx = SK_CTX(sk); - struct aa_sk_ctx *new = SK_CTX(newsk); + struct aa_sk_ctx *ctx = aa_sock(sk); + struct aa_sk_ctx *new = aa_sock(newsk); new->label = aa_get_label(ctx->label); new->peer = aa_get_label(ctx->peer); @@ -840,7 +822,7 @@ static int apparmor_socket_post_create(struct socket *sock, int family, label = aa_get_current_label(); if (sock->sk) { - struct aa_sk_ctx *ctx = SK_CTX(sock->sk); + struct aa_sk_ctx *ctx = aa_sock(sock->sk); aa_put_label(ctx->label); ctx->label = aa_get_label(label); @@ -1025,7 +1007,7 @@ static int apparmor_socket_shutdown(struct socket *sock, int how) */ static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) { - struct aa_sk_ctx *ctx = SK_CTX(sk); + struct aa_sk_ctx *ctx = aa_sock(sk); if (!skb->secmark) return 0; @@ -1038,7 +1020,7 @@ static int apparmor_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) static struct aa_label *sk_peer_label(struct sock *sk) { - struct aa_sk_ctx *ctx = SK_CTX(sk); + struct aa_sk_ctx *ctx = aa_sock(sk); if (ctx->peer) return ctx->peer; @@ -1122,7 +1104,7 @@ static int apparmor_socket_getpeersec_dgram(struct socket *sock, */ static void apparmor_sock_graft(struct sock *sk, struct socket *parent) { - struct aa_sk_ctx *ctx = SK_CTX(sk); + struct aa_sk_ctx *ctx = aa_sock(sk); if (!ctx->label) ctx->label = aa_get_current_label(); @@ -1132,7 +1114,7 @@ static void apparmor_sock_graft(struct sock *sk, struct socket *parent) static int apparmor_inet_conn_request(struct sock *sk, struct sk_buff *skb, struct request_sock *req) { - struct aa_sk_ctx *ctx = SK_CTX(sk); + struct aa_sk_ctx *ctx = aa_sock(sk); if (!skb->secmark) return 0; @@ -1149,6 +1131,7 @@ struct lsm_blob_sizes apparmor_blob_sizes __lsm_ro_after_init = { .lbs_cred = sizeof(struct aa_task_ctx *), .lbs_file = sizeof(struct aa_file_ctx), .lbs_task = sizeof(struct aa_task_ctx), + .lbs_sock = sizeof(struct aa_sk_ctx), }; static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { @@ -1185,7 +1168,6 @@ static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(getprocattr, apparmor_getprocattr), LSM_HOOK_INIT(setprocattr, apparmor_setprocattr), - LSM_HOOK_INIT(sk_alloc_security, apparmor_sk_alloc_security), LSM_HOOK_INIT(sk_free_security, apparmor_sk_free_security), LSM_HOOK_INIT(sk_clone_security, apparmor_sk_clone_security), @@ -1624,7 +1606,7 @@ static unsigned int apparmor_ip_postroute(void *priv, if (sk == NULL) return NF_ACCEPT; - ctx = SK_CTX(sk); + ctx = aa_sock(sk); if (!apparmor_secmark_check(ctx->label, OP_SENDMSG, AA_MAY_SEND, skb->secmark, sk)) return NF_ACCEPT; diff --git a/security/security.c b/security/security.c index 1bc000f834e2..5e43d3f64c1f 100644 --- a/security/security.c +++ b/security/security.c @@ -28,6 +28,7 @@ #include #include #include +#include #define MAX_LSM_EVM_XATTR 2 @@ -169,6 +170,7 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed) lsm_set_blob_size(&needed->lbs_inode, &blob_sizes.lbs_inode); lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc); lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg); + lsm_set_blob_size(&needed->lbs_sock, &blob_sizes.lbs_sock); lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task); } @@ -304,6 +306,7 @@ static void __init ordered_lsm_init(void) init_debug("inode blob size = %d\n", blob_sizes.lbs_inode); init_debug("ipc blob size = %d\n", blob_sizes.lbs_ipc); init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); + init_debug("sock blob size = %d\n", blob_sizes.lbs_sock); init_debug("task blob size = %d\n", blob_sizes.lbs_task); /* @@ -622,6 +625,28 @@ static int lsm_msg_msg_alloc(struct msg_msg *mp) return 0; } +/** + * lsm_sock_alloc - allocate a composite sock blob + * @sock: the sock that needs a blob + * @priority: allocation mode + * + * Allocate the sock blob for all the modules + * + * Returns 0, or -ENOMEM if memory can't be allocated. + */ +static int lsm_sock_alloc(struct sock *sock, gfp_t priority) +{ + if (blob_sizes.lbs_sock == 0) { + sock->sk_security = NULL; + return 0; + } + + sock->sk_security = kzalloc(blob_sizes.lbs_sock, priority); + if (sock->sk_security == NULL) + return -ENOMEM; + return 0; +} + /** * lsm_early_task - during initialization allocate a composite task blob * @task: the task that needs a blob @@ -2066,12 +2091,21 @@ EXPORT_SYMBOL(security_socket_getpeersec_dgram); int security_sk_alloc(struct sock *sk, int family, gfp_t priority) { - return call_int_hook(sk_alloc_security, 0, sk, family, priority); + int rc = lsm_sock_alloc(sk, priority); + + if (unlikely(rc)) + return rc; + rc = call_int_hook(sk_alloc_security, 0, sk, family, priority); + if (unlikely(rc)) + security_sk_free(sk); + return rc; } void security_sk_free(struct sock *sk) { call_void_hook(sk_free_security, sk); + kfree(sk->sk_security); + sk->sk_security = NULL; } void security_sk_clone(const struct sock *sk, struct sock *newsk) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 9625b99e677f..3feb971068e2 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4467,7 +4467,7 @@ static int socket_sockcreate_sid(const struct task_security_struct *tsec, static int sock_has_perm(struct sock *sk, u32 perms) { - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); struct common_audit_data ad; struct lsm_network_audit net = {0,}; @@ -4524,7 +4524,7 @@ static int selinux_socket_post_create(struct socket *sock, int family, isec->initialized = LABEL_INITIALIZED; if (sock->sk) { - sksec = sock->sk->sk_security; + sksec = selinux_sock(sock->sk); sksec->sclass = sclass; sksec->sid = sid; /* Allows detection of the first association on this socket */ @@ -4540,8 +4540,8 @@ static int selinux_socket_post_create(struct socket *sock, int family, static int selinux_socket_socketpair(struct socket *socka, struct socket *sockb) { - struct sk_security_struct *sksec_a = socka->sk->sk_security; - struct sk_security_struct *sksec_b = sockb->sk->sk_security; + struct sk_security_struct *sksec_a = selinux_sock(socka->sk); + struct sk_security_struct *sksec_b = selinux_sock(sockb->sk); sksec_a->peer_sid = sksec_b->sid; sksec_b->peer_sid = sksec_a->sid; @@ -4556,7 +4556,7 @@ static int selinux_socket_socketpair(struct socket *socka, static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen) { struct sock *sk = sock->sk; - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); u16 family; int err; @@ -4691,7 +4691,7 @@ static int selinux_socket_connect_helper(struct socket *sock, struct sockaddr *address, int addrlen) { struct sock *sk = sock->sk; - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); int err; err = sock_has_perm(sk, SOCKET__CONNECT); @@ -4870,9 +4870,9 @@ static int selinux_socket_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk) { - struct sk_security_struct *sksec_sock = sock->sk_security; - struct sk_security_struct *sksec_other = other->sk_security; - struct sk_security_struct *sksec_new = newsk->sk_security; + struct sk_security_struct *sksec_sock = selinux_sock(sock); + struct sk_security_struct *sksec_other = selinux_sock(other); + struct sk_security_struct *sksec_new = selinux_sock(newsk); struct common_audit_data ad; struct lsm_network_audit net = {0,}; int err; @@ -4904,8 +4904,8 @@ static int selinux_socket_unix_stream_connect(struct sock *sock, static int selinux_socket_unix_may_send(struct socket *sock, struct socket *other) { - struct sk_security_struct *ssec = sock->sk->sk_security; - struct sk_security_struct *osec = other->sk->sk_security; + struct sk_security_struct *ssec = selinux_sock(sock->sk); + struct sk_security_struct *osec = selinux_sock(other->sk); struct common_audit_data ad; struct lsm_network_audit net = {0,}; @@ -4947,7 +4947,7 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb, u16 family) { int err = 0; - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); u32 sk_sid = sksec->sid; struct common_audit_data ad; struct lsm_network_audit net = {0,}; @@ -4980,7 +4980,7 @@ static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb, static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) { int err; - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); u16 family = sk->sk_family; u32 sk_sid = sksec->sid; struct common_audit_data ad; @@ -5048,13 +5048,15 @@ static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) return err; } -static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval, - int __user *optlen, unsigned len) +static int selinux_socket_getpeersec_stream(struct socket *sock, + char __user *optval, + int __user *optlen, + unsigned int len) { int err = 0; char *scontext; u32 scontext_len; - struct sk_security_struct *sksec = sock->sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sock->sk); u32 peer_sid = SECSID_NULL; if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET || @@ -5114,34 +5116,27 @@ static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff * static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority) { - struct sk_security_struct *sksec; - - sksec = kzalloc(sizeof(*sksec), priority); - if (!sksec) - return -ENOMEM; + struct sk_security_struct *sksec = selinux_sock(sk); sksec->peer_sid = SECINITSID_UNLABELED; sksec->sid = SECINITSID_UNLABELED; sksec->sclass = SECCLASS_SOCKET; selinux_netlbl_sk_security_reset(sksec); - sk->sk_security = sksec; return 0; } static void selinux_sk_free_security(struct sock *sk) { - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); - sk->sk_security = NULL; selinux_netlbl_sk_security_free(sksec); - kfree(sksec); } static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk) { - struct sk_security_struct *sksec = sk->sk_security; - struct sk_security_struct *newsksec = newsk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); + struct sk_security_struct *newsksec = selinux_sock(newsk); newsksec->sid = sksec->sid; newsksec->peer_sid = sksec->peer_sid; @@ -5155,7 +5150,7 @@ static void selinux_sk_getsecid(struct sock *sk, u32 *secid) if (!sk) *secid = SECINITSID_ANY_SOCKET; else { - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); *secid = sksec->sid; } @@ -5165,7 +5160,7 @@ static void selinux_sock_graft(struct sock *sk, struct socket *parent) { struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(parent)); - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 || sk->sk_family == PF_UNIX) @@ -5180,7 +5175,7 @@ static void selinux_sock_graft(struct sock *sk, struct socket *parent) static int selinux_sctp_assoc_request(struct sctp_endpoint *ep, struct sk_buff *skb) { - struct sk_security_struct *sksec = ep->base.sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(ep->base.sk); struct common_audit_data ad; struct lsm_network_audit net = {0,}; u8 peerlbl_active; @@ -5331,8 +5326,8 @@ static int selinux_sctp_bind_connect(struct sock *sk, int optname, static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk, struct sock *newsk) { - struct sk_security_struct *sksec = sk->sk_security; - struct sk_security_struct *newsksec = newsk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); + struct sk_security_struct *newsksec = selinux_sock(newsk); /* If policy does not support SECCLASS_SCTP_SOCKET then call * the non-sctp clone version. @@ -5349,7 +5344,7 @@ static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk, static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb, struct request_sock *req) { - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); int err; u16 family = req->rsk_ops->family; u32 connsid; @@ -5370,7 +5365,7 @@ static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb, static void selinux_inet_csk_clone(struct sock *newsk, const struct request_sock *req) { - struct sk_security_struct *newsksec = newsk->sk_security; + struct sk_security_struct *newsksec = selinux_sock(newsk); newsksec->sid = req->secid; newsksec->peer_sid = req->peer_secid; @@ -5387,7 +5382,7 @@ static void selinux_inet_csk_clone(struct sock *newsk, static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb) { u16 family = sk->sk_family; - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); /* handle mapped IPv4 packets arriving via IPv6 sockets */ if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) @@ -5471,7 +5466,7 @@ static int selinux_tun_dev_attach_queue(void *security) static int selinux_tun_dev_attach(struct sock *sk, void *security) { struct tun_security_struct *tunsec = security; - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); /* we don't currently perform any NetLabel based labeling here and it * isn't clear that we would want to do so anyway; while we could apply @@ -5512,7 +5507,7 @@ static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb) int err = 0; u32 perm; struct nlmsghdr *nlh; - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); if (skb->len < NLMSG_HDRLEN) { err = -EINVAL; @@ -5653,7 +5648,7 @@ static unsigned int selinux_ip_output(struct sk_buff *skb, return NF_ACCEPT; /* standard practice, label using the parent socket */ - sksec = sk->sk_security; + sksec = selinux_sock(sk); sid = sksec->sid; } else sid = SECINITSID_KERNEL; @@ -5692,7 +5687,7 @@ static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, if (sk == NULL) return NF_ACCEPT; - sksec = sk->sk_security; + sksec = selinux_sock(sk); ad.type = LSM_AUDIT_DATA_NET; ad.u.net = &net; @@ -5784,7 +5779,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, u32 skb_sid; struct sk_security_struct *sksec; - sksec = sk->sk_security; + sksec = selinux_sock(sk); if (selinux_skb_peerlbl_sid(skb, family, &skb_sid)) return NF_DROP; /* At this point, if the returned skb peerlbl is SECSID_NULL @@ -5813,7 +5808,7 @@ static unsigned int selinux_ip_postroute(struct sk_buff *skb, } else { /* Locally generated packet, fetch the security label from the * associated socket. */ - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); peer_sid = sksec->sid; secmark_perm = PACKET__SEND; } @@ -6793,6 +6788,7 @@ struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = { .lbs_inode = sizeof(struct inode_security_struct), .lbs_ipc = sizeof(struct ipc_security_struct), .lbs_msg_msg = sizeof(struct msg_security_struct), + .lbs_sock = sizeof(struct sk_security_struct), }; static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h index 586b7abd0aa7..3e2bb90dc868 100644 --- a/security/selinux/include/objsec.h +++ b/security/selinux/include/objsec.h @@ -185,4 +185,9 @@ static inline u32 current_sid(void) return tsec->sid; } +static inline struct sk_security_struct *selinux_sock(const struct sock *sock) +{ + return sock->sk_security + selinux_blob_sizes.lbs_sock; +} + #endif /* _SELINUX_OBJSEC_H_ */ diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c index abaab7683840..6a94b31b5472 100644 --- a/security/selinux/netlabel.c +++ b/security/selinux/netlabel.c @@ -17,6 +17,7 @@ #include #include #include +#include #include #include #include @@ -67,7 +68,7 @@ static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb, static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr(struct sock *sk) { int rc; - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); struct netlbl_lsm_secattr *secattr; if (sksec->nlbl_secattr != NULL) @@ -100,7 +101,7 @@ static struct netlbl_lsm_secattr *selinux_netlbl_sock_getattr( const struct sock *sk, u32 sid) { - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); struct netlbl_lsm_secattr *secattr = sksec->nlbl_secattr; if (secattr == NULL) @@ -235,7 +236,7 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb, * being labeled by it's parent socket, if it is just exit */ sk = skb_to_full_sk(skb); if (sk != NULL) { - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); if (sksec->nlbl_state != NLBL_REQSKB) return 0; @@ -273,7 +274,7 @@ int selinux_netlbl_sctp_assoc_request(struct sctp_endpoint *ep, { int rc; struct netlbl_lsm_secattr secattr; - struct sk_security_struct *sksec = ep->base.sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(ep->base.sk); struct sockaddr_in addr4; struct sockaddr_in6 addr6; @@ -352,7 +353,7 @@ int selinux_netlbl_inet_conn_request(struct request_sock *req, u16 family) */ void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family) { - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); if (family == PF_INET) sksec->nlbl_state = NLBL_LABELED; @@ -370,8 +371,8 @@ void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family) */ void selinux_netlbl_sctp_sk_clone(struct sock *sk, struct sock *newsk) { - struct sk_security_struct *sksec = sk->sk_security; - struct sk_security_struct *newsksec = newsk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); + struct sk_security_struct *newsksec = selinux_sock(newsk); newsksec->nlbl_state = sksec->nlbl_state; } @@ -389,7 +390,7 @@ void selinux_netlbl_sctp_sk_clone(struct sock *sk, struct sock *newsk) int selinux_netlbl_socket_post_create(struct sock *sk, u16 family) { int rc; - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); struct netlbl_lsm_secattr *secattr; if (family != PF_INET && family != PF_INET6) @@ -504,7 +505,7 @@ int selinux_netlbl_socket_setsockopt(struct socket *sock, { int rc = 0; struct sock *sk = sock->sk; - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); struct netlbl_lsm_secattr secattr; if (selinux_netlbl_option(level, optname) && @@ -542,7 +543,7 @@ static int selinux_netlbl_socket_connect_helper(struct sock *sk, struct sockaddr *addr) { int rc; - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); struct netlbl_lsm_secattr *secattr; /* connected sockets are allowed to disconnect when the address family @@ -581,7 +582,7 @@ static int selinux_netlbl_socket_connect_helper(struct sock *sk, int selinux_netlbl_socket_connect_locked(struct sock *sk, struct sockaddr *addr) { - struct sk_security_struct *sksec = sk->sk_security; + struct sk_security_struct *sksec = selinux_sock(sk); if (sksec->nlbl_state != NLBL_REQSKB && sksec->nlbl_state != NLBL_CONNLABELED) diff --git a/security/smack/smack.h b/security/smack/smack.h index 62529f382942..2836540f9577 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -372,6 +372,11 @@ static inline struct smack_known **smack_ipc(const struct kern_ipc_perm *ipc) return ipc->security + smack_blob_sizes.lbs_ipc; } +static inline struct socket_smack *smack_sock(const struct sock *sock) +{ + return sock->sk_security + smack_blob_sizes.lbs_sock; +} + /* * Is the directory transmuting? */ diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index abeb09c30633..796f78580c17 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -1456,7 +1456,7 @@ static int smack_inode_getsecurity(struct inode *inode, if (sock == NULL || sock->sk == NULL) return -EOPNOTSUPP; - ssp = sock->sk->sk_security; + ssp = smack_sock(sock->sk); if (strcmp(name, XATTR_SMACK_IPIN) == 0) isp = ssp->smk_in; @@ -1838,7 +1838,7 @@ static int smack_file_receive(struct file *file) if (inode->i_sb->s_magic == SOCKFS_MAGIC) { sock = SOCKET_I(inode); - ssp = sock->sk->sk_security; + ssp = smack_sock(sock->sk); tsp = smack_cred(current_cred()); /* * If the receiving process can't write to the @@ -2245,11 +2245,7 @@ static void smack_task_to_inode(struct task_struct *p, struct inode *inode) static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags) { struct smack_known *skp = smk_of_current(); - struct socket_smack *ssp; - - ssp = kzalloc(sizeof(struct socket_smack), gfp_flags); - if (ssp == NULL) - return -ENOMEM; + struct socket_smack *ssp = smack_sock(sk); /* * Sockets created by kernel threads receive web label. @@ -2263,11 +2259,10 @@ static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags) } ssp->smk_packet = NULL; - sk->sk_security = ssp; - return 0; } +#ifdef SMACK_IPV6_PORT_LABELING /** * smack_sk_free_security - Free a socket blob * @sk: the socket @@ -2276,7 +2271,6 @@ static int smack_sk_alloc_security(struct sock *sk, int family, gfp_t gfp_flags) */ static void smack_sk_free_security(struct sock *sk) { -#ifdef SMACK_IPV6_PORT_LABELING struct smk_port_label *spp; if (sk->sk_family == PF_INET6) { @@ -2289,9 +2283,8 @@ static void smack_sk_free_security(struct sock *sk) } rcu_read_unlock(); } -#endif - kfree(sk->sk_security); } +#endif /** * smack_ipv4host_label - check host based restrictions @@ -2409,7 +2402,7 @@ static struct smack_known *smack_ipv6host_label(struct sockaddr_in6 *sip) static int smack_netlabel(struct sock *sk, int labeled) { struct smack_known *skp; - struct socket_smack *ssp = sk->sk_security; + struct socket_smack *ssp = smack_sock(sk); int rc = 0; /* @@ -2454,7 +2447,7 @@ static int smack_netlabel_send(struct sock *sk, struct sockaddr_in *sap) int rc; int sk_lbl; struct smack_known *hkp; - struct socket_smack *ssp = sk->sk_security; + struct socket_smack *ssp = smack_sock(sk); struct smk_audit_info ad; rcu_read_lock(); @@ -2530,7 +2523,7 @@ static void smk_ipv6_port_label(struct socket *sock, struct sockaddr *address) { struct sock *sk = sock->sk; struct sockaddr_in6 *addr6; - struct socket_smack *ssp = sock->sk->sk_security; + struct socket_smack *ssp = smack_sock(sock->sk); struct smk_port_label *spp; unsigned short port = 0; @@ -2618,7 +2611,7 @@ static int smk_ipv6_port_check(struct sock *sk, struct sockaddr_in6 *address, int act) { struct smk_port_label *spp; - struct socket_smack *ssp = sk->sk_security; + struct socket_smack *ssp = smack_sock(sk); struct smack_known *skp = NULL; unsigned short port; struct smack_known *object; @@ -2712,7 +2705,7 @@ static int smack_inode_setsecurity(struct inode *inode, const char *name, if (sock == NULL || sock->sk == NULL) return -EOPNOTSUPP; - ssp = sock->sk->sk_security; + ssp = smack_sock(sock->sk); if (strcmp(name, XATTR_SMACK_IPIN) == 0) ssp->smk_in = skp; @@ -2760,7 +2753,7 @@ static int smack_socket_post_create(struct socket *sock, int family, * Sockets created by kernel threads receive web label. */ if (unlikely(current->flags & PF_KTHREAD)) { - ssp = sock->sk->sk_security; + ssp = smack_sock(sock->sk); ssp->smk_in = &smack_known_web; ssp->smk_out = &smack_known_web; } @@ -2785,8 +2778,8 @@ static int smack_socket_post_create(struct socket *sock, int family, static int smack_socket_socketpair(struct socket *socka, struct socket *sockb) { - struct socket_smack *asp = socka->sk->sk_security; - struct socket_smack *bsp = sockb->sk->sk_security; + struct socket_smack *asp = smack_sock(socka->sk); + struct socket_smack *bsp = smack_sock(sockb->sk); asp->smk_packet = bsp->smk_out; bsp->smk_packet = asp->smk_out; @@ -2844,7 +2837,7 @@ static int smack_socket_connect(struct socket *sock, struct sockaddr *sap, return 0; #ifdef SMACK_IPV6_SECMARK_LABELING - ssp = sock->sk->sk_security; + ssp = smack_sock(sock->sk); #endif switch (sock->sk->sk_family) { @@ -3586,9 +3579,9 @@ static int smack_unix_stream_connect(struct sock *sock, { struct smack_known *skp; struct smack_known *okp; - struct socket_smack *ssp = sock->sk_security; - struct socket_smack *osp = other->sk_security; - struct socket_smack *nsp = newsk->sk_security; + struct socket_smack *ssp = smack_sock(sock); + struct socket_smack *osp = smack_sock(other); + struct socket_smack *nsp = smack_sock(newsk); struct smk_audit_info ad; int rc = 0; #ifdef CONFIG_AUDIT @@ -3634,8 +3627,8 @@ static int smack_unix_stream_connect(struct sock *sock, */ static int smack_unix_may_send(struct socket *sock, struct socket *other) { - struct socket_smack *ssp = sock->sk->sk_security; - struct socket_smack *osp = other->sk->sk_security; + struct socket_smack *ssp = smack_sock(sock->sk); + struct socket_smack *osp = smack_sock(other->sk); struct smk_audit_info ad; int rc; @@ -3672,7 +3665,7 @@ static int smack_socket_sendmsg(struct socket *sock, struct msghdr *msg, struct sockaddr_in6 *sap = (struct sockaddr_in6 *) msg->msg_name; #endif #ifdef SMACK_IPV6_SECMARK_LABELING - struct socket_smack *ssp = sock->sk->sk_security; + struct socket_smack *ssp = smack_sock(sock->sk); struct smack_known *rsp; #endif int rc = 0; @@ -3845,7 +3838,7 @@ static int smk_skb_to_addr_ipv6(struct sk_buff *skb, struct sockaddr_in6 *sip) static int smack_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) { struct netlbl_lsm_secattr secattr; - struct socket_smack *ssp = sk->sk_security; + struct socket_smack *ssp = smack_sock(sk); struct smack_known *skp = NULL; int rc = 0; struct smk_audit_info ad; @@ -3966,7 +3959,7 @@ static int smack_socket_getpeersec_stream(struct socket *sock, int slen = 1; int rc = 0; - ssp = sock->sk->sk_security; + ssp = smack_sock(sock->sk); if (ssp->smk_packet != NULL) { rcp = ssp->smk_packet->smk_known; slen = strlen(rcp) + 1; @@ -4016,7 +4009,7 @@ static int smack_socket_getpeersec_dgram(struct socket *sock, switch (family) { case PF_UNIX: - ssp = sock->sk->sk_security; + ssp = smack_sock(sock->sk); s = ssp->smk_out->smk_secid; break; case PF_INET: @@ -4029,7 +4022,7 @@ static int smack_socket_getpeersec_dgram(struct socket *sock, * Translate what netlabel gave us. */ if (sock != NULL && sock->sk != NULL) - ssp = sock->sk->sk_security; + ssp = smack_sock(sock->sk); netlbl_secattr_init(&secattr); rc = netlbl_skbuff_getattr(skb, family, &secattr); if (rc == 0) { @@ -4067,7 +4060,7 @@ static void smack_sock_graft(struct sock *sk, struct socket *parent) (sk->sk_family != PF_INET && sk->sk_family != PF_INET6)) return; - ssp = sk->sk_security; + ssp = smack_sock(sk); ssp->smk_in = skp; ssp->smk_out = skp; /* cssp->smk_packet is already set in smack_inet_csk_clone() */ @@ -4087,7 +4080,7 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, { u16 family = sk->sk_family; struct smack_known *skp; - struct socket_smack *ssp = sk->sk_security; + struct socket_smack *ssp = smack_sock(sk); struct netlbl_lsm_secattr secattr; struct sockaddr_in addr; struct iphdr *hdr; @@ -4186,7 +4179,7 @@ static int smack_inet_conn_request(struct sock *sk, struct sk_buff *skb, static void smack_inet_csk_clone(struct sock *sk, const struct request_sock *req) { - struct socket_smack *ssp = sk->sk_security; + struct socket_smack *ssp = smack_sock(sk); struct smack_known *skp; if (req->peer_secid != 0) { @@ -4590,6 +4583,7 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = { .lbs_inode = sizeof(struct inode_smack), .lbs_ipc = sizeof(struct smack_known *), .lbs_msg_msg = sizeof(struct smack_known *), + .lbs_sock = sizeof(struct socket_smack), }; static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { @@ -4699,7 +4693,9 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(socket_getpeersec_stream, smack_socket_getpeersec_stream), LSM_HOOK_INIT(socket_getpeersec_dgram, smack_socket_getpeersec_dgram), LSM_HOOK_INIT(sk_alloc_security, smack_sk_alloc_security), +#ifdef SMACK_IPV6_PORT_LABELING LSM_HOOK_INIT(sk_free_security, smack_sk_free_security), +#endif LSM_HOOK_INIT(sock_graft, smack_sock_graft), LSM_HOOK_INIT(inet_conn_request, smack_inet_conn_request), LSM_HOOK_INIT(inet_csk_clone, smack_inet_csk_clone), diff --git a/security/smack/smack_netfilter.c b/security/smack/smack_netfilter.c index fc7399b45373..635e2339579e 100644 --- a/security/smack/smack_netfilter.c +++ b/security/smack/smack_netfilter.c @@ -28,8 +28,8 @@ static unsigned int smack_ipv6_output(void *priv, struct socket_smack *ssp; struct smack_known *skp; - if (sk && sk->sk_security) { - ssp = sk->sk_security; + if (sk && smack_sock(sk)) { + ssp = smack_sock(sk); skp = ssp->smk_out; skb->secmark = skp->smk_secid; } @@ -46,8 +46,8 @@ static unsigned int smack_ipv4_output(void *priv, struct socket_smack *ssp; struct smack_known *skp; - if (sk && sk->sk_security) { - ssp = sk->sk_security; + if (sk && smack_sock(sk)) { + ssp = smack_sock(sk); skp = ssp->smk_out; skb->secmark = skp->smk_secid; } From patchwork Wed Nov 13 16:50:48 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11242291 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 66CF814ED for ; Wed, 13 Nov 2019 16:51:28 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 1099C206CC for ; Wed, 13 Nov 2019 16:51:28 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="YauSJs6F" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728596AbfKMQv2 (ORCPT ); Wed, 13 Nov 2019 11:51:28 -0500 Received: from sonic315-26.consmr.mail.ne1.yahoo.com ([66.163.190.152]:36952 "EHLO sonic315-26.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728612AbfKMQv2 (ORCPT ); Wed, 13 Nov 2019 11:51:28 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573663886; bh=i6tPPr7x71/s61Wwgk9lK2odZ7QDHQgW26n+sD1MkVQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=YauSJs6FR8q1sbVkHMPl1J0rMGoyilACJ5LVMN1Ld7NBG4JgZa+AjkLU9teioazC4MSljSJvHmoQ8iq6Eor/HnT8cTA1MrlZipxcQtiWFJiHf0R6+TXgMW3O9tBRof+yH58uNE5+b9Nx8i7ScGdKedTkFy/oDNtMlfLpM3+hc9YlhjcD6+STQNA3bgFDX2KvzPzhMD3gGSmbmE5UDbxd0Df1EQgeXcuntw8tP2Hy3TXzzg6l66Jq1LBWlqpXFMx2kQc8HqsFqZwaSXYc2q1DoQokCqhl8q1t6FT71WvPbk45OJMi65lvrffrXDrK9ygQ6AwZkpqBt+nGaczae8u1cQ== X-YMail-OSG: bgRy1TkVM1kTgVgV4PQFWPN.kaByaV.lAXvsGKF1cFR2nlQiKzKKwURmaTnqfej yCSjxAoQ7CsV4JwlYNBzRO8mOE0Z54vJN4SDzvlCKOz8ejSzPZHiFaHEfr123T7wnKZKSVhtxqf7 lXyS7RDGBTKCUbK1WnbSRTWYhaYzc4jJfnw5Bj0qe23rkYFkIa2fKFm25wItuBy..5TipKBjiM6D dPEDt3R_b1Gg_gDxuRIWrX4KTVL7lwXuaJkdpJDjRXlu8erMandWoIoo1ROu2JZk.5uOt9y6N8fQ zJqB9Y4pkFm6MYntfxQkQ5sL9h0664po2dFHiwlvxVBxbC.IxHSeB4e0annVgy5amOP_MSE_bvdy PcXvwhpKQ7NxSP5OCcsFyyxc.AmiHm07BpBvFECQx1xtkCQCD6gJK7a5kyJhdXE1aQTrNECy_2J2 52EBCjvJBNIgYclGO5ndsmiU1aDUKdM1dBWdHZOFsL6bS31ZnGIybbAql23iXgqQ_Q2O_0U9GJR5 IOFluw2MZaq20DwF_cKRAHCXK3fAK.sPjlF0gCEb6c9r5xq67f_rRO447s.n_pUp8rI50tz3m5QN rfsgpvQTDpwyJK33flINiN5Ul3vHFB_3w1WoiTd.puUzZT5Ndioq7FiLmV_HxArgn33yPcv52Ddk yw5rU5Uj8SNkfDI5BAryM9M621r281naKfyrRqJ6RRCHlklk5eXMv5VPm4ln_1SsUlbGUWSQPwEd oHmx0j6ojlOjWPEZ962oysGEQzaBooYraPGwxCkuP5LSAPM2IEb3jkHvetOg.nfQf2TATA7MTyUV dclIB0sl6GKsjaUzSoeCCLk9pnD_5XyrIiBXmVcEWMRbd4b0h7L1n49gTcr16fRLI.FqLWNJJ4Fj PkC8sGUKdlGXy7r1VUG_yKcCequLM2vPegnogPuCT8A8QvgS7uxSn03kLe_jWCVIMdTC5wRy13Sy M0q8zczIjQbrA8puCzC.F6.5cCPoYi.KvUTqGbRcNy66NHTkzPOWMWnz4zD6lhjqNZzBVgU7AIay IlYmp0Vly1J9zXAV8zSisyLvIV_hW4.AVDWR2psrd3Mf8aMgqxX64gffvtWBIY5GNEKWW.YzdYIZ 51TEy0iXz1S_EHbnGIrH4GNI5CzxG.Um0DElISR8JvH.V_vg3ZKp05.PNtsPc88obgqx2YLo76Jz EZFt2ZQdJ06_I8XlPiJfByuC9dlqV0qpwvBAx38dtSCxEYm7mB5rk0jbes6vpzDxRDOFr0qPAsMd TLzVJkzACEegdbhOtxhZ2s_LTeKhTfTZH7ucYf7FJRyfJmBMCookLNCvaHEn4xvEZkz_VjK5TnUi _gp5niUiL8CIGncJMIwKppQnbCEuf53yBKnoAk2gipwxn35JB0UyDaE3vOGKIEuE1v1GmpVFfNZq gZ5a_UG9HXXUPYGWQm..xLreBSsdQFmW.C9p_Ee6YzSYUK.R81ESqWKQ- Received: from sonic.gate.mail.ne1.yahoo.com by sonic315.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 16:51:26 +0000 Received: by smtp411.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID e948f3a250728d7566d3e2a83137ba19; Wed, 13 Nov 2019 16:51:20 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH v11 02/25] LSM: Create and manage the lsmblob data structure. Date: Wed, 13 Nov 2019 08:50:48 -0800 Message-Id: <20191113165111.6744-3-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113165111.6744-1-casey@schaufler-ca.com> References: <20191113165111.6744-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org When more than one security module is exporting data to audit and networking sub-systems a single 32 bit integer is no longer sufficient to represent the data. Add a structure to be used instead. The lsmblob structure is currently an array of u32 "secids". There is an entry for each of the security modules built into the system that would use secids if active. The system assigns the module a "slot" when it registers hooks. If modules are compiled in but not registered there will be unused slots. A new lsm_id structure, which contains the name of the LSM and its slot number, is created. There is an instance for each LSM, which assigns the name and passes it to the infrastructure to set the slot. Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 12 ++++++-- include/linux/security.h | 58 ++++++++++++++++++++++++++++++++++++++ security/apparmor/lsm.c | 7 ++++- security/commoncap.c | 7 ++++- security/loadpin/loadpin.c | 8 +++++- security/safesetid/lsm.c | 8 +++++- security/security.c | 28 ++++++++++++++---- security/selinux/hooks.c | 8 +++++- security/smack/smack_lsm.c | 7 ++++- security/tomoyo/tomoyo.c | 8 +++++- security/yama/yama_lsm.c | 7 ++++- 11 files changed, 142 insertions(+), 16 deletions(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 13a67fd1a767..cfe5393840c7 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -2062,6 +2062,14 @@ struct security_hook_heads { struct hlist_head locked_down; } __randomize_layout; +/* + * Information that identifies a security module. + */ +struct lsm_id { + const char *lsm; /* Name of the LSM */ + int slot; /* Slot in lsmblob if one is allocated */ +}; + /* * Security module hook list structure. * For use with generic list macros for common operations. @@ -2070,7 +2078,7 @@ struct security_hook_list { struct hlist_node list; struct hlist_head *head; union security_list_options hook; - char *lsm; + struct lsm_id *lsmid; } __randomize_layout; /* @@ -2099,7 +2107,7 @@ extern struct security_hook_heads security_hook_heads; extern char *lsm_names; extern void security_add_hooks(struct security_hook_list *hooks, int count, - char *lsm); + struct lsm_id *lsmid); #define LSM_FLAG_LEGACY_MAJOR BIT(0) #define LSM_FLAG_EXCLUSIVE BIT(1) diff --git a/include/linux/security.h b/include/linux/security.h index 9df7547afc0c..5eced28fa0c9 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -126,6 +126,64 @@ enum lockdown_reason { LOCKDOWN_CONFIDENTIALITY_MAX, }; +/* + * Data exported by the security modules + * + * Any LSM that provides secid or secctx based hooks must be included. + */ +#define LSMBLOB_ENTRIES ( \ + (IS_ENABLED(CONFIG_SECURITY_SELINUX) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_SECURITY_SMACK) ? 1 : 0) + \ + (IS_ENABLED(CONFIG_SECURITY_APPARMOR) ? 1 : 0)) + +struct lsmblob { + u32 secid[LSMBLOB_ENTRIES]; +}; + +#define LSMBLOB_INVALID -1 /* Not a valid LSM slot number */ +#define LSMBLOB_NEEDED -2 /* Slot requested on initialization */ +#define LSMBLOB_NOT_NEEDED -3 /* Slot not requested */ + +/** + * lsmblob_init - initialize an lsmblob structure. + * @blob: Pointer to the data to initialize + * @secid: The initial secid value + * + * Set all secid for all modules to the specified value. + */ +static inline void lsmblob_init(struct lsmblob *blob, u32 secid) +{ + int i; + + for (i = 0; i < LSMBLOB_ENTRIES; i++) + blob->secid[i] = secid; +} + +/** + * lsmblob_is_set - report if there is an value in the lsmblob + * @blob: Pointer to the exported LSM data + * + * Returns true if there is a secid set, false otherwise + */ +static inline bool lsmblob_is_set(struct lsmblob *blob) +{ + struct lsmblob empty = {}; + + return !!memcmp(blob, &empty, sizeof(*blob)); +} + +/** + * lsmblob_equal - report if the two lsmblob's are equal + * @bloba: Pointer to one LSM data + * @blobb: Pointer to the other LSM data + * + * Returns true if all entries in the two are equal, false otherwise + */ +static inline bool lsmblob_equal(struct lsmblob *bloba, struct lsmblob *blobb) +{ + return !memcmp(bloba, blobb, sizeof(*bloba)); +} + /* These functions are in security/commoncap.c */ extern int cap_capable(const struct cred *cred, struct user_namespace *ns, int cap, unsigned int opts); diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c index 4093fa231671..11845348eefb 100644 --- a/security/apparmor/lsm.c +++ b/security/apparmor/lsm.c @@ -1134,6 +1134,11 @@ struct lsm_blob_sizes apparmor_blob_sizes __lsm_ro_after_init = { .lbs_sock = sizeof(struct aa_sk_ctx), }; +static struct lsm_id apparmor_lsmid __lsm_ro_after_init = { + .lsm = "apparmor", + .slot = LSMBLOB_NEEDED +}; + static struct security_hook_list apparmor_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check), LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme), @@ -1722,7 +1727,7 @@ static int __init apparmor_init(void) goto buffers_out; } security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks), - "apparmor"); + &apparmor_lsmid); /* Report that AppArmor successfully initialized */ apparmor_initialized = 1; diff --git a/security/commoncap.c b/security/commoncap.c index f4ee0ae106b2..9dcfd2a0e891 100644 --- a/security/commoncap.c +++ b/security/commoncap.c @@ -1339,6 +1339,11 @@ int cap_mmap_file(struct file *file, unsigned long reqprot, #ifdef CONFIG_SECURITY +static struct lsm_id capability_lsmid __lsm_ro_after_init = { + .lsm = "capability", + .slot = LSMBLOB_NOT_NEEDED +}; + static struct security_hook_list capability_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(capable, cap_capable), LSM_HOOK_INIT(settime, cap_settime), @@ -1363,7 +1368,7 @@ static struct security_hook_list capability_hooks[] __lsm_ro_after_init = { static int __init capability_init(void) { security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks), - "capability"); + &capability_lsmid); return 0; } diff --git a/security/loadpin/loadpin.c b/security/loadpin/loadpin.c index ee5cb944f4ad..86317e78899f 100644 --- a/security/loadpin/loadpin.c +++ b/security/loadpin/loadpin.c @@ -180,6 +180,11 @@ static int loadpin_load_data(enum kernel_load_data_id id) return loadpin_read_file(NULL, (enum kernel_read_file_id) id); } +static struct lsm_id loadpin_lsmid __lsm_ro_after_init = { + .lsm = "loadpin", + .slot = LSMBLOB_NOT_NEEDED +}; + static struct security_hook_list loadpin_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(sb_free_security, loadpin_sb_free_security), LSM_HOOK_INIT(kernel_read_file, loadpin_read_file), @@ -227,7 +232,8 @@ static int __init loadpin_init(void) pr_info("ready to pin (currently %senforcing)\n", enforce ? "" : "not "); parse_exclude(); - security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), "loadpin"); + security_add_hooks(loadpin_hooks, ARRAY_SIZE(loadpin_hooks), + &loadpin_lsmid); return 0; } diff --git a/security/safesetid/lsm.c b/security/safesetid/lsm.c index 7760019ad35d..950dfb7f931e 100644 --- a/security/safesetid/lsm.c +++ b/security/safesetid/lsm.c @@ -149,6 +149,11 @@ static int safesetid_task_fix_setuid(struct cred *new, return -EACCES; } +static struct lsm_id safesetid_lsmid __lsm_ro_after_init = { + .lsm = "safesetid", + .slot = LSMBLOB_NOT_NEEDED +}; + static struct security_hook_list safesetid_security_hooks[] = { LSM_HOOK_INIT(task_fix_setuid, safesetid_task_fix_setuid), LSM_HOOK_INIT(capable, safesetid_security_capable) @@ -157,7 +162,8 @@ static struct security_hook_list safesetid_security_hooks[] = { static int __init safesetid_security_init(void) { security_add_hooks(safesetid_security_hooks, - ARRAY_SIZE(safesetid_security_hooks), "safesetid"); + ARRAY_SIZE(safesetid_security_hooks), + &safesetid_lsmid); /* Report that SafeSetID successfully initialized */ safesetid_initialized = 1; diff --git a/security/security.c b/security/security.c index 5e43d3f64c1f..5f503cadf7f3 100644 --- a/security/security.c +++ b/security/security.c @@ -308,6 +308,7 @@ static void __init ordered_lsm_init(void) init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); init_debug("sock blob size = %d\n", blob_sizes.lbs_sock); init_debug("task blob size = %d\n", blob_sizes.lbs_task); + init_debug("lsmblob size = %lu\n", sizeof(struct lsmblob)); /* * Create any kmem_caches needed for blobs @@ -435,21 +436,36 @@ static int lsm_append(const char *new, char **result) return 0; } +/* + * Current index to use while initializing the lsmblob secid list. + */ +static int lsm_slot __initdata; + /** * security_add_hooks - Add a modules hooks to the hook lists. * @hooks: the hooks to add * @count: the number of hooks to add - * @lsm: the name of the security module + * @lsmid: the the identification information for the security module * * Each LSM has to register its hooks with the infrastructure. + * If the LSM is using hooks that export secids allocate a slot + * for it in the lsmblob. */ void __init security_add_hooks(struct security_hook_list *hooks, int count, - char *lsm) + struct lsm_id *lsmid) { int i; + if (lsmid->slot == LSMBLOB_NEEDED) { + if (lsm_slot >= LSMBLOB_ENTRIES) + panic("%s Too many LSMs registered.\n", __func__); + lsmid->slot = lsm_slot++; + init_debug("%s assigned lsmblob slot %d\n", lsmid->lsm, + lsmid->slot); + } + for (i = 0; i < count; i++) { - hooks[i].lsm = lsm; + hooks[i].lsmid = lsmid; hlist_add_tail_rcu(&hooks[i].list, hooks[i].head); } @@ -458,7 +474,7 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, * and fix this up afterwards. */ if (slab_is_available()) { - if (lsm_append(lsm, &lsm_names) < 0) + if (lsm_append(lsmid->lsm, &lsm_names) < 0) panic("%s - Cannot get early memory.\n", __func__); } } @@ -1906,7 +1922,7 @@ int security_getprocattr(struct task_struct *p, const char *lsm, char *name, struct security_hook_list *hp; hlist_for_each_entry(hp, &security_hook_heads.getprocattr, list) { - if (lsm != NULL && strcmp(lsm, hp->lsm)) + if (lsm != NULL && strcmp(lsm, hp->lsmid->lsm)) continue; return hp->hook.getprocattr(p, name, value); } @@ -1919,7 +1935,7 @@ int security_setprocattr(const char *lsm, const char *name, void *value, struct security_hook_list *hp; hlist_for_each_entry(hp, &security_hook_heads.setprocattr, list) { - if (lsm != NULL && strcmp(lsm, hp->lsm)) + if (lsm != NULL && strcmp(lsm, hp->lsmid->lsm)) continue; return hp->hook.setprocattr(name, value, size); } diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 3feb971068e2..5570a6ed49d5 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6791,6 +6791,11 @@ struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = { .lbs_sock = sizeof(struct sk_security_struct), }; +static struct lsm_id selinux_lsmid __lsm_ro_after_init = { + .lsm = "selinux", + .slot = LSMBLOB_NEEDED +}; + static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr), LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction), @@ -7051,7 +7056,8 @@ static __init int selinux_init(void) hashtab_cache_init(); - security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux"); + security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), + &selinux_lsmid); if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET)) panic("SELinux: Unable to register AVC netcache callback\n"); diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index 796f78580c17..e42336328446 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -4586,6 +4586,11 @@ struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = { .lbs_sock = sizeof(struct socket_smack), }; +static struct lsm_id smack_lsmid __lsm_ro_after_init = { + .lsm = "smack", + .slot = LSMBLOB_NEEDED +}; + static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(ptrace_access_check, smack_ptrace_access_check), LSM_HOOK_INIT(ptrace_traceme, smack_ptrace_traceme), @@ -4784,7 +4789,7 @@ static __init int smack_init(void) /* * Register with LSM */ - security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), "smack"); + security_add_hooks(smack_hooks, ARRAY_SIZE(smack_hooks), &smack_lsmid); smack_enabled = 1; pr_info("Smack: Initializing.\n"); diff --git a/security/tomoyo/tomoyo.c b/security/tomoyo/tomoyo.c index 716c92ec941a..f1968e80f06d 100644 --- a/security/tomoyo/tomoyo.c +++ b/security/tomoyo/tomoyo.c @@ -529,6 +529,11 @@ static void tomoyo_task_free(struct task_struct *task) } } +static struct lsm_id tomoyo_lsmid __lsm_ro_after_init = { + .lsm = "tomoyo", + .slot = LSMBLOB_NOT_NEEDED +}; + /* * tomoyo_security_ops is a "struct security_operations" which is used for * registering TOMOYO. @@ -581,7 +586,8 @@ static int __init tomoyo_init(void) struct tomoyo_task *s = tomoyo_task(current); /* register ourselves with the security framework */ - security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), "tomoyo"); + security_add_hooks(tomoyo_hooks, ARRAY_SIZE(tomoyo_hooks), + &tomoyo_lsmid); pr_info("TOMOYO Linux initialized\n"); s->domain_info = &tomoyo_kernel_domain; atomic_inc(&tomoyo_kernel_domain.users); diff --git a/security/yama/yama_lsm.c b/security/yama/yama_lsm.c index 94dc346370b1..0f0cf7136929 100644 --- a/security/yama/yama_lsm.c +++ b/security/yama/yama_lsm.c @@ -421,6 +421,11 @@ static int yama_ptrace_traceme(struct task_struct *parent) return rc; } +static struct lsm_id yama_lsmid __lsm_ro_after_init = { + .lsm = "yama", + .slot = LSMBLOB_NOT_NEEDED +}; + static struct security_hook_list yama_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(ptrace_access_check, yama_ptrace_access_check), LSM_HOOK_INIT(ptrace_traceme, yama_ptrace_traceme), @@ -477,7 +482,7 @@ static inline void yama_init_sysctl(void) { } static int __init yama_init(void) { pr_info("Yama: becoming mindful.\n"); - security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks), "yama"); + security_add_hooks(yama_hooks, ARRAY_SIZE(yama_hooks), &yama_lsmid); yama_init_sysctl(); return 0; } From patchwork Wed Nov 13 16:50:49 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11242303 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 5CDA014ED for ; Wed, 13 Nov 2019 16:51:38 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id F19A120637 for ; Wed, 13 Nov 2019 16:51:37 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="CuApQNUN" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726590AbfKMQvi (ORCPT ); Wed, 13 Nov 2019 11:51:38 -0500 Received: from sonic315-26.consmr.mail.ne1.yahoo.com ([66.163.190.152]:37286 "EHLO sonic315-26.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726395AbfKMQvi (ORCPT ); Wed, 13 Nov 2019 11:51:38 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573663896; bh=5GryetjHS9DsS6NvVDShqBlcVkATUSaTt+1DCEu2n9w=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=CuApQNUNlSH9OARbibZJ6jR/wSLPkhhBZ7gBUeAZpAJFXDEMllZcB+cEQK+8VOlBMFgWm/xI/eX8dR1w9rBLtBigLFh311vMISa9TiA1OOjiwRFq2jIVS12Vow3gLdH3XQ+mnnVGik7D3/OfX/L0CoDdH9ygPIwA4Y7iAiDAWP11AFdK8fGuoy3qBRy3MsWi5iamxNwjfpCOb8YEEMFw2Q9c2gQ7YwTl56j5HdqzEPzWpQ8m1lfaMsCElsk1nPPHU4eHxY4bDdhVEyw+r9giyCsz8RbEYBVWiH26oli9aCL9LvO/Hvc+y3UnxMpXHqeDdTqZXtJtL2iRMY9rWZKh5Q== X-YMail-OSG: OO_rCNQVM1kWkpRQdxc3TcNzieiBmqCHy.UQvhY2oYzjqC215_FgtPicYT_BhUs qhFW8LXY2JHUBzHHeuzEJBPJELDz4X6jpbdFWQdFG.ZW0dA6wU07qJSZ_ZSRyBgn6i92QtDLbS0J R.Qggx_3Kt5sxzywCww3VOM3UXDyc7rCGZdC9eHI1bWCIXBbYrIR59ZIhKXfd9bUHcjHcZuZE9Qn J0klbbglwtVoibt5T4EL8EMKz8I4LJJ2k8ONs0u68KP82168rtnYPjEh_HHsq3tfK0ONa3TttlX2 tJaI.J2SXEygIObIwaRt02FUF5tIh5TtOiyZTaZsMW49lPspysIwE.bVuzHWhqvSixV0AjXhfR9d ndr73PCwh.o7TvqnobKo3XJV.pKZXLx9tQs.lQrNpdxyv2PfdqQeO2O.ZqhR96DEYWMmX.SD_kW9 sT7Gi0_ZrpBszgJBPWtoaSkUBuHRCLKTvYUwDtbuCmlPv3oie7sAkK1p0JbkG5NLDIzRrKsJ.Wkw 7PRnRgBVNR1dSo5f4Uypxu9o_4rN53HEU09KjxzGB4klF4lUDUJ0wcsDXkkfNhqdqj8YOfzlHoG2 9DHUPb4_Niw_JolInd9XeiOsLq8mFKDdU4Ma6qrHldlcZZenASjICNbyOCk6OsDJv2jkuDAbpZMy l6kLl.CM9mpfTQHfqGgLmWPoozpLlD88IzklgEBsYXVzIPaYkozPLxzwqSQbTw1uEzb8QGP4hcoX BvxU1A0O2WPZhr5KmRGK8rOuLXfGDs8r0yTRDcBCISXXIs3OR._3C7JSkFXgOfecKO.eDzejXKD5 mIAUtXGdmJ2yRRbIuo_9Oo4DP0kf0uhLAr4bM0Vgv6fisA9fjUHkjoaJUEzF3CCYNp8xFDT6yuJy rLth4QM6e3QyCeBvlQAq7AG.OmxLPUIEJU2.7VjVbzaHXjSC13xFIj73ijigsCXqXpe1s5hjGd8o LggUOPfBVtbeW9oRTkRbe3EHrEmL_Po995BzPQvUuFwF6FsZrwcwGDKErXbUXpHOUWBQ0Hm1oehI gm0vexj6tunekum_CIMPGGPzUiA7FZngpKGbwpyRa90CHXtp2c0cB7lf6AD6GYMDivaexPmLNfWm glcUl6F.qJQgNUNQZYtJNLcbMd6FUXheLD_iIWZ5dYyD2cbwZzr37wM21PEh7jOHXi9NU4U2z_U5 H4RuarNRfiF2fO4kLKHibg3qBgzbYdzMFE3D_0lEqA0_OFxXy0SHlWBDTtlzEc4POqR3zrRRkfn1 ZRbEBUImhDccvEidJ1hsHgQGj2uN848lyNTQu2krCXOCRBgix.gw_YPqpLDB9zXUeZHiN7KEOOLQ nGM4zTBfZIp1VC5MK2vO.NT3f1_VXLow0nG_I8zRvL4pbvBZPnwGANkT4Uq.ieJY6eQ9n.3Me02u IRD1L6lxBkrtWDZnwuMBo0DX7QauvyhGLDbzONmyhttk3ryQ1QUDeaI8- Received: from sonic.gate.mail.ne1.yahoo.com by sonic315.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 16:51:36 +0000 Received: by smtp406.mail.ne1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID d1fd8dc550696f9d78519438d0af5fd1; Wed, 13 Nov 2019 16:51:33 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH v11 03/25] LSM: Use lsmblob in security_audit_rule_match Date: Wed, 13 Nov 2019 08:50:49 -0800 Message-Id: <20191113165111.6744-4-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113165111.6744-1-casey@schaufler-ca.com> References: <20191113165111.6744-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Change the secid parameter of security_audit_rule_match to a lsmblob structure pointer. Pass the entry from the lsmblob structure for the approprite slot to the LSM hook. Change the users of security_audit_rule_match to use the lsmblob instead of a u32. In some cases this requires a temporary conversion using lsmblob_init() that will go away when other interfaces get converted. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler --- include/linux/security.h | 7 ++++--- kernel/auditfilter.c | 7 +++++-- kernel/auditsc.c | 14 ++++++++++---- security/integrity/ima/ima.h | 4 ++-- security/integrity/ima/ima_policy.c | 7 +++++-- security/security.c | 18 +++++++++++++++--- 6 files changed, 41 insertions(+), 16 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 5eced28fa0c9..2df58448f1f2 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1835,7 +1835,8 @@ static inline int security_key_getsecurity(struct key *key, char **_buffer) #ifdef CONFIG_SECURITY int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule); int security_audit_rule_known(struct audit_krule *krule); -int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule); +int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op, + void *lsmrule); void security_audit_rule_free(void *lsmrule); #else @@ -1851,8 +1852,8 @@ static inline int security_audit_rule_known(struct audit_krule *krule) return 0; } -static inline int security_audit_rule_match(u32 secid, u32 field, u32 op, - void *lsmrule) +static inline int security_audit_rule_match(struct lsmblob *blob, u32 field, + u32 op, void *lsmrule) { return 0; } diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index b0126e9c0743..356db1dd276c 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1325,6 +1325,7 @@ int audit_filter(int msgtype, unsigned int listtype) struct audit_field *f = &e->rule.fields[i]; pid_t pid; u32 sid; + struct lsmblob blob; switch (f->type) { case AUDIT_PID: @@ -1355,8 +1356,10 @@ int audit_filter(int msgtype, unsigned int listtype) case AUDIT_SUBJ_CLR: if (f->lsm_rule) { security_task_getsecid(current, &sid); - result = security_audit_rule_match(sid, - f->type, f->op, f->lsm_rule); + lsmblob_init(&blob, sid); + result = security_audit_rule_match( + &blob, f->type, + f->op, f->lsm_rule); } break; case AUDIT_EXE: diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 4effe01ebbe2..7566e5b1c419 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -445,6 +445,7 @@ static int audit_filter_rules(struct task_struct *tsk, const struct cred *cred; int i, need_sid = 1; u32 sid; + struct lsmblob blob; unsigned int sessionid; cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation); @@ -643,7 +644,9 @@ static int audit_filter_rules(struct task_struct *tsk, security_task_getsecid(tsk, &sid); need_sid = 0; } - result = security_audit_rule_match(sid, f->type, + lsmblob_init(&blob, sid); + result = security_audit_rule_match(&blob, + f->type, f->op, f->lsm_rule); } @@ -658,15 +661,17 @@ static int audit_filter_rules(struct task_struct *tsk, if (f->lsm_rule) { /* Find files that match */ if (name) { + lsmblob_init(&blob, name->osid); result = security_audit_rule_match( - name->osid, + &blob, f->type, f->op, f->lsm_rule); } else if (ctx) { list_for_each_entry(n, &ctx->names_list, list) { + lsmblob_init(&blob, n->osid); if (security_audit_rule_match( - n->osid, + &blob, f->type, f->op, f->lsm_rule)) { @@ -678,7 +683,8 @@ static int audit_filter_rules(struct task_struct *tsk, /* Find ipc objects that match */ if (!ctx || ctx->type != AUDIT_IPC) break; - if (security_audit_rule_match(ctx->ipc.osid, + lsmblob_init(&blob, ctx->ipc.osid); + if (security_audit_rule_match(&blob, f->type, f->op, f->lsm_rule)) ++result; diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h index 3689081aaf38..5bcd6011ef8c 100644 --- a/security/integrity/ima/ima.h +++ b/security/integrity/ima/ima.h @@ -370,8 +370,8 @@ static inline int security_filter_rule_init(u32 field, u32 op, char *rulestr, return -EINVAL; } -static inline int security_filter_rule_match(u32 secid, u32 field, u32 op, - void *lsmrule) +static inline int security_filter_rule_match(struct lsmblob *blob, u32 field, + u32 op, void *lsmrule) { return -EINVAL; } diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 5380aca2b351..7711cc6a3fe3 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -414,6 +414,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, for (i = 0; i < MAX_LSM_RULES; i++) { int rc = 0; u32 osid; + struct lsmblob blob; if (!rule->lsm[i].rule) continue; @@ -423,7 +424,8 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, case LSM_OBJ_ROLE: case LSM_OBJ_TYPE: security_inode_getsecid(inode, &osid); - rc = security_filter_rule_match(osid, + lsmblob_init(&blob, osid); + rc = security_filter_rule_match(&blob, rule->lsm[i].type, Audit_equal, rule->lsm[i].rule); @@ -431,7 +433,8 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, case LSM_SUBJ_USER: case LSM_SUBJ_ROLE: case LSM_SUBJ_TYPE: - rc = security_filter_rule_match(secid, + lsmblob_init(&blob, secid); + rc = security_filter_rule_match(&blob, rule->lsm[i].type, Audit_equal, rule->lsm[i].rule); diff --git a/security/security.c b/security/security.c index 5f503cadf7f3..7c386cbe4cf3 100644 --- a/security/security.c +++ b/security/security.c @@ -439,7 +439,7 @@ static int lsm_append(const char *new, char **result) /* * Current index to use while initializing the lsmblob secid list. */ -static int lsm_slot __initdata; +static int lsm_slot __lsm_ro_after_init; /** * security_add_hooks - Add a modules hooks to the hook lists. @@ -2412,9 +2412,21 @@ void security_audit_rule_free(void *lsmrule) call_void_hook(audit_rule_free, lsmrule); } -int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule) +int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op, + void *lsmrule) { - return call_int_hook(audit_rule_match, 0, secid, field, op, lsmrule); + struct security_hook_list *hp; + int rc; + + hlist_for_each_entry(hp, &security_hook_heads.audit_rule_match, list) { + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot)) + continue; + rc = hp->hook.audit_rule_match(blob->secid[hp->lsmid->slot], + field, op, lsmrule); + if (rc != 0) + return rc; + } + return 0; } #endif /* CONFIG_AUDIT */ From patchwork Wed Nov 13 16:50:50 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11242297 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 91F95138C for ; Wed, 13 Nov 2019 16:51:37 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 34006204FD for ; Wed, 13 Nov 2019 16:51:37 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="MKzoJ0Ip" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728635AbfKMQvi (ORCPT ); Wed, 13 Nov 2019 11:51:38 -0500 Received: from sonic315-26.consmr.mail.ne1.yahoo.com ([66.163.190.152]:34112 "EHLO sonic315-26.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728632AbfKMQvi (ORCPT ); Wed, 13 Nov 2019 11:51:38 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573663896; bh=eVAcx7o8q0AFLreBS98x3GgYwdFEcr7jaVdmiN42/p8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=MKzoJ0Iplmg0TOHxk8cjDrsEawXycgDYNuDWY3eh6VtnCo3RsmPdLLJcIAEPP8d1lFNBAUxYAI1+M8XggCtmFL/usZBnxW0LE0QEOA21Zd1/ae39yJxftVzhhvvvpTOMd6eCRnpkDTKKI9U8SoLL+YFdDD8IylPgDz0xmWoo6ReaB5u9s4flC25lrobpwQ5v6l5Xss3RI9ROfdTr6b+x3qNIVL1xL4yeNQzp1UB7STOLYRmSgPP8U2jGSnhzh/rMf46iho1Ov0sNIDU2G+pFz4fRHujXcMIjpFwH8JikX+xcBqIEq28mNR/faKf2C0PY+WXUT9o6+GQTILP0XLXizQ== X-YMail-OSG: p55VIqIVM1mqD8jsMnN2t1jZOm8G8.jptgFBHincN1Y68f2RFNZoyZhNMJG2fiU .16DBLJ8B4uKYI5SoDJJaoBPoPfT_clm0.xYC7vzky1PpLdr3Z.g9e2RHV0MnlLYpnlerhhTkXnT THbRDuLyL.CWiNxCrtp7g9fBMXBQc.ydtzIPK4fbS.9J4cAYbYvveavsjBS3xvDaWXa5DkegKOt5 dSLp8JXwpu36bFjgBlUcDHKpA7UK1t7JtfHBQi4vU0myT.FWXn2ErMW2SHuexfGYHbCQHckgNAGO ou2Y74Wm81YvXqATk28ocR9GMx8MH6mAFIx6n2j_xNTDcUmhvP9ZgirA86hu4zzwLoCivCg_o0JF 3hzRbx36Hr_m4eRIUK3Ym8p48jupLsvrzyU9_wlp1xT_BmJBlLndyUpVZCpTrcX5hD6KqGaK_sNX A1RgCwQqreP4JStjDWeSRPdEXpRm2PWjoIuuf90aen5xL3RhE_Orw1PBF.UNCcAE8iGwKEMV4UYm SGOif3DKPXIvr8_c0lxhqor0Sw0xqeUYRPi0bT4dlH62TCZxEVEEy_RLfDB5CfLnKUln6JVU1gc4 De3qC779SyJmt5JZFeEX3guxH5TOgR_XHpOteyJ5UuAAqUiLsLr_bk0n2PGIB.llp34fXD_0PEav JfqBUJaX72Ozea7Y1gkcgWl1UpDVjdDrrWaXdb4zG4recB9pEQdQrTZBsyVBmMlirMd0FuTH6tcC Tsc8YVhluoqWW0DG9cqmeztn8NFGH3NUHQmLc_lgK6zId5z3soYqLeDDcpjZBJaxQDzx45ga9Xh6 eXo.2kYEKfMzH8QIojtMzy4Hr18EKKNDeAGT3duCsVOj4rupHXFyuMos5PKvE3.r7T5CguyVBGfJ v3kmRVpuRBH3NuNWB7LEwzedp7CPMVkTgpt3H7xhL.oIGwaGU98FP7WEehVbcBHpoepfMSbzRIhZ HA9TbPu4aA4ygYTufAG1KVja2Nts9bSLM6AGFRW30m.x4inwnBAimAqfg7gLdWkRz3pRNOXZfKOb L1lakYBcjtXghJLX4Fu070a1uJk4pAi0n1S5lrLPEbZRhOn4ue0RHQiGyIqL49c67z6umOUyADry X33uh6dO.RUjwZNAMTgwMyqVSpDgAFWirhHjIbmgpgs8NT3zF0CywiDKRO_KA6yTF4hNH33PkCey 9idMB_BxdrUXtNUxpYZ_j2qvd8VrbFTh4AcfQo80E62w_wVyQ0OEjZB2ssVowCtg15UgXKeyB7Ua owQoVrXfZpfrtnLTn8cS6UxqwuRiSlbnviKNIbOr_J15GlQC0zGAroRl7uKxyXqKwew4.uDzc0Ox 2GfS3H7OJCOmBZ8Q4xz95KAXLMtkOds4h.XUrTxPoBTIwttnbk8rPKzRlyKOyUda5TMqpod4htbm Fagisg5Xao1gGIB.RgZJLheIUPlaIJ7pPfVbQhEFiwU8IZSdkPV9Dx5UzzQ-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic315.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 16:51:36 +0000 Received: by smtp406.mail.ne1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID d1fd8dc550696f9d78519438d0af5fd1; Wed, 13 Nov 2019 16:51:34 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH v11 04/25] LSM: Use lsmblob in security_kernel_act_as Date: Wed, 13 Nov 2019 08:50:50 -0800 Message-Id: <20191113165111.6744-5-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113165111.6744-1-casey@schaufler-ca.com> References: <20191113165111.6744-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Change the security_kernel_act_as interface to use a lsmblob structure in place of the single u32 secid in support of module stacking. Change it's only caller, set_security_override, to do the same. Change that one's only caller, set_security_override_from_ctx, to call it with the new parameter type. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler --- include/linux/cred.h | 3 ++- include/linux/security.h | 5 +++-- kernel/cred.c | 10 ++++++---- security/security.c | 14 ++++++++++++-- 4 files changed, 23 insertions(+), 9 deletions(-) diff --git a/include/linux/cred.h b/include/linux/cred.h index 18639c069263..03ae0182cba6 100644 --- a/include/linux/cred.h +++ b/include/linux/cred.h @@ -18,6 +18,7 @@ struct cred; struct inode; +struct lsmblob; /* * COW Supplementary groups list @@ -165,7 +166,7 @@ extern const struct cred *override_creds(const struct cred *); extern void revert_creds(const struct cred *); extern struct cred *prepare_kernel_cred(struct task_struct *); extern int change_create_files_as(struct cred *, struct inode *); -extern int set_security_override(struct cred *, u32); +extern int set_security_override(struct cred *, struct lsmblob *); extern int set_security_override_from_ctx(struct cred *, const char *); extern int set_create_files_as(struct cred *, struct inode *); extern int cred_fscmp(const struct cred *, const struct cred *); diff --git a/include/linux/security.h b/include/linux/security.h index 2df58448f1f2..2b0ab47cfb26 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -435,7 +435,7 @@ void security_cred_free(struct cred *cred); int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp); void security_transfer_creds(struct cred *new, const struct cred *old); void security_cred_getsecid(const struct cred *c, u32 *secid); -int security_kernel_act_as(struct cred *new, u32 secid); +int security_kernel_act_as(struct cred *new, struct lsmblob *blob); int security_kernel_create_files_as(struct cred *new, struct inode *inode); int security_kernel_module_request(char *kmod_name); int security_kernel_load_data(enum kernel_load_data_id id); @@ -1041,7 +1041,8 @@ static inline void security_transfer_creds(struct cred *new, { } -static inline int security_kernel_act_as(struct cred *cred, u32 secid) +static inline int security_kernel_act_as(struct cred *cred, + struct lsmblob *blob) { return 0; } diff --git a/kernel/cred.c b/kernel/cred.c index c0a4c12d38b2..846ac4b23c16 100644 --- a/kernel/cred.c +++ b/kernel/cred.c @@ -732,14 +732,14 @@ EXPORT_SYMBOL(prepare_kernel_cred); /** * set_security_override - Set the security ID in a set of credentials * @new: The credentials to alter - * @secid: The LSM security ID to set + * @blob: The LSM security information to set * * Set the LSM security ID in a set of credentials so that the subjective * security is overridden when an alternative set of credentials is used. */ -int set_security_override(struct cred *new, u32 secid) +int set_security_override(struct cred *new, struct lsmblob *blob) { - return security_kernel_act_as(new, secid); + return security_kernel_act_as(new, blob); } EXPORT_SYMBOL(set_security_override); @@ -755,6 +755,7 @@ EXPORT_SYMBOL(set_security_override); */ int set_security_override_from_ctx(struct cred *new, const char *secctx) { + struct lsmblob blob; u32 secid; int ret; @@ -762,7 +763,8 @@ int set_security_override_from_ctx(struct cred *new, const char *secctx) if (ret < 0) return ret; - return set_security_override(new, secid); + lsmblob_init(&blob, secid); + return set_security_override(new, &blob); } EXPORT_SYMBOL(set_security_override_from_ctx); diff --git a/security/security.c b/security/security.c index 7c386cbe4cf3..dd6f212e11af 100644 --- a/security/security.c +++ b/security/security.c @@ -1615,9 +1615,19 @@ void security_cred_getsecid(const struct cred *c, u32 *secid) } EXPORT_SYMBOL(security_cred_getsecid); -int security_kernel_act_as(struct cred *new, u32 secid) +int security_kernel_act_as(struct cred *new, struct lsmblob *blob) { - return call_int_hook(kernel_act_as, 0, new, secid); + struct security_hook_list *hp; + int rc; + + hlist_for_each_entry(hp, &security_hook_heads.kernel_act_as, list) { + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot)) + continue; + rc = hp->hook.kernel_act_as(new, blob->secid[hp->lsmid->slot]); + if (rc != 0) + return rc; + } + return 0; } int security_kernel_create_files_as(struct cred *new, struct inode *inode) From patchwork Wed Nov 13 16:50:51 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11242305 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id AE39B138C for ; Wed, 13 Nov 2019 16:51:42 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4F3A9206CC for ; Wed, 13 Nov 2019 16:51:42 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="m3SYMC9y" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728101AbfKMQvn (ORCPT ); Wed, 13 Nov 2019 11:51:43 -0500 Received: from sonic306-27.consmr.mail.ne1.yahoo.com ([66.163.189.89]:34228 "EHLO sonic306-27.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726395AbfKMQvn (ORCPT ); Wed, 13 Nov 2019 11:51:43 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573663901; bh=fQopPU+QHEIhU1rMxngnZt5dLriz8PONEvXZFfDzj2M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=m3SYMC9yZ76qn62zv4JobQbZEyt2ohP5tsjJ3Z478u3ZjOAhXRGl1sUX3YZVIGFCMSta85n5yfE3X2HOEa7Fe85adtCq2fqGngTZ88IoesbjhN6Fsxrry0EQR6qExTYPAODZBRGPjcuaUYSsA8C7+3i03XAwtJyr1WQkwZMnCFloMmD8py47bZU7iIfKN4bKjVyhO5lipx4CkFUnBFxIONhxit0VUTKNDdvpVS9EfP/rllm8KztHGWnNWrlUdimIaiUcYM1jMAPTh1QQTYBaYLht+Dg+RxTiHVgCP0fO+7u2W96mRRjePos/Tu4Z9cUPYLNvSJmSG/kElLNnwwjjlw== X-YMail-OSG: XfcuBicVM1n3AKHwRz_Xiv94WMcC8XThpts4M7u0I4lUtI.Ed_5ezRpDo6UnFbB 6BZgGhy7eqxwCwMGUaAxnWOGt0OmJRaW69Ra0VcpNTv1XPyJ1tQCmLzTA59_unJFVnd25ys3qW00 rXqRuOV7pE2BsvhVRCeRIqcd5vREEoxFuENrlgKNQEWISEpOwJdG8ICbpUqt_lFg9yEzKBwjPu_j i.Uyvg9NCJ4McPkUC3Goy85JsD7oHopPPqGHuoKftRjPjFAcyY2iBvJL.t4JqBneUiHAwo2T1zpq 2k_6PQxgMe7va2V1QJZuKi.va6XYD685eTwZExjwvY_emgTL5divBzcS__9j8.JU9Xvmc7umT2wX UFE4nJ4q8Hwz0D4aJyLLSarzFEFFEzUac3zkGGE7n6zYLa5r3k8Fw7LMfxalO_6ZvIZKQxtjbZve BJUzHY_9eT6Uq3Kla_9Y1u6vWhphB5VkVItJz03dfSnZDXkDDpcx6ioQpiD9V_xYAgsThT31_p1O ChQ387M7m_swN8b3l_8vXpVvuR31d2mPoGKVMCuC.qQlS0aZ4LVRUD9RAQKytCB.HXDdUD3Loa6P 17o5yVsilf6EnIShEBiKW9bAUq.M2eq.HNvGsZFe9K0qEUhdkVsz3KfVA2JjqsXCa1okHAL.vCkJ o0R7s9_4XNTtlEY956I3RWoBrFPDzuGN72DfmqU7T8oLXwXWzXVpZGe56fXV1y_JL7vYq1Xo5Kez OcTHTYV4cXrCsMHFqTxjrxFBuI4i0kddwf8u6E8HD3K2dSIvnMqMozBwRO1aBeUg1ASuhMZipYuQ BnDHcEruMeBP1l2rutqdW9_3ftyLn5U4P0R_iS.IA.PeFcN5egzlgVAFRm5l0172kQfyJFp618Qa gE7a.ihS2BraXFpLd0XfbbJU4sUWWyvtTuMug3FrZVEUQl6neawSGomIkMBI4NjIazkI9EoHiLci mzYXVm0gKxuFX3gmHVvQn4JLMc5H.YTx6CC9YFLHl8._w0f2M4aS6VkiGYNoFdwLuaqZPBv6IF.H i1SUeaiDpbL0ubO63r7on5DmTGP6fyBT14oyXTY2i4CmL5eW32RaRSQic8528yqQRRhhuvmqBeMO llltrL0LBm1LWWomYli250w_nD31csQSI9.6GbAYgwbn5YFHlCGQFIuP1ZBByEo9LCdyoBX_K_Ov e56_4qTt8L66jr.p3CzLzbQ5.oiFZ9VDXIce8Lfj2e11hj_pJ7jtsfdhhpKHq2SFTZt76gNNwKd1 jPva8QLsQVYo1n_SaQQY2rzomtBTWlWIdWJFy7PjQdFtg5Tcn5mYS3wnY18r7EkEtDhKURoZ4csG 605yVRrevn6DIOY0tzXJCL18ZZmEaxL844esL06aW6VQlt2Bpat2ZzvnfhY1hxLFl_SKC0XwKV7I jwa5Cp4hmyN9VpVoT548mbt8kvoRi7FpxxBwUaqskoYSyoRd.M9xWnMhsaTssEeQ- Received: from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 16:51:41 +0000 Received: by smtp406.mail.ne1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID d1fd8dc550696f9d78519438d0af5fd1; Wed, 13 Nov 2019 16:51:35 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH v11 05/25] net: Prepare UDS for security module stacking Date: Wed, 13 Nov 2019 08:50:51 -0800 Message-Id: <20191113165111.6744-6-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113165111.6744-1-casey@schaufler-ca.com> References: <20191113165111.6744-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Change the data used in UDS SO_PEERSEC processing from a secid to a more general struct lsmblob. Update the security_socket_getpeersec_dgram() interface to use the lsmblob. There is a small amount of scaffolding code that will come out when the security_secid_to_secctx() code is brought in line with the lsmblob. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler cc: netdev@vger.kernel.org --- include/linux/security.h | 7 +++++-- include/net/af_unix.h | 2 +- include/net/scm.h | 8 +++++--- net/ipv4/ip_sockglue.c | 8 +++++--- net/unix/af_unix.c | 6 +++--- security/security.c | 18 +++++++++++++++--- 6 files changed, 34 insertions(+), 15 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 2b0ab47cfb26..d57f400a307e 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1354,7 +1354,8 @@ int security_socket_shutdown(struct socket *sock, int how); int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb); int security_socket_getpeersec_stream(struct socket *sock, char __user *optval, int __user *optlen, unsigned len); -int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid); +int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, + struct lsmblob *blob); int security_sk_alloc(struct sock *sk, int family, gfp_t priority); void security_sk_free(struct sock *sk); void security_sk_clone(const struct sock *sk, struct sock *newsk); @@ -1492,7 +1493,9 @@ static inline int security_socket_getpeersec_stream(struct socket *sock, char __ return -ENOPROTOOPT; } -static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid) +static inline int security_socket_getpeersec_dgram(struct socket *sock, + struct sk_buff *skb, + struct lsmblob *blob) { return -ENOPROTOOPT; } diff --git a/include/net/af_unix.h b/include/net/af_unix.h index 3426d6dacc45..933492c08b8c 100644 --- a/include/net/af_unix.h +++ b/include/net/af_unix.h @@ -36,7 +36,7 @@ struct unix_skb_parms { kgid_t gid; struct scm_fp_list *fp; /* Passed files */ #ifdef CONFIG_SECURITY_NETWORK - u32 secid; /* Security ID */ + struct lsmblob lsmblob; /* Security LSM data */ #endif u32 consumed; } __randomize_layout; diff --git a/include/net/scm.h b/include/net/scm.h index 1ce365f4c256..e2e71c4bf9d0 100644 --- a/include/net/scm.h +++ b/include/net/scm.h @@ -33,7 +33,7 @@ struct scm_cookie { struct scm_fp_list *fp; /* Passed files */ struct scm_creds creds; /* Skb credentials */ #ifdef CONFIG_SECURITY_NETWORK - u32 secid; /* Passed security ID */ + struct lsmblob lsmblob; /* Passed LSM data */ #endif }; @@ -46,7 +46,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl); #ifdef CONFIG_SECURITY_NETWORK static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm) { - security_socket_getpeersec_dgram(sock, NULL, &scm->secid); + security_socket_getpeersec_dgram(sock, NULL, &scm->lsmblob); } #else static __inline__ void unix_get_peersec_dgram(struct socket *sock, struct scm_cookie *scm) @@ -97,7 +97,9 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc int err; if (test_bit(SOCK_PASSSEC, &sock->flags)) { - err = security_secid_to_secctx(scm->secid, &secdata, &seclen); + /* Scaffolding - it has to be element 0 for now */ + err = security_secid_to_secctx(scm->lsmblob.secid[0], + &secdata, &seclen); if (!err) { put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, seclen, secdata); diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index aa3fd61818c4..6cf57d5ac899 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -130,15 +130,17 @@ static void ip_cmsg_recv_checksum(struct msghdr *msg, struct sk_buff *skb, static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) { + struct lsmblob lb; char *secdata; - u32 seclen, secid; + u32 seclen; int err; - err = security_socket_getpeersec_dgram(NULL, skb, &secid); + err = security_socket_getpeersec_dgram(NULL, skb, &lb); if (err) return; - err = security_secid_to_secctx(secid, &secdata, &seclen); + /* Scaffolding - it has to be element 0 */ + err = security_secid_to_secctx(lb.secid[0], &secdata, &seclen); if (err) return; diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c index 0d8da809bea2..189fd6644e7f 100644 --- a/net/unix/af_unix.c +++ b/net/unix/af_unix.c @@ -138,17 +138,17 @@ static struct hlist_head *unix_sockets_unbound(void *addr) #ifdef CONFIG_SECURITY_NETWORK static void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb) { - UNIXCB(skb).secid = scm->secid; + UNIXCB(skb).lsmblob = scm->lsmblob; } static inline void unix_set_secdata(struct scm_cookie *scm, struct sk_buff *skb) { - scm->secid = UNIXCB(skb).secid; + scm->lsmblob = UNIXCB(skb).lsmblob; } static inline bool unix_secdata_eq(struct scm_cookie *scm, struct sk_buff *skb) { - return (scm->secid == UNIXCB(skb).secid); + return lsmblob_equal(&scm->lsmblob, &(UNIXCB(skb).lsmblob)); } #else static inline void unix_get_secdata(struct scm_cookie *scm, struct sk_buff *skb) diff --git a/security/security.c b/security/security.c index dd6f212e11af..55837706e3ef 100644 --- a/security/security.c +++ b/security/security.c @@ -2108,10 +2108,22 @@ int security_socket_getpeersec_stream(struct socket *sock, char __user *optval, optval, optlen, len); } -int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid) +int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, + struct lsmblob *blob) { - return call_int_hook(socket_getpeersec_dgram, -ENOPROTOOPT, sock, - skb, secid); + struct security_hook_list *hp; + int rc = -ENOPROTOOPT; + + hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_dgram, + list) { + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot)) + continue; + rc = hp->hook.socket_getpeersec_dgram(sock, skb, + &blob->secid[hp->lsmid->slot]); + if (rc != 0) + break; + } + return rc; } EXPORT_SYMBOL(security_socket_getpeersec_dgram); From patchwork Wed Nov 13 16:50:52 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11242309 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 9356A14BC for ; Wed, 13 Nov 2019 16:51:52 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3544B206CC for ; Wed, 13 Nov 2019 16:51:52 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="UuEnHI/I" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727487AbfKMQvx (ORCPT ); Wed, 13 Nov 2019 11:51:53 -0500 Received: from sonic306-27.consmr.mail.ne1.yahoo.com ([66.163.189.89]:45358 "EHLO sonic306-27.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726812AbfKMQvx (ORCPT ); Wed, 13 Nov 2019 11:51:53 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573663911; bh=co4jpZY+mhudboH3Pzmlm1GU8BGwBGVp+kygYlsjIuI=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=UuEnHI/I7mpPubVIHFlt+Yo9yr14yatATRuVemneFQV8KKyTM0gMuxywY5MlU5i8bKzvbVVY04HRIbubpHdasLvG/bQ0DiE9NQKZNKVpOMf4jQOf+1r5//z1PzN5DqA0M5J+xKv1gdaGTMtDvOHXD+yqKPV2d2WOsQy//oTlEtELZlRbMHPRKVsaQLfyZ+0BVEr9Mu/ycy7rv6fA5R9spBsiyQrNdEhyMIYH+GS6dsln+HJWRMEP3O3HuRzB1JRa7INM3sVq6hU0fQ3HwqT3l/4hepyY65bms57MnpRL7KzK/af24xpakSFqWxg0z0gtCCgt0CvnTJtWnesQgGnCfw== X-YMail-OSG: IztB1jAVM1kxtayOaTq9JWMhGt2LS8edd2YylrWsx1pW04XckDoQxVwAECbLNuI HhCD0dnrhxO6OcAMa.Ss2fbGM27Q1ozaQU34Q7uOjqY7jhmA.Zvi70hytKFazVV.on7BexPuuP.f OkdgbfvQVYvH372OQS6WozR6.ywkqRYUTMELtXs7M9AIT0lbKUMCQXsErEOod8PlIsfZexgnOY6C IGNmCo620o_Nx4Ee6LjftopZouE9ulbz3tSAcCOyAp_zYBXCvup1M54tiXbVMIS2Sjaej3c_1wzX BFF6G5T5anvQdZsHcfv5KKMdcl.dhTXZGyNkpn9Whi80jRIfkVA0NRSrOfSP4pgrVKf_wDosatTw XwiJFFJ8eXYtMYGDsO_8_c5t_Vg0RMjOIr4PvOJdySS0vtF5.NeUbKtDP_VhPRpdXgznpS83FGoa GByCp5YG.sSNSqZNeVaqi1qy6J5rIqEx3pQuilxdxtgY__8PTOkJHGicGy5t9Ab2P.w46W2d0KhB zCQm8pkV7PeQj80DTavLrVKuZ7b.y0CG5Wnqc9YOr0AJu793ISZ8ciNuxPCllsl_urvUuqsIHQnL erEXZWZijs530Pw1na437jSj_jVfA0KMFAohkD5n4nmqoH63srx1Opc9nzcLr02umIt.rWwqKVrQ FGAG8.WuSQ27kHrdDxNVBcXCFG86C2krHzXpFF7wQOUjM6oPdcOQzPL1Qsx2L_AccAiu3EuGi1xD NgyUlMXJUuHfYXCE1FzCEamKqS7hvX5jxTsUKYLWxemoRKU8yZS96qKP_LN9lHDHbFCaGtaq_atM x8mWROX1id7CD3nyX.jYy0o2uZItZpHHyJN6PWV65MAmlwA7K3DvR6YTRSEg9DGBLAs79ryrEyBX gqFIUbhlVkwArRK.hJ9AT7qrWLlleZxGWnlnom83xyd78c_8wdeMHPn7X0b4bCgofARgpUEfBVGz JRoJLiNmYKjM0.abNMXs.vCaqdCeXBQGPlvaiWuQr5uHj6BkWPLsGIihTJrMnYbWpY25Z3Lesno_ DsHW46z_FBc532g.LQQZCsdlBBgD4je6p7hByxHaf7Dv8Tg.lsmxu6CXQapJv8O23pkIHDRktnDO e9QuQuJlZZOpTHed2T_IKPJI1mOojm5eEn_MFXcb37w3F_FBaVwaNA8l1dQRVZIXBiWeWa0HiBLL QfEpswVv3ahh5qEIxPSP4lKa6s_Oho93RSIn_FsNZbNLrzQFneMfolMWG0DkiRlQcIGQUJH268BJ knUw6OeKIDqIFaKKgkS31a61z3VFM7Ok1kiBLQOoSMzA8A6R.J8p8zrelBmIW7KMvUWFgKmPxsgQ ldQPp25OVbhL..bPn7WQy3RUvNmvU26_yv1drhbSL1vqs_rocLG6YU7pXf_Ku1le.YfwKV5B4sEz XnpLXiZO8G9dkuP1oIQyNa4_2lAeuaHOe25eJ1HFwcUsrB1jegvLztVFeTthIq54- Received: from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 16:51:51 +0000 Received: by smtp428.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 689fd9ed4f3afbe656322824a2096f21; Wed, 13 Nov 2019 16:51:49 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH v11 06/25] LSM: Use lsmblob in security_secctx_to_secid Date: Wed, 13 Nov 2019 08:50:52 -0800 Message-Id: <20191113165111.6744-7-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113165111.6744-1-casey@schaufler-ca.com> References: <20191113165111.6744-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Change security_secctx_to_secid() to fill in a lsmblob instead of a u32 secid. Multiple LSMs may be able to interpret the string, and this allows for setting whichever secid is appropriate. In some cases there is scaffolding where other interfaces have yet to be converted. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler --- include/linux/security.h | 5 +++-- kernel/cred.c | 4 +--- net/netfilter/nft_meta.c | 13 ++++++------- net/netfilter/xt_SECMARK.c | 5 ++++- net/netlabel/netlabel_unlabeled.c | 14 ++++++++------ security/security.c | 18 +++++++++++++++--- 6 files changed, 37 insertions(+), 22 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index d57f400a307e..b69877a13efa 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -494,7 +494,8 @@ int security_setprocattr(const char *lsm, const char *name, void *value, int security_netlink_send(struct sock *sk, struct sk_buff *skb); int security_ismaclabel(const char *name); int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen); -int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); +int security_secctx_to_secid(const char *secdata, u32 seclen, + struct lsmblob *blob); void security_release_secctx(char *secdata, u32 seclen); void security_inode_invalidate_secctx(struct inode *inode); int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen); @@ -1300,7 +1301,7 @@ static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *secle static inline int security_secctx_to_secid(const char *secdata, u32 seclen, - u32 *secid) + struct lsmblob *blob) { return -EOPNOTSUPP; } diff --git a/kernel/cred.c b/kernel/cred.c index 846ac4b23c16..7fef90f3f10b 100644 --- a/kernel/cred.c +++ b/kernel/cred.c @@ -756,14 +756,12 @@ EXPORT_SYMBOL(set_security_override); int set_security_override_from_ctx(struct cred *new, const char *secctx) { struct lsmblob blob; - u32 secid; int ret; - ret = security_secctx_to_secid(secctx, strlen(secctx), &secid); + ret = security_secctx_to_secid(secctx, strlen(secctx), &blob); if (ret < 0) return ret; - lsmblob_init(&blob, secid); return set_security_override(new, &blob); } EXPORT_SYMBOL(set_security_override_from_ctx); diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c index 317e3a9e8c5b..7c49397c33fd 100644 --- a/net/netfilter/nft_meta.c +++ b/net/netfilter/nft_meta.c @@ -617,21 +617,20 @@ static const struct nla_policy nft_secmark_policy[NFTA_SECMARK_MAX + 1] = { static int nft_secmark_compute_secid(struct nft_secmark *priv) { - u32 tmp_secid = 0; + struct lsmblob blob; int err; - err = security_secctx_to_secid(priv->ctx, strlen(priv->ctx), &tmp_secid); + err = security_secctx_to_secid(priv->ctx, strlen(priv->ctx), &blob); if (err) return err; - if (!tmp_secid) - return -ENOENT; - - err = security_secmark_relabel_packet(tmp_secid); + /* Using le[0] is scaffolding */ + err = security_secmark_relabel_packet(blob.secid[0]); if (err) return err; - priv->secid = tmp_secid; + /* Using le[0] is scaffolding */ + priv->secid = blob.secid[0]; return 0; } diff --git a/net/netfilter/xt_SECMARK.c b/net/netfilter/xt_SECMARK.c index 2317721f3ecb..2d68416b4552 100644 --- a/net/netfilter/xt_SECMARK.c +++ b/net/netfilter/xt_SECMARK.c @@ -45,13 +45,14 @@ secmark_tg(struct sk_buff *skb, const struct xt_action_param *par) static int checkentry_lsm(struct xt_secmark_target_info *info) { + struct lsmblob blob; int err; info->secctx[SECMARK_SECCTX_MAX - 1] = '\0'; info->secid = 0; err = security_secctx_to_secid(info->secctx, strlen(info->secctx), - &info->secid); + &blob); if (err) { if (err == -EINVAL) pr_info_ratelimited("invalid security context \'%s\'\n", @@ -59,6 +60,8 @@ static int checkentry_lsm(struct xt_secmark_target_info *info) return err; } + /* scaffolding during the transition */ + info->secid = blob.secid[0]; if (!info->secid) { pr_info_ratelimited("unable to map security context \'%s\'\n", info->secctx); diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c index d2e4ab8d1cb1..7a5a87f15736 100644 --- a/net/netlabel/netlabel_unlabeled.c +++ b/net/netlabel/netlabel_unlabeled.c @@ -881,7 +881,7 @@ static int netlbl_unlabel_staticadd(struct sk_buff *skb, void *addr; void *mask; u32 addr_len; - u32 secid; + struct lsmblob blob; struct netlbl_audit audit_info; /* Don't allow users to add both IPv4 and IPv6 addresses for a @@ -905,12 +905,13 @@ static int netlbl_unlabel_staticadd(struct sk_buff *skb, ret_val = security_secctx_to_secid( nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]), nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]), - &secid); + &blob); if (ret_val != 0) return ret_val; + /* scaffolding with the [0] */ return netlbl_unlhsh_add(&init_net, - dev_name, addr, mask, addr_len, secid, + dev_name, addr, mask, addr_len, blob.secid[0], &audit_info); } @@ -932,7 +933,7 @@ static int netlbl_unlabel_staticadddef(struct sk_buff *skb, void *addr; void *mask; u32 addr_len; - u32 secid; + struct lsmblob blob; struct netlbl_audit audit_info; /* Don't allow users to add both IPv4 and IPv6 addresses for a @@ -954,12 +955,13 @@ static int netlbl_unlabel_staticadddef(struct sk_buff *skb, ret_val = security_secctx_to_secid( nla_data(info->attrs[NLBL_UNLABEL_A_SECCTX]), nla_len(info->attrs[NLBL_UNLABEL_A_SECCTX]), - &secid); + &blob); if (ret_val != 0) return ret_val; + /* scaffolding with the [0] */ return netlbl_unlhsh_add(&init_net, - NULL, addr, mask, addr_len, secid, + NULL, addr, mask, addr_len, blob.secid[0], &audit_info); } diff --git a/security/security.c b/security/security.c index 55837706e3ef..32bb5383de9b 100644 --- a/security/security.c +++ b/security/security.c @@ -1970,10 +1970,22 @@ int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) } EXPORT_SYMBOL(security_secid_to_secctx); -int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) +int security_secctx_to_secid(const char *secdata, u32 seclen, + struct lsmblob *blob) { - *secid = 0; - return call_int_hook(secctx_to_secid, 0, secdata, seclen, secid); + struct security_hook_list *hp; + int rc; + + lsmblob_init(blob, 0); + hlist_for_each_entry(hp, &security_hook_heads.secctx_to_secid, list) { + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot)) + continue; + rc = hp->hook.secctx_to_secid(secdata, seclen, + &blob->secid[hp->lsmid->slot]); + if (rc != 0) + return rc; + } + return 0; } EXPORT_SYMBOL(security_secctx_to_secid); From patchwork Wed Nov 13 16:50:53 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11242319 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id CCDAC14ED for ; Wed, 13 Nov 2019 16:51:59 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 770B9206CC for ; Wed, 13 Nov 2019 16:51:59 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="SnM3WOD+" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727993AbfKMQwA (ORCPT ); Wed, 13 Nov 2019 11:52:00 -0500 Received: from sonic313-14.consmr.mail.ne1.yahoo.com ([66.163.185.37]:41257 "EHLO sonic313-14.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728632AbfKMQwA (ORCPT ); Wed, 13 Nov 2019 11:52:00 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573663917; bh=/2O/lBuiszp8IGrqgASZVmpsvPg0RqXJ0kHxozSiH40=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=SnM3WOD+WQsQy1gbYUZ/DGIijRPEyHdzVdJ0+94UCe1w85EnCFXRFK/8uzUdtaR5cJWBjG9+85TJlPEFLMhKVdrix3A3PwbmOCK3VJWamhpZpmoEkLNOsoil3Jxtlg2YXnYcn2MPAnZ8tj+6unZEZgFvYPOh6JUOUiNrTELHoanAzx10S2su6UGYzjnuncILOS0N8GeYgMv2cl+0ZZhqEuWmDDajERGz7/7+HujdkyJ0f7x7qPGJJ5epyFJflSy6LO6Vjwb9D60yMy4pGkxT6B8bR04TZiWEMe8PGMepe5niKQYmTRSv63Pbutl20EPq/VdZYSrCpO9lcJa+dSJjhg== X-YMail-OSG: JsDfi5AVM1lA90By4dPB9xMw6bLXmW0Qr5tqTIkZBu0mCsewqGnBc_GgHZw9RMy 4MGODUdKuG4GFQVZ6R348y8627_HXyld8FGYLbxCSuPA1isQbSg6rfynSb1KZhAmpllmN_IsEAmY Sa.Tmp9PstrgP42V5gZNRW_MRFYoiYrii7u0kczkz4ZT2GxrGWOJ9E_G2CtscIvkjtmC.jJEstlc 3gA7Aof.k10n0Qtk600SQnz_n6Ovdxz9XAYNB.VXcphyTSvdEjxDPAEQVrZTczujASmF32grTICD xfSgyWQq1aekRHWssSSJdKscQMbWy23szrlwA3Y2dQc1eynlrUDcAPYPYijV7WoOZno7fZKbCSSK 1SOLtPwrJWmx15V1OgOFqjdoDk.5dv9bU8ZCHbugY9ZRQwpH1d0CgVavz9nApQ9iFJ9sMJEda184 MQna3eyUR5XBMbJshdUhTjhwXBm2IeeFy1xNaafI7LWF5qNGLSO1eRt.RpYFWCpTWVYeKsJ4jwSd _nG2HrzThRpTfnj7BH4atHMNM1vlvYqmjrNB2aEiuAIr.wAvCovkCpJlsGFgClDGt7pcSkNUtwL. Har9Y1rlnYx2Z4fZ6bYuROOjmglrR9vbHIngk6vU7fu0UOnIxQRy2UEybaJ7x_js_N_WrIAQnd61 CgMt6.zDZOSyBUjtQmF9aWbW4qRRl3kBry2Fb67r5OlGsIOsBwm3gYhjIgQWJJRwpbq6yd3_6Ze5 UtgxjhkNjJhs9UWdbN3kT.xQQIcxyla7ZJVtkxN3JyaSbVQpGd1GFC.THqJ4wJzEH4n1vMtXKzFY CCdhlm9TPdzB2Z7vEHSQz12LEkei5XD3ITznahZNgUTV5KaKMIYQL._me8CSFonZ_fqbUMr7BRHl EW3c5dmNouoc.MrgGt7CVnUVt_DOB8Lg_HYCVGa26V9BczJIo.iGgxd8wyfp8WeqoneH8xmyRpnV XqzMI5daFyVGfHqgLEgTwcjEZwK3gyU1DhFtonla4VfNK5uVPBcR_rs38sHFSE5CBpSnEPo1odYt ZpIpmLzBtK89JSuJs4eigze8vv.ZZ.zcau5GducW1fUkM5OSzmC_EUcrYPIOYs4N9LXEnyGO.PQx am.0htgLEEOAtupf6jp1kLaAkw8iFgcouOPI.F002MRy4kgENZOzFKiZz9yIufB6Tj69mCPrkwS5 JIkI67HbS4BACwbghPM2GrJLJ6QGAdTPTSDOG9mF.xfBnkEob6VO4DW8XHCoMicHrnR8RWKwg9A0 3uxaoJi3yZPpEr2UTe5riCu3SS6u3NPjfC3ipLFFtnvIaphF8gJ5BOf1j99PxOFj.0r2GX476rHW VfrQXW2rWn_3N61R57FQTO2IVB059_AYvCRTSZ6yjcMBR4KBGT29jz9QhYxEjAlQrpAlo6AiuQvm 3T3PHk96HE7DslOIdI6uBsOzpGB4wL9bRHM6uiDk8Bi8dL9GYSm7YYN4fkA-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic313.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 16:51:57 +0000 Received: by smtp428.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 689fd9ed4f3afbe656322824a2096f21; Wed, 13 Nov 2019 16:51:52 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH v11 07/25] LSM: Use lsmblob in security_secid_to_secctx Date: Wed, 13 Nov 2019 08:50:53 -0800 Message-Id: <20191113165111.6744-8-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113165111.6744-1-casey@schaufler-ca.com> References: <20191113165111.6744-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Change security_secid_to_secctx() to take a lsmblob as input instead of a u32 secid. It will then call the LSM hooks using the lsmblob element allocated for that module. The callers have been updated as well. This allows for the possibility that more than one module may be called upon to translate a secid to a string, as can occur in the audit code. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler cc: netdev@vger.kernel.org --- drivers/android/binder.c | 4 +++- include/linux/security.h | 5 +++-- include/net/scm.h | 5 ++--- kernel/audit.c | 9 +++++++-- kernel/auditsc.c | 14 ++++++++++---- net/ipv4/ip_sockglue.c | 3 +-- net/netfilter/nf_conntrack_netlink.c | 8 ++++++-- net/netfilter/nf_conntrack_standalone.c | 4 +++- net/netfilter/nfnetlink_queue.c | 8 ++++++-- net/netlabel/netlabel_unlabeled.c | 18 ++++++++++++++---- net/netlabel/netlabel_user.c | 6 +++--- security/security.c | 16 +++++++++++++--- 12 files changed, 71 insertions(+), 29 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 265d9dd46a5e..5f4702b4c507 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -3109,10 +3109,12 @@ static void binder_transaction(struct binder_proc *proc, if (target_node && target_node->txn_security_ctx) { u32 secid; + struct lsmblob blob; size_t added_size; security_task_getsecid(proc->tsk, &secid); - ret = security_secid_to_secctx(secid, &secctx, &secctx_sz); + lsmblob_init(&blob, secid); + ret = security_secid_to_secctx(&blob, &secctx, &secctx_sz); if (ret) { return_error = BR_FAILED_REPLY; return_error_param = ret; diff --git a/include/linux/security.h b/include/linux/security.h index b69877a13efa..a3e99bccb1bb 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -493,7 +493,7 @@ int security_setprocattr(const char *lsm, const char *name, void *value, size_t size); int security_netlink_send(struct sock *sk, struct sk_buff *skb); int security_ismaclabel(const char *name); -int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen); +int security_secid_to_secctx(struct lsmblob *blob, char **secdata, u32 *seclen); int security_secctx_to_secid(const char *secdata, u32 seclen, struct lsmblob *blob); void security_release_secctx(char *secdata, u32 seclen); @@ -1294,7 +1294,8 @@ static inline int security_ismaclabel(const char *name) return 0; } -static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) +static inline int security_secid_to_secctx(struct lsmblob *blob, + char **secdata, u32 *seclen) { return -EOPNOTSUPP; } diff --git a/include/net/scm.h b/include/net/scm.h index e2e71c4bf9d0..31ae605fcc0a 100644 --- a/include/net/scm.h +++ b/include/net/scm.h @@ -97,9 +97,8 @@ static inline void scm_passec(struct socket *sock, struct msghdr *msg, struct sc int err; if (test_bit(SOCK_PASSSEC, &sock->flags)) { - /* Scaffolding - it has to be element 0 for now */ - err = security_secid_to_secctx(scm->lsmblob.secid[0], - &secdata, &seclen); + err = security_secid_to_secctx(&scm->lsmblob, &secdata, + &seclen); if (!err) { put_cmsg(msg, SOL_SOCKET, SCM_SECURITY, seclen, secdata); diff --git a/kernel/audit.c b/kernel/audit.c index da8dc0db5bd3..2f8e89eaf3e5 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1417,7 +1417,10 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh) case AUDIT_SIGNAL_INFO: len = 0; if (audit_sig_sid) { - err = security_secid_to_secctx(audit_sig_sid, &ctx, &len); + struct lsmblob blob; + + lsmblob_init(&blob, audit_sig_sid); + err = security_secid_to_secctx(&blob, &ctx, &len); if (err) return err; } @@ -2060,12 +2063,14 @@ int audit_log_task_context(struct audit_buffer *ab) unsigned len; int error; u32 sid; + struct lsmblob blob; security_task_getsecid(current, &sid); if (!sid) return 0; - error = security_secid_to_secctx(sid, &ctx, &len); + lsmblob_init(&blob, sid); + error = security_secid_to_secctx(&blob, &ctx, &len); if (error) { if (error != -EINVAL) goto error_path; diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 7566e5b1c419..04803c3099b2 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -966,6 +966,7 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid, char *ctx = NULL; u32 len; int rc = 0; + struct lsmblob blob; ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID); if (!ab) @@ -975,7 +976,8 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid, from_kuid(&init_user_ns, auid), from_kuid(&init_user_ns, uid), sessionid); if (sid) { - if (security_secid_to_secctx(sid, &ctx, &len)) { + lsmblob_init(&blob, sid); + if (security_secid_to_secctx(&blob, &ctx, &len)) { audit_log_format(ab, " obj=(none)"); rc = 1; } else { @@ -1218,7 +1220,10 @@ static void show_special(struct audit_context *context, int *call_panic) if (osid) { char *ctx = NULL; u32 len; - if (security_secid_to_secctx(osid, &ctx, &len)) { + struct lsmblob blob; + + lsmblob_init(&blob, osid); + if (security_secid_to_secctx(&blob, &ctx, &len)) { audit_log_format(ab, " osid=%u", osid); *call_panic = 1; } else { @@ -1368,9 +1373,10 @@ static void audit_log_name(struct audit_context *context, struct audit_names *n, if (n->osid != 0) { char *ctx = NULL; u32 len; + struct lsmblob blob; - if (security_secid_to_secctx( - n->osid, &ctx, &len)) { + lsmblob_init(&blob, n->osid); + if (security_secid_to_secctx(&blob, &ctx, &len)) { audit_log_format(ab, " osid=%u", n->osid); if (call_panic) *call_panic = 2; diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c index 6cf57d5ac899..1ca97d0cb4a9 100644 --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -139,8 +139,7 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb) if (err) return; - /* Scaffolding - it has to be element 0 */ - err = security_secid_to_secctx(lb.secid[0], &secdata, &seclen); + err = security_secid_to_secctx(&lb, &secdata, &seclen); if (err) return; diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c index e2d13cd18875..0412f6744185 100644 --- a/net/netfilter/nf_conntrack_netlink.c +++ b/net/netfilter/nf_conntrack_netlink.c @@ -331,8 +331,10 @@ static int ctnetlink_dump_secctx(struct sk_buff *skb, const struct nf_conn *ct) struct nlattr *nest_secctx; int len, ret; char *secctx; + struct lsmblob blob; - ret = security_secid_to_secctx(ct->secmark, &secctx, &len); + lsmblob_init(&blob, ct->secmark); + ret = security_secid_to_secctx(&blob, &secctx, &len); if (ret) return 0; @@ -621,8 +623,10 @@ static inline int ctnetlink_secctx_size(const struct nf_conn *ct) { #ifdef CONFIG_NF_CONNTRACK_SECMARK int len, ret; + struct lsmblob blob; - ret = security_secid_to_secctx(ct->secmark, NULL, &len); + lsmblob_init(&blob, ct->secmark); + ret = security_secid_to_secctx(&blob, NULL, &len); if (ret) return 0; diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c index 410809c669e1..183a85412155 100644 --- a/net/netfilter/nf_conntrack_standalone.c +++ b/net/netfilter/nf_conntrack_standalone.c @@ -175,8 +175,10 @@ static void ct_show_secctx(struct seq_file *s, const struct nf_conn *ct) int ret; u32 len; char *secctx; + struct lsmblob blob; - ret = security_secid_to_secctx(ct->secmark, &secctx, &len); + lsmblob_init(&blob, ct->secmark); + ret = security_secid_to_secctx(&blob, &secctx, &len); if (ret) return; diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c index feabdfb22920..bfa7f12fde99 100644 --- a/net/netfilter/nfnetlink_queue.c +++ b/net/netfilter/nfnetlink_queue.c @@ -305,13 +305,17 @@ static u32 nfqnl_get_sk_secctx(struct sk_buff *skb, char **secdata) { u32 seclen = 0; #if IS_ENABLED(CONFIG_NETWORK_SECMARK) + struct lsmblob blob; + if (!skb || !sk_fullsock(skb->sk)) return 0; read_lock_bh(&skb->sk->sk_callback_lock); - if (skb->secmark) - security_secid_to_secctx(skb->secmark, secdata, &seclen); + if (skb->secmark) { + lsmblob_init(&blob, skb->secmark); + security_secid_to_secctx(&blob, secdata, &seclen); + } read_unlock_bh(&skb->sk->sk_callback_lock); #endif diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c index 7a5a87f15736..0cda17cb44a0 100644 --- a/net/netlabel/netlabel_unlabeled.c +++ b/net/netlabel/netlabel_unlabeled.c @@ -375,6 +375,7 @@ int netlbl_unlhsh_add(struct net *net, struct audit_buffer *audit_buf = NULL; char *secctx = NULL; u32 secctx_len; + struct lsmblob blob; if (addr_len != sizeof(struct in_addr) && addr_len != sizeof(struct in6_addr)) @@ -437,7 +438,8 @@ int netlbl_unlhsh_add(struct net *net, unlhsh_add_return: rcu_read_unlock(); if (audit_buf != NULL) { - if (security_secid_to_secctx(secid, + lsmblob_init(&blob, secid); + if (security_secid_to_secctx(&blob, &secctx, &secctx_len) == 0) { audit_log_format(audit_buf, " sec_obj=%s", secctx); @@ -474,6 +476,7 @@ static int netlbl_unlhsh_remove_addr4(struct net *net, struct net_device *dev; char *secctx; u32 secctx_len; + struct lsmblob blob; spin_lock(&netlbl_unlhsh_lock); list_entry = netlbl_af4list_remove(addr->s_addr, mask->s_addr, @@ -493,8 +496,10 @@ static int netlbl_unlhsh_remove_addr4(struct net *net, addr->s_addr, mask->s_addr); if (dev != NULL) dev_put(dev); + if (entry != NULL) + lsmblob_init(&blob, entry->secid); if (entry != NULL && - security_secid_to_secctx(entry->secid, + security_secid_to_secctx(&blob, &secctx, &secctx_len) == 0) { audit_log_format(audit_buf, " sec_obj=%s", secctx); security_release_secctx(secctx, secctx_len); @@ -536,6 +541,7 @@ static int netlbl_unlhsh_remove_addr6(struct net *net, struct net_device *dev; char *secctx; u32 secctx_len; + struct lsmblob blob; spin_lock(&netlbl_unlhsh_lock); list_entry = netlbl_af6list_remove(addr, mask, &iface->addr6_list); @@ -554,8 +560,10 @@ static int netlbl_unlhsh_remove_addr6(struct net *net, addr, mask); if (dev != NULL) dev_put(dev); + if (entry != NULL) + lsmblob_init(&blob, entry->secid); if (entry != NULL && - security_secid_to_secctx(entry->secid, + security_secid_to_secctx(&blob, &secctx, &secctx_len) == 0) { audit_log_format(audit_buf, " sec_obj=%s", secctx); security_release_secctx(secctx, secctx_len); @@ -1076,6 +1084,7 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd, u32 secid; char *secctx; u32 secctx_len; + struct lsmblob blob; data = genlmsg_put(cb_arg->skb, NETLINK_CB(cb_arg->nl_cb->skb).portid, cb_arg->seq, &netlbl_unlabel_gnl_family, @@ -1130,7 +1139,8 @@ static int netlbl_unlabel_staticlist_gen(u32 cmd, secid = addr6->secid; } - ret_val = security_secid_to_secctx(secid, &secctx, &secctx_len); + lsmblob_init(&blob, secid); + ret_val = security_secid_to_secctx(&blob, &secctx, &secctx_len); if (ret_val != 0) goto list_cb_failure; ret_val = nla_put(cb_arg->skb, diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c index 3ed4fea2a2de..893301ae0131 100644 --- a/net/netlabel/netlabel_user.c +++ b/net/netlabel/netlabel_user.c @@ -86,6 +86,7 @@ struct audit_buffer *netlbl_audit_start_common(int type, struct audit_buffer *audit_buf; char *secctx; u32 secctx_len; + struct lsmblob blob; if (audit_enabled == AUDIT_OFF) return NULL; @@ -98,10 +99,9 @@ struct audit_buffer *netlbl_audit_start_common(int type, from_kuid(&init_user_ns, audit_info->loginuid), audit_info->sessionid); + lsmblob_init(&blob, audit_info->secid); if (audit_info->secid != 0 && - security_secid_to_secctx(audit_info->secid, - &secctx, - &secctx_len) == 0) { + security_secid_to_secctx(&blob, &secctx, &secctx_len) == 0) { audit_log_format(audit_buf, " subj=%s", secctx); security_release_secctx(secctx, secctx_len); } diff --git a/security/security.c b/security/security.c index 32bb5383de9b..0fc75a31a6bb 100644 --- a/security/security.c +++ b/security/security.c @@ -1963,10 +1963,20 @@ int security_ismaclabel(const char *name) } EXPORT_SYMBOL(security_ismaclabel); -int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) +int security_secid_to_secctx(struct lsmblob *blob, char **secdata, u32 *seclen) { - return call_int_hook(secid_to_secctx, -EOPNOTSUPP, secid, secdata, - seclen); + struct security_hook_list *hp; + int rc; + + hlist_for_each_entry(hp, &security_hook_heads.secid_to_secctx, list) { + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot)) + continue; + rc = hp->hook.secid_to_secctx(blob->secid[hp->lsmid->slot], + secdata, seclen); + if (rc != 0) + return rc; + } + return 0; } EXPORT_SYMBOL(security_secid_to_secctx); From patchwork Wed Nov 13 16:50:54 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11242313 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 99A7E14BC for ; Wed, 13 Nov 2019 16:51:57 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 41765206CC for ; Wed, 13 Nov 2019 16:51:57 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="r8FxsBCn" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728637AbfKMQv6 (ORCPT ); Wed, 13 Nov 2019 11:51:58 -0500 Received: from sonic315-26.consmr.mail.ne1.yahoo.com ([66.163.190.152]:36387 "EHLO sonic315-26.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727112AbfKMQv6 (ORCPT ); Wed, 13 Nov 2019 11:51:58 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573663916; bh=6IK8Jmd19p+jg8RRRWD/snF1OW5tAad5UhaaNLHME/M=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=r8FxsBCnsvRPSum+RXOSJUso7JSBULRwWortt9VVl+5t5dBS7hMInHYTr7cm+BtJGGl28mRMQfvLfB4vJnF+Q6LR2uMQCYnFZ4JTk0tOGfjKNMGpQUSsFP+uYVz1Bb9HM32tcNGzn05M/hjvQsCSILGIbmdt8kJuOArJGlYejvT559wNN9+j/wpElh+1doALadR5nX2cj+NKJqOguaJEqnkJaEj9vMazV3/qS3QvbyFHpi0u5e5IoZZPG8MF4cUfieIQNgtjzsFC0LPwjcme+pAaK0I3+loeFE0wgT/QIaXJ2C16LjLFrHMSe/9tZUGk2VBLfpn+j/3oWzuNiAtiiQ== X-YMail-OSG: PS2uAXsVM1nc8EWcg1BJZfxvzWrvNLyhWg7.ZJrps.IuG3Xtc_R8sKES_Tgjs73 qJG1yQny.1RAmtrlifo9G.LFWIgHjf19915ETH5xY87ClfZYOYc_6PcbuAbUaXGuMIpjjtrV.XDE QaRpzC15uNAEVb5wVl_ZJ9WkzqBZIB_Mcf0nKBfx7Lj9ZfL9LE3ko9woFYR4ReJB5unf8E2wrXIB aR2Jzqu5aUEhVFbiGyPQc5IBvQuMo_5RFTBnAE1Y8rSyu9KxMM037j73nrCIDG.vlXPvKzjtZXNa Zms8UXsVmXkTKj9kxhPkRzmwrm6raazUb8Qtdhpz_KoYKbW6BRcTkFoER53wcO1YV1Kv0FF5OsyX VQJIGT9v1zHxCfT9la30BU5g0mKtjRjD8N7bQemCtKOwsvmpd.ojuhoFXhEIR8JJo4..g9sOCQLe 8ppYRPgxKcphGzvKM_JzfRtrzPROQd1iupN9P.vzCp5Y5Uis8Y7hC1Pha.ZALe65OZRCoFkbMWEU AxSC3rcQAQyllSpf2raWcyYKE4.ALozrPkxImYC2JCVV7V2i8iZkOYuqiN1v3y2nsAuagwxRcDxM Q6sgvFeRwMR.Fbm2yguQLFeIF_zqSBWC54DE9ttghIl.JXJpcGAjfbQrtXsC2jS3Wju7zG4YL51n EI5I7R4XCOht6Uy8sGj_LiE3Sa5.Nc7nIv7_.3LzGno3pjhHU0NCyNNMjx_RhdGar7Id3u2ex7hl BaIUs8xhv_lEQKaVLvkcTS89M.HQodQ8uGyu2stvEP8H1BVSdZsm.iYPiCYoQvvuf.Mf6BFB1z6M Bu94CvCzTEU2nlEnRr.0TLXGOg7HPNN2hVeRGGg50OdVDi4d2NGOV2RdTrKWoLGIEzK5aeozIocD 7v_gCbKp7VYRBxNqQds6Hiumrp8T5PLSBX.83KDWvGIrMZ_KJr2b8D.eK.1QxGs2L04oh.SfL8zr W1KfHS5jgOOGT0OxrVTPr4.X9Bvrntb9ByiHss.lbTJsbQBRMiUn_.GGQZYZV5rjStuzT7sFv5oV 6k9f7LfqwZs5gxyXspsiSKBbl6VJClSeN8aFp9wG6R5X.1ckUzSSXR3HFho2lZG7nXC88OCGL_Bg nfNP22vEE__oKKXC8fsSnmFXCQV8W.Q.g6Sr5owVpchwxAnJvUfZtC7w3WHftTgNxKjuT6lW.Okx tkqNQ44qY8PkE19chSQrMDG7YfUj6gIqpjqFyOaJqGMFY0wDKSpG0K7YC3XQ81genRWjPTkQnXzl 5TYW7bKGi9I3x8qMjEJCRuMwzDz5WyqiT0ferxTLBW8F8NvtuzLDV.kpMn4WoyqHWAlj1CQ56lhQ yu6i2i1YVKk.WlJoIbq9AEJowCRdAolYz4RQaQQG9yGPfwuL_jOemo5OMuVBHORQaXk2zEX7Y1Gx n3JrVXaVNy6VTH7UAhEJcM0Z9.OMvbZ1lwdrGvKCWXOZrnseWtUfs5n9H8Q-- Received: from sonic.gate.mail.ne1.yahoo.com by sonic315.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 16:51:56 +0000 Received: by smtp428.mail.bf1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 689fd9ed4f3afbe656322824a2096f21; Wed, 13 Nov 2019 16:51:54 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH v11 08/25] LSM: Use lsmblob in security_ipc_getsecid Date: Wed, 13 Nov 2019 08:50:54 -0800 Message-Id: <20191113165111.6744-9-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113165111.6744-1-casey@schaufler-ca.com> References: <20191113165111.6744-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org There may be more than one LSM that provides IPC data for auditing. Change security_ipc_getsecid() to fill in a lsmblob structure instead of the u32 secid. The audit data structure containing the secid will be updated later, so there is a bit of scaffolding here. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler --- include/linux/security.h | 7 ++++--- kernel/auditsc.c | 5 ++++- security/security.c | 12 +++++++++--- 3 files changed, 17 insertions(+), 7 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index a3e99bccb1bb..9519b4fb43ae 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -464,7 +464,7 @@ int security_task_prctl(int option, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5); void security_task_to_inode(struct task_struct *p, struct inode *inode); int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag); -void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid); +void security_ipc_getsecid(struct kern_ipc_perm *ipcp, struct lsmblob *blob); int security_msg_msg_alloc(struct msg_msg *msg); void security_msg_msg_free(struct msg_msg *msg); int security_msg_queue_alloc(struct kern_ipc_perm *msq); @@ -1172,9 +1172,10 @@ static inline int security_ipc_permission(struct kern_ipc_perm *ipcp, return 0; } -static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid) +static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp, + struct lsmblob *blob) { - *secid = 0; + lsmblob_init(blob, 0); } static inline int security_msg_msg_alloc(struct msg_msg *msg) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 04803c3099b2..ce8bf2d8f8d2 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -2285,11 +2285,14 @@ void __audit_mq_getsetattr(mqd_t mqdes, struct mq_attr *mqstat) void __audit_ipc_obj(struct kern_ipc_perm *ipcp) { struct audit_context *context = audit_context(); + struct lsmblob blob; context->ipc.uid = ipcp->uid; context->ipc.gid = ipcp->gid; context->ipc.mode = ipcp->mode; context->ipc.has_perm = 0; - security_ipc_getsecid(ipcp, &context->ipc.osid); + security_ipc_getsecid(ipcp, &blob); + /* scaffolding on the [0] - change "osid" to a lsmblob */ + context->ipc.osid = blob.secid[0]; context->type = AUDIT_IPC; } diff --git a/security/security.c b/security/security.c index 0fc75a31a6bb..b60c6a51f622 100644 --- a/security/security.c +++ b/security/security.c @@ -1783,10 +1783,16 @@ int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag) return call_int_hook(ipc_permission, 0, ipcp, flag); } -void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid) +void security_ipc_getsecid(struct kern_ipc_perm *ipcp, struct lsmblob *blob) { - *secid = 0; - call_void_hook(ipc_getsecid, ipcp, secid); + struct security_hook_list *hp; + + lsmblob_init(blob, 0); + hlist_for_each_entry(hp, &security_hook_heads.ipc_getsecid, list) { + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot)) + continue; + hp->hook.ipc_getsecid(ipcp, &blob->secid[hp->lsmid->slot]); + } } int security_msg_msg_alloc(struct msg_msg *msg) From patchwork Wed Nov 13 16:50:55 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11242323 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id B2BAA14BC for ; Wed, 13 Nov 2019 16:52:13 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 4A2BA206D5 for ; Wed, 13 Nov 2019 16:52:13 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="ZpXOVhR7" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728632AbfKMQwO (ORCPT ); Wed, 13 Nov 2019 11:52:14 -0500 Received: from sonic306-27.consmr.mail.ne1.yahoo.com ([66.163.189.89]:36701 "EHLO sonic306-27.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1728002AbfKMQwO (ORCPT ); Wed, 13 Nov 2019 11:52:14 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573663931; bh=pQnVgBDQ9FVixicaxYpRVJb7Y52n1wmRYRG9yF/IRdE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=ZpXOVhR7KNT67bZkS/6huS8hiUXBHGczPC6m+FZZD8aMlpEnT1sTnRz5GHjMgDphBpotQkX5VeJKWDqONU2EiH65M0KTNvxxHNBmx9yrxV0X+mMJLZXbi8oJLkSUmGA6vI/ZibWGzwz+qoXuNefu0hQ8s2cL0qaaktXzDHWGeo/rU2XkCbDLJcLfXpFxPAMVQYRkyGDhQRnKRDvjdx18VnGA8QlcS4NSvOWBgRwZuB8FDDHh8fshcAuh72iGFEYTjMfOmuX1zDDxmnhiWFJ8VwGCjXPwuvBnP9NI8sw/DUQ/JZwlY/w5Y3+KUHYChnNQysGImUyFW47fEl2nysgwsw== X-YMail-OSG: rkCPghIVM1kDO4c2st_BoZCXZky5hwYAabspLHayKwQltfqqVA3u4kYnyb47Tt1 o5jjui9Ai3vEh9FLbZyEt7c_tvpFgzB4bXv5.M61AVmsTR.12K8xKw_W5FcQ76G9icTPgCa6hrlC JyEHfPw_vxvQxUqdNwa7LkMZqReC9mwIsa6Dg9plJQcpgcL1J67KVJLfTzwJkbYrtU3ZUaRA7fzY ShOYgB4PyIZAO.wfK.S32JWprUQdc7Aiy4zYHMh71c8LK1KdAARJkbYoBEpGAurhu9a4ijUq4f6W xwBl8lamfuHPrLAVLZnk8Y00uBMAB5jlfgimkmL3cSam_m8g.zZzwYv5fx_c9BX15.oGQDP4JE9t YJ8gydT.ds9y0j9FaWwC__db38_Su7Eui_ntnHjer1Ap.vG8edfRFnPypk11mOkOa_MuV9yK2b9v rb1CmwdkUXOyG0MaajVlTDmONopcl.KzGUN55eAHVXfNfXFNEurOiD5emEzc9tnpFM8ywLLnBrJb vfYdYTD_.jc3lMbQr5IMs9WieNj5duGQMmLvEJJw336yVA125Ok7_dM8wr.H9_aIs0a0IjjPsP_U 0lij0mCph.qyRY_apUVy0ek9knid.gXIyMyxDDbOEo4LEUt0IFoxa0nAMStK5S17E2NmaXi.rcjJ 4poLibSPfIPXwc1.kyEbRJjn2USGx_Pa2T.GBNb7sqOJWSkj0D0PjBqayo0bLVV3xohWaJFRWzXg A.oJrftMxhBGVd2QJxOpTdijVf9m_xLoNfuA.Dx3wdshCImFbYkiuWgBtgSB_GYWoprigR3zFoG0 ktuXMRiZBBP1xZZSihDgOdbo9DXgdYsTCVVmyd1gmiRHGy3XxSCTh0jWlFYrmFIH2yAkn8vDdqTL KddTB6uGf7nhG2xSpBCXGHirA3pISTKSFr_EDQp_ugow8SjSQZyyXh7w.s6WMcbMrlpi8JCoZqag HeA5jSNKI8r_ear1yaDkXfe0M_OMLfQPl89CTGoiwlsphpeLVrAOHI7bTkBXq5tbZWEbcacg936E _ESd.KYjpd.hBi81r721KZIrkwMfLjY_edHETXPzb7LCAta6gOWqkZX9G7SlqbLuZZeMZnUmdXZA MRK5aIwZavQQUrS0NxHR3ozovNdIRpdZhSJMIN_jzH6aD3ifvlnxGOzSvogHfL06r1wjYrh.jCU8 bv2WctmGPMsdjGeSc3mlqPaD8lZRfbHjWCPrvFO1TTUr9F1UngB4VPcHoFc_tfMd76CJGQ7BXIUL b4gCv5kVzH159Ah7YrDL6FpOM6EHyOFO6b9tM5MACj5AxuagdsJZJJ8DqG3QiiuoTc_75zoI2kYO LZCyddlzfXkRY1CcmHHm4.Il69aNwnZweQwB40cYV3CUodUCLCSv_q5r2ytCysKtvH5xzjrpmzwD 8E6c.uDKMpY.JA5QU1xEYIkK8eXF7EFxRhu0Lg_mCKIt8H0PO1UhDh5O28h1uwc2WkP4- Received: from sonic.gate.mail.ne1.yahoo.com by sonic306.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 16:52:11 +0000 Received: by smtp412.mail.gq1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID f3b88226f6e8715356d93ea0c8357736; Wed, 13 Nov 2019 16:52:07 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH v11 09/25] LSM: Use lsmblob in security_task_getsecid Date: Wed, 13 Nov 2019 08:50:55 -0800 Message-Id: <20191113165111.6744-10-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113165111.6744-1-casey@schaufler-ca.com> References: <20191113165111.6744-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Change the security_task_getsecid() interface to fill in a lsmblob structure instead of a u32 secid in support of LSM stacking. Audit interfaces will need to collect all possible secids for possible reporting. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler cc: linux-integrity@vger.kernel.org --- drivers/android/binder.c | 4 +-- include/linux/security.h | 7 ++--- kernel/audit.c | 11 ++++---- kernel/auditfilter.c | 4 +-- kernel/auditsc.c | 18 ++++++++----- net/netlabel/netlabel_unlabeled.c | 5 +++- net/netlabel/netlabel_user.h | 6 ++++- security/integrity/ima/ima_appraise.c | 4 ++- security/integrity/ima/ima_main.c | 39 ++++++++++++++++----------- security/security.c | 12 ++++++--- 10 files changed, 68 insertions(+), 42 deletions(-) diff --git a/drivers/android/binder.c b/drivers/android/binder.c index 5f4702b4c507..3a7fcdc8dbe2 100644 --- a/drivers/android/binder.c +++ b/drivers/android/binder.c @@ -3108,12 +3108,10 @@ static void binder_transaction(struct binder_proc *proc, t->priority = task_nice(current); if (target_node && target_node->txn_security_ctx) { - u32 secid; struct lsmblob blob; size_t added_size; - security_task_getsecid(proc->tsk, &secid); - lsmblob_init(&blob, secid); + security_task_getsecid(proc->tsk, &blob); ret = security_secid_to_secctx(&blob, &secctx, &secctx_sz); if (ret) { return_error = BR_FAILED_REPLY; diff --git a/include/linux/security.h b/include/linux/security.h index 9519b4fb43ae..67f95a335b5d 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -447,7 +447,7 @@ int security_task_fix_setuid(struct cred *new, const struct cred *old, int security_task_setpgid(struct task_struct *p, pid_t pgid); int security_task_getpgid(struct task_struct *p); int security_task_getsid(struct task_struct *p); -void security_task_getsecid(struct task_struct *p, u32 *secid); +void security_task_getsecid(struct task_struct *p, struct lsmblob *blob); int security_task_setnice(struct task_struct *p, int nice); int security_task_setioprio(struct task_struct *p, int ioprio); int security_task_getioprio(struct task_struct *p); @@ -1099,9 +1099,10 @@ static inline int security_task_getsid(struct task_struct *p) return 0; } -static inline void security_task_getsecid(struct task_struct *p, u32 *secid) +static inline void security_task_getsecid(struct task_struct *p, + struct lsmblob *blob) { - *secid = 0; + lsmblob_init(blob, 0); } static inline int security_task_setnice(struct task_struct *p, int nice) diff --git a/kernel/audit.c b/kernel/audit.c index 2f8e89eaf3e5..fd29186ae977 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -2062,14 +2062,12 @@ int audit_log_task_context(struct audit_buffer *ab) char *ctx = NULL; unsigned len; int error; - u32 sid; struct lsmblob blob; - security_task_getsecid(current, &sid); - if (!sid) + security_task_getsecid(current, &blob); + if (!lsmblob_is_set(&blob)) return 0; - lsmblob_init(&blob, sid); error = security_secid_to_secctx(&blob, &ctx, &len); if (error) { if (error != -EINVAL) @@ -2276,6 +2274,7 @@ int audit_set_loginuid(kuid_t loginuid) int audit_signal_info(int sig, struct task_struct *t) { kuid_t uid = current_uid(), auid; + struct lsmblob blob; if (auditd_test_task(t) && (sig == SIGTERM || sig == SIGHUP || @@ -2286,7 +2285,9 @@ int audit_signal_info(int sig, struct task_struct *t) audit_sig_uid = auid; else audit_sig_uid = uid; - security_task_getsecid(current, &audit_sig_sid); + security_task_getsecid(current, &blob); + /* scaffolding until audit_sig_sid is converted */ + audit_sig_sid = blob.secid[0]; } return audit_signal_info_syscall(t); diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index 356db1dd276c..19cfbe716f9d 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1324,7 +1324,6 @@ int audit_filter(int msgtype, unsigned int listtype) for (i = 0; i < e->rule.field_count; i++) { struct audit_field *f = &e->rule.fields[i]; pid_t pid; - u32 sid; struct lsmblob blob; switch (f->type) { @@ -1355,8 +1354,7 @@ int audit_filter(int msgtype, unsigned int listtype) case AUDIT_SUBJ_SEN: case AUDIT_SUBJ_CLR: if (f->lsm_rule) { - security_task_getsecid(current, &sid); - lsmblob_init(&blob, sid); + security_task_getsecid(current, &blob); result = security_audit_rule_match( &blob, f->type, f->op, f->lsm_rule); diff --git a/kernel/auditsc.c b/kernel/auditsc.c index ce8bf2d8f8d2..cccb681ad081 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -444,7 +444,6 @@ static int audit_filter_rules(struct task_struct *tsk, { const struct cred *cred; int i, need_sid = 1; - u32 sid; struct lsmblob blob; unsigned int sessionid; @@ -641,10 +640,9 @@ static int audit_filter_rules(struct task_struct *tsk, logged upon error */ if (f->lsm_rule) { if (need_sid) { - security_task_getsecid(tsk, &sid); + security_task_getsecid(tsk, &blob); need_sid = 0; } - lsmblob_init(&blob, sid); result = security_audit_rule_match(&blob, f->type, f->op, @@ -2382,12 +2380,15 @@ int __audit_sockaddr(int len, void *a) void __audit_ptrace(struct task_struct *t) { struct audit_context *context = audit_context(); + struct lsmblob blob; context->target_pid = task_tgid_nr(t); context->target_auid = audit_get_loginuid(t); context->target_uid = task_uid(t); context->target_sessionid = audit_get_sessionid(t); - security_task_getsecid(t, &context->target_sid); + security_task_getsecid(t, &blob); + /* scaffolding - until target_sid is converted */ + context->target_sid = blob.secid[0]; memcpy(context->target_comm, t->comm, TASK_COMM_LEN); } @@ -2403,6 +2404,7 @@ int audit_signal_info_syscall(struct task_struct *t) struct audit_aux_data_pids *axp; struct audit_context *ctx = audit_context(); kuid_t t_uid = task_uid(t); + struct lsmblob blob; if (!audit_signals || audit_dummy_context()) return 0; @@ -2414,7 +2416,9 @@ int audit_signal_info_syscall(struct task_struct *t) ctx->target_auid = audit_get_loginuid(t); ctx->target_uid = t_uid; ctx->target_sessionid = audit_get_sessionid(t); - security_task_getsecid(t, &ctx->target_sid); + security_task_getsecid(t, &blob); + /* scaffolding until target_sid is converted */ + ctx->target_sid = blob.secid[0]; memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN); return 0; } @@ -2435,7 +2439,9 @@ int audit_signal_info_syscall(struct task_struct *t) axp->target_auid[axp->pid_count] = audit_get_loginuid(t); axp->target_uid[axp->pid_count] = t_uid; axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t); - security_task_getsecid(t, &axp->target_sid[axp->pid_count]); + security_task_getsecid(t, &blob); + /* scaffolding until target_sid is converted */ + axp->target_sid[axp->pid_count] = blob.secid[0]; memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN); axp->pid_count++; diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c index 0cda17cb44a0..e279b81d9545 100644 --- a/net/netlabel/netlabel_unlabeled.c +++ b/net/netlabel/netlabel_unlabeled.c @@ -1539,11 +1539,14 @@ int __init netlbl_unlabel_defconf(void) int ret_val; struct netlbl_dom_map *entry; struct netlbl_audit audit_info; + struct lsmblob blob; /* Only the kernel is allowed to call this function and the only time * it is called is at bootup before the audit subsystem is reporting * messages so don't worry to much about these values. */ - security_task_getsecid(current, &audit_info.secid); + security_task_getsecid(current, &blob); + /* scaffolding until audit_info.secid is converted */ + audit_info.secid = blob.secid[0]; audit_info.loginuid = GLOBAL_ROOT_UID; audit_info.sessionid = 0; diff --git a/net/netlabel/netlabel_user.h b/net/netlabel/netlabel_user.h index 3c67afce64f1..438b5db6c714 100644 --- a/net/netlabel/netlabel_user.h +++ b/net/netlabel/netlabel_user.h @@ -34,7 +34,11 @@ static inline void netlbl_netlink_auditinfo(struct sk_buff *skb, struct netlbl_audit *audit_info) { - security_task_getsecid(current, &audit_info->secid); + struct lsmblob blob; + + security_task_getsecid(current, &blob); + /* scaffolding until secid is converted */ + audit_info->secid = blob.secid[0]; audit_info->loginuid = audit_get_loginuid(current); audit_info->sessionid = audit_get_sessionid(current); } diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index 136ae4e0ee92..7288a574459b 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -48,11 +48,13 @@ bool is_ima_appraise_enabled(void) int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func) { u32 secid; + struct lsmblob blob; if (!ima_appraise) return 0; - security_task_getsecid(current, &secid); + security_task_getsecid(current, &blob); + lsmblob_secid(&blob, &secid); return ima_match_policy(inode, current_cred(), secid, func, mask, IMA_APPRAISE | IMA_HASH, NULL, NULL); } diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 60027c643ecd..cac654c2faaf 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -380,12 +380,13 @@ static int process_measurement(struct file *file, const struct cred *cred, */ int ima_file_mmap(struct file *file, unsigned long prot) { - u32 secid; + struct lsmblob blob; if (file && (prot & PROT_EXEC)) { - security_task_getsecid(current, &secid); - return process_measurement(file, current_cred(), secid, NULL, - 0, MAY_EXEC, MMAP_CHECK); + security_task_getsecid(current, &blob); + /* scaffolding - until process_measurement changes */ + return process_measurement(file, current_cred(), blob.secid[0], + NULL, 0, MAY_EXEC, MMAP_CHECK); } return 0; @@ -408,10 +409,12 @@ int ima_bprm_check(struct linux_binprm *bprm) { int ret; u32 secid; + struct lsmblob blob; - security_task_getsecid(current, &secid); - ret = process_measurement(bprm->file, current_cred(), secid, NULL, 0, - MAY_EXEC, BPRM_CHECK); + security_task_getsecid(current, &blob); + /* scaffolding until process_measurement changes */ + ret = process_measurement(bprm->file, current_cred(), blob.secid[0], + NULL, 0, MAY_EXEC, BPRM_CHECK); if (ret) return ret; @@ -432,10 +435,11 @@ int ima_bprm_check(struct linux_binprm *bprm) */ int ima_file_check(struct file *file, int mask) { - u32 secid; + struct lsmblob blob; - security_task_getsecid(current, &secid); - return process_measurement(file, current_cred(), secid, NULL, 0, + security_task_getsecid(current, &blob); + /* scaffolding until process_measurement changes */ + return process_measurement(file, current_cred(), blob.secid[0], NULL, 0, mask & (MAY_READ | MAY_WRITE | MAY_EXEC | MAY_APPEND), FILE_CHECK); } @@ -544,7 +548,7 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size, enum kernel_read_file_id read_id) { enum ima_hooks func; - u32 secid; + struct lsmblob blob; if (!file && read_id == READING_FIRMWARE) { if ((ima_appraise & IMA_APPRAISE_FIRMWARE) && @@ -566,9 +570,10 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size, } func = read_idmap[read_id] ?: FILE_CHECK; - security_task_getsecid(current, &secid); - return process_measurement(file, current_cred(), secid, buf, size, - MAY_READ, func); + security_task_getsecid(current, &blob); + /* scaffolding until process_measurement changes */ + return process_measurement(file, current_cred(), blob.secid[0], buf, + size, MAY_READ, func); } /** @@ -687,11 +692,13 @@ static void process_buffer_measurement(const void *buf, int size, void ima_kexec_cmdline(const void *buf, int size) { u32 secid; + struct lsmblob blob; if (buf && size != 0) { - security_task_getsecid(current, &secid); + security_task_getsecid(current, &blob); + /* scaffolding */ process_buffer_measurement(buf, size, "kexec-cmdline", - current_cred(), secid); + current_cred(), blob.secid[0]); } } diff --git a/security/security.c b/security/security.c index b60c6a51f622..e1f216d453bf 100644 --- a/security/security.c +++ b/security/security.c @@ -1700,10 +1700,16 @@ int security_task_getsid(struct task_struct *p) return call_int_hook(task_getsid, 0, p); } -void security_task_getsecid(struct task_struct *p, u32 *secid) +void security_task_getsecid(struct task_struct *p, struct lsmblob *blob) { - *secid = 0; - call_void_hook(task_getsecid, p, secid); + struct security_hook_list *hp; + + lsmblob_init(blob, 0); + hlist_for_each_entry(hp, &security_hook_heads.task_getsecid, list) { + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot)) + continue; + hp->hook.task_getsecid(p, &blob->secid[hp->lsmid->slot]); + } } EXPORT_SYMBOL(security_task_getsecid); From patchwork Wed Nov 13 16:50:56 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 11242329 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 1D0A914ED for ; Wed, 13 Nov 2019 16:52:14 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id BADC5206D5 for ; Wed, 13 Nov 2019 16:52:13 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=yahoo.com header.i=@yahoo.com header.b="MWDN0KTq" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728010AbfKMQwO (ORCPT ); Wed, 13 Nov 2019 11:52:14 -0500 Received: from sonic313-14.consmr.mail.ne1.yahoo.com ([66.163.185.37]:41811 "EHLO sonic313-14.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727112AbfKMQwO (ORCPT ); Wed, 13 Nov 2019 11:52:14 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1573663933; bh=fVLWr87l6j0R/gnScLqNrHSBH1hKgEnFzkqP1Bp6da8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=MWDN0KTqFRGL6PyFl6uZD5BbsXJb8h23Hchjhhg47NNDWKaFc0HffCQFb03dGOyN8LgBxEtZuZKzQISuacrlPvkBdXduKW+FtAcHrM6WmU/vtkFsM4NmUr+qcxOE1VSVUsmE6SMY9phCoCMzwOvb/rv16cbU0WAZ9Lx/9UpiDev7NVi0DIqQKTEQqxcWuVdIcvJrCs61/2+txZm0cfBp5vMdTZSw9FUMuwn2vMt7v2H0HbRKCQLS0UqDAHuzTRN1QiYMGW3GYIVPHeyEckO6j41ME1rRrD5VBxSh+S3HrBLoQmXOKPj4JN18Y3Eby7nQ0E4tnQLYM5ZUEUvWJqIcDQ== X-YMail-OSG: eVp_7AYVM1kaaHmjhM6tYP16fr0mquKLp_8LtAB6mKfI6Gn9OcOF6WpEweuh5Xh vBaaQZJcmwgeyFEzIVpwqqdlnLuSiwxmRwT9_mYs686X1qw.oze.Y3kNbhajCTyZxHkPDEIOR_0G iuPPZQ99LJNysqY3xZYoNS3qGwhY4D0BYZXf0I.h4t1SEq_dU.7TL60PEJgWQPDQLb71pMxTF8pt 16w6kXQ09ryUQBMWtf5wZQziPJ6742.QBdcWGiLgQw0upUj0STqA8Ki_9ibv1ozYhOAXqF0hA_VH lC6GRRzJPdrY7YZQCJvid0lTzLqrtLrvoZoaxg_ivWWxgpt.dcreSBBSQNQx7jXvHmDgg4mlTUJh MVno_qJMDiHitYe4HNXOdc.z9lP9GL9OQbcA1IoPyJ1bKf1TKrpdxVc6fddR.Yb0aR1nZfjughAz esyfp4kZ8.7mDGQoJDfh8xPayvp6ql8QEYS2kbHU28jwjKCgTNc4r8lFI9OOJp.fuY54pvZ1pAz9 OyNJn7CSrMpS0gTYxWlDIpkXfXXtBhEY3uf6CFZwqleMk1YRhdrwPb6.FRU3ONGxH79NCq.A_rLf tno3XcHNXf83DMjCWyT8AI2FDy8k8ssJGtHSJJI5qzAxcIxrtw.lCEnHLmMGJ9mgJb4tuZgFWer7 IyBZZh3q3J_sW_d5ccFCTZykWRKa_cVhCjxGJjglFBQ2ifCbGTsgKrRiwSeGTkM8Fn7QrevKsYv9 d6XGLYWl74q3FGxbn28_gh63vXHB_8aCW8Nt4k2a8jof0vuO9ai73LlGs_uCldEoslpcyeupeLjT Lof.tvNj_CSTOIsEpo7_BPCBMwxQsWu7wQbbQe6gwRgPMnf5u90F6gLlO9pdghTmLuPW1Rip6AXF sS9ZemY36_fVj6BT82b4qE1_Ce7ScIesoR5REzIPFuyqyrdiwGswbJG6R447eDMo.9kmmAdf4CCD PAGqadWIGWUaPJF0cy4IY3iQ0AKLEUL2SfTkllJyjjimXwmKpRzOsPvNsiBm6nRFiany9O_2Rsg8 OkUAckAJ7QSjZSJlk6pkbTp4KUvmw3LbZlFgnE541xTVWBaC3uJzBEC57g2g5t3RMZFWpkiTZ9a. Dh_Bz.IU83dWyKUHnH7606Z6_oGH1m05bVotzJ3omywtZCbfpJtWAWLW_SPdfNMw_fjEZNZFZTgq 19rvhGpyCPPa_UA6KVAJ99reoYchZgaLLDtGCFTiGTR6LDkB4nvBYvsN3KvwNfwUhQhasVhD7fd. 59UQWa8J4q1C8ISewXJTLZbxMWm4bCe4p_LWxGCJMwMBUy9yloWWm5GmTR5mX3..i17TfYNRGWmh h2gcUUhjTrRzLiy_nKx_nE.MFgLUtMcvVj2GzCVBoFcdP9B5x8utDWFAPnsTxdrzDeB3ZTjGpTT6 uonVI96rTtnOdDdInQ0aHa9YQC3bTCM9HGQVrm.X4RJOB.7XrSwpP9nz14x_.4IBcShgQW4uyKvc - Received: from sonic.gate.mail.ne1.yahoo.com by sonic313.consmr.mail.ne1.yahoo.com with HTTP; Wed, 13 Nov 2019 16:52:13 +0000 Received: by smtp412.mail.gq1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID f3b88226f6e8715356d93ea0c8357736; Wed, 13 Nov 2019 16:52:08 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: casey@schaufler-ca.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com, sds@tycho.nsa.gov Subject: [PATCH v11 10/25] LSM: Use lsmblob in security_inode_getsecid Date: Wed, 13 Nov 2019 08:50:56 -0800 Message-Id: <20191113165111.6744-11-casey@schaufler-ca.com> X-Mailer: git-send-email 2.20.1 In-Reply-To: <20191113165111.6744-1-casey@schaufler-ca.com> References: <20191113165111.6744-1-casey@schaufler-ca.com> MIME-Version: 1.0 Sender: selinux-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: selinux@vger.kernel.org Change the security_inode_getsecid() interface to fill in a lsmblob structure instead of a u32 secid. This allows for its callers to gather data from all registered LSMs. Data is provided for IMA and audit. Reviewed-by: Kees Cook Reviewed-by: John Johansen Signed-off-by: Casey Schaufler cc: linux-integrity@vger.kernel.org --- include/linux/security.h | 7 ++++--- kernel/auditsc.c | 6 +++++- security/integrity/ima/ima_policy.c | 4 +--- security/security.c | 11 +++++++++-- 4 files changed, 19 insertions(+), 9 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 67f95a335b5d..a845254fc415 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -407,7 +407,7 @@ int security_inode_killpriv(struct dentry *dentry); int security_inode_getsecurity(struct inode *inode, const char *name, void **buffer, bool alloc); int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags); int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size); -void security_inode_getsecid(struct inode *inode, u32 *secid); +void security_inode_getsecid(struct inode *inode, struct lsmblob *blob); int security_inode_copy_up(struct dentry *src, struct cred **new); int security_inode_copy_up_xattr(const char *name); int security_kernfs_init_security(struct kernfs_node *kn_dir, @@ -922,9 +922,10 @@ static inline int security_inode_listsecurity(struct inode *inode, char *buffer, return 0; } -static inline void security_inode_getsecid(struct inode *inode, u32 *secid) +static inline void security_inode_getsecid(struct inode *inode, + struct lsmblob *blob) { - *secid = 0; + lsmblob_init(blob, 0); } static inline int security_inode_copy_up(struct dentry *src, struct cred **new) diff --git a/kernel/auditsc.c b/kernel/auditsc.c index cccb681ad081..5752e51883d5 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -1931,13 +1931,17 @@ static void audit_copy_inode(struct audit_names *name, const struct dentry *dentry, struct inode *inode, unsigned int flags) { + struct lsmblob blob; + name->ino = inode->i_ino; name->dev = inode->i_sb->s_dev; name->mode = inode->i_mode; name->uid = inode->i_uid; name->gid = inode->i_gid; name->rdev = inode->i_rdev; - security_inode_getsecid(inode, &name->osid); + security_inode_getsecid(inode, &blob); + /* scaffolding until osid is updated */ + name->osid = blob.secid[0]; if (flags & AUDIT_INODE_NOEVAL) { name->fcap_ver = -1; return; diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c index 7711cc6a3fe3..c5417045e165 100644 --- a/security/integrity/ima/ima_policy.c +++ b/security/integrity/ima/ima_policy.c @@ -413,7 +413,6 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, return false; for (i = 0; i < MAX_LSM_RULES; i++) { int rc = 0; - u32 osid; struct lsmblob blob; if (!rule->lsm[i].rule) @@ -423,8 +422,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode, case LSM_OBJ_USER: case LSM_OBJ_ROLE: case LSM_OBJ_TYPE: - security_inode_getsecid(inode, &osid); - lsmblob_init(&blob, osid); + security_inode_getsecid(inode, &blob); rc = security_filter_rule_match(&blob, rule->lsm[i].type, Audit_equal, diff --git a/security/security.c b/security/security.c index e1f216d453bf..bd279a24adfc 100644 --- a/security/security.c +++ b/security/security.c @@ -1386,9 +1386,16 @@ int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer } EXPORT_SYMBOL(security_inode_listsecurity); -void security_inode_getsecid(struct inode *inode, u32 *secid) +void security_inode_getsecid(struct inode *inode, struct lsmblob *blob) { - call_void_hook(inode_getsecid, inode, secid); + struct security_hook_list *hp; + + lsmblob_init(blob, 0); + hlist_for_each_entry(hp, &security_hook_heads.inode_getsecid, list) { + if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot)) + continue; + hp->hook.inode_getsecid(inode, &blob->secid[hp->lsmid->slot]); + } } int security_inode_copy_up(struct dentry *src, struct cred **new)