[PATCH -mm] [LSM] Stacking support for inode_init_security

[PATCH -mm] [LSM] Stacking support for inode_init_security

[serue]

This is basically the same patch as I sent out Friday, except against
2.6.13-rc6-mm1 with stacker applied.  It redefines
security_inode_init_security() to pass a struct list_head to which
security modules can attach their data.  Filesystems can then loop
through the results easily to store each of the xattrs and free the
results.

This is useful both for the stacker LSM, and for any two (or more)
LSMs which might want to cooperate even without stacker.

I've tested this under using Stephen Smalley's sample exploit
originally motivating inode_init_security, as well as with a simple
'touch ab; ls -Z ab'.  Several kernels have been compiled without a
problem.

thanks,
-serge

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
--
 fs/ext2/xattr_security.c |   22 ++++++++++++++--------
 fs/ext3/xattr_security.c |   22 ++++++++++++++--------
 include/linux/security.h |   30 +++++++++++++++++++-----------
 mm/shmem.c               |    6 ++----
 security/dummy.c         |    2 +-
 security/selinux/hooks.c |   42 ++++++++++++++++++++++++++----------------
 6 files changed, 76 insertions(+), 48 deletions(-)

Index: linux-2.6.13-rc6-mm1/include/linux/security.h
===================================================================
--- linux-2.6.13-rc6-mm1.orig/include/linux/security.h	2005-08-19 17:00:39.000000000 -0500
+++ linux-2.6.13-rc6-mm1/include/linux/security.h	2005-08-21 21:11:07.000000000 -0500
@@ -161,6 +161,14 @@ struct swap_info_struct;
 
 #ifdef CONFIG_SECURITY
 
+struct xattr_data {
+	struct list_head list;
+	char *name;
+	void *value;
+	int len;
+};
+
+
 /**
  * struct security_operations - main security structure
  *
@@ -343,9 +351,13 @@ struct swap_info_struct;
  *	then it should return -EOPNOTSUPP to skip this processing.
  *	@inode contains the inode structure of the newly created inode.
  *	@dir contains the inode structure of the parent directory.
- *	@name will be set to the allocated name suffix (e.g. selinux).
- *	@value will be set to the allocated attribute value.
- *	@len will be set to the length of the value.
+ *	@head, if not null, points to a listhead to which to append a
+ *		newly allocated struct xattr_data with the following data:
+ *		@data->name will be set to the allocated name suffix
+ * 			(e.g. selinux).
+ *		@data->value will be set to the allocated attribute value.
+ *		@data->len will be set to the length of the value.
+ *		@data->list is used to add the data to the list_head
  *	Returns 0 if @name and @value have been successfully set,
  *		-EOPNOTSUPP if no security attribute is needed, or
  *		-ENOMEM on memory allocation failure.
@@ -1146,7 +1158,7 @@ struct security_operations {
 	int (*inode_alloc_security) (struct inode *inode);	
 	void (*inode_free_security) (struct inode *inode);
 	int (*inode_init_security) (struct inode *inode, struct inode *dir,
-				    char **name, void **value, size_t *len);
+				    struct list_head *head);
 	int (*inode_create) (struct inode *dir,
 	                     struct dentry *dentry, int mode);
 	int (*inode_link) (struct dentry *old_dentry,
@@ -1497,13 +1509,11 @@ static inline void security_inode_free (
 
 static inline int security_inode_init_security (struct inode *inode,
 						struct inode *dir,
-						char **name,
-						void **value,
-						size_t *len)
+						struct list_head *head)
 {
 	if (unlikely (IS_PRIVATE (inode)))
 		return -EOPNOTSUPP;
-	return security_ops->inode_init_security (inode, dir, name, value, len);
+	return security_ops->inode_init_security (inode, dir, head);
 }
 	
 static inline int security_inode_create (struct inode *dir,
@@ -2186,9 +2196,7 @@ static inline void security_inode_free (
 
 static inline int security_inode_init_security (struct inode *inode,
 						struct inode *dir,
-						char **name,
-						void **value,
-						size_t *len)
+						struct list_head *head)
 {
 	return -EOPNOTSUPP;
 }
Index: linux-2.6.13-rc6-mm1/mm/shmem.c
===================================================================
--- linux-2.6.13-rc6-mm1.orig/mm/shmem.c	2005-08-19 16:59:41.000000000 -0500
+++ linux-2.6.13-rc6-mm1/mm/shmem.c	2005-08-19 17:01:49.000000000 -0500
@@ -1611,8 +1611,7 @@ shmem_mknod(struct inode *dir, struct de
 	int error = -ENOSPC;
 
 	if (inode) {
-		error = security_inode_init_security(inode, dir, NULL, NULL,
-						     NULL);
+		error = security_inode_init_security(inode, dir, NULL);
 		if (error) {
 			if (error != -EOPNOTSUPP) {
 				iput(inode);
@@ -1758,8 +1757,7 @@ static int shmem_symlink(struct inode *d
 	if (!inode)
 		return -ENOSPC;
 
-	error = security_inode_init_security(inode, dir, NULL, NULL,
-					     NULL);
+	error = security_inode_init_security(inode, dir, NULL);
 	if (error) {
 		if (error != -EOPNOTSUPP) {
 			iput(inode);
Index: linux-2.6.13-rc6-mm1/security/dummy.c
===================================================================
--- linux-2.6.13-rc6-mm1.orig/security/dummy.c	2005-08-19 16:59:42.000000000 -0500
+++ linux-2.6.13-rc6-mm1/security/dummy.c	2005-08-19 17:01:49.000000000 -0500
@@ -259,7 +259,7 @@ static void dummy_inode_free_security (s
 }
 
 static int dummy_inode_init_security (struct inode *inode, struct inode *dir,
-				      char **name, void **value, size_t *len)
+				      struct list_head *head)
 {
 	return -EOPNOTSUPP;
 }
Index: linux-2.6.13-rc6-mm1/security/selinux/hooks.c
===================================================================
--- linux-2.6.13-rc6-mm1.orig/security/selinux/hooks.c	2005-08-19 17:00:39.000000000 -0500
+++ linux-2.6.13-rc6-mm1/security/selinux/hooks.c	2005-08-19 17:01:49.000000000 -0500
@@ -1960,13 +1960,13 @@ static void selinux_inode_free_security(
 }
 
 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
-				       char **name, void **value,
-				       size_t *len)
+				       struct list_head *head)
 {
 	struct task_security_struct *tsec;
 	struct inode_security_struct *dsec;
 	struct superblock_security_struct *sbsec;
 	struct inode_security_struct *isec;
+	struct xattr_data *datap;
 	u32 newsid, clen;
 	int rc;
 	char *namep = NULL, *context;
@@ -2002,24 +2002,34 @@ static int selinux_inode_init_security(s
 
 	inode_security_set_sid(inode, newsid);
 
-	if (name) {
-		namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
-		if (!namep)
-			return -ENOMEM;
-		*name = namep;
-	}
+	if (!head)
+		return 0;
 
-	if (value && len) {
-		rc = security_sid_to_context(newsid, &context, &clen);
-		if (rc) {
-			kfree(namep);
-			return rc;
-		}
-		*value = context;
-		*len = clen;
+	datap = kmalloc(sizeof(struct xattr_data), GFP_KERNEL);
+	if (!datap)
+		return -ENOMEM;
+
+	namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
+	if (!namep) {
+		rc = -ENOMEM;
+		goto err;
 	}
 
+	rc = security_sid_to_context(newsid, &context, &clen);
+	if (rc)
+		goto err;
+	datap->value = context;
+	datap->len = clen;
+	datap->name = namep;
+	INIT_LIST_HEAD(&datap->list);
+
+	list_add_tail(&datap->list, head);
 	return 0;
+
+err:
+	kfree(namep);
+	kfree(datap);
+	return rc;
 }
 
 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
Index: linux-2.6.13-rc6-mm1/fs/ext2/xattr_security.c
===================================================================
--- linux-2.6.13-rc6-mm1.orig/fs/ext2/xattr_security.c	2005-08-19 16:59:38.000000000 -0500
+++ linux-2.6.13-rc6-mm1/fs/ext2/xattr_security.c	2005-08-19 17:01:49.000000000 -0500
@@ -50,20 +50,26 @@ int
 ext2_init_security(struct inode *inode, struct inode *dir)
 {
 	int err;
-	size_t len;
-	void *value;
-	char *name;
+	struct xattr_data *p, *n;
+	LIST_HEAD(head);
 
-	err = security_inode_init_security(inode, dir, &name, &value, &len);
+	err = security_inode_init_security(inode, dir, &head);
 	if (err) {
 		if (err == -EOPNOTSUPP)
 			return 0;
 		return err;
 	}
-	err = ext2_xattr_set(inode, EXT2_XATTR_INDEX_SECURITY,
-			     name, value, len, 0);
-	kfree(name);
-	kfree(value);
+
+	list_for_each_entry_safe(p, n, &head, list) {
+		if (!err)
+			err = ext2_xattr_set(inode,
+				EXT2_XATTR_INDEX_SECURITY,
+				p->name, p->value, p->len, 0);
+		list_del(&p->list);
+		kfree(p->name);
+		kfree(p->value);
+		kfree(p);
+	}
 	return err;
 }
 
Index: linux-2.6.13-rc6-mm1/fs/ext3/xattr_security.c
===================================================================
--- linux-2.6.13-rc6-mm1.orig/fs/ext3/xattr_security.c	2005-08-19 16:59:38.000000000 -0500
+++ linux-2.6.13-rc6-mm1/fs/ext3/xattr_security.c	2005-08-19 17:01:49.000000000 -0500
@@ -52,20 +52,26 @@ int
 ext3_init_security(handle_t *handle, struct inode *inode, struct inode *dir)
 {
 	int err;
-	size_t len;
-	void *value;
-	char *name;
+	struct xattr_data *p, *n;
+	LIST_HEAD(head);
 
-	err = security_inode_init_security(inode, dir, &name, &value, &len);
+	err = security_inode_init_security(inode, dir, &head);
 	if (err) {
 		if (err == -EOPNOTSUPP)
 			return 0;
 		return err;
 	}
-	err = ext3_xattr_set_handle(handle, inode, EXT3_XATTR_INDEX_SECURITY,
-				    name, value, len, 0);
-	kfree(name);
-	kfree(value);
+
+	list_for_each_entry_safe(p, n, &head, list) {
+		if (!err)
+			err = ext3_xattr_set_handle(handle, inode,
+				EXT3_XATTR_INDEX_SECURITY,
+				p->name, p->value, p->len, 0);
+		list_del(&p->list);
+		kfree(p->name);
+		kfree(p->value);
+		kfree(p);
+	}
 	return err;
 }
 

[PATCH -mm] [LSM] Stacking support for inode_init_security

[serue]

This is basically the same patch as I sent out Friday, except against
2.6.13-rc6-mm1 with stacker applied.  It redefines
security_inode_init_security() to pass a struct list_head to which
security modules can attach their data.  Filesystems can then loop
through the results easily to store each of the xattrs and free the
results.

This is useful both for the stacker LSM, and for any two (or more)
LSMs which might want to cooperate even without stacker.

I've tested this under using Stephen Smalley's sample exploit
originally motivating inode_init_security, as well as with a simple
'touch ab; ls -Z ab'.  Several kernels have been compiled without a
problem.

thanks,
-serge

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
--
 fs/ext2/xattr_security.c |   22 ++++++++++++++--------
 fs/ext3/xattr_security.c |   22 ++++++++++++++--------
 include/linux/security.h |   30 +++++++++++++++++++-----------
 mm/shmem.c               |    6 ++----
 security/dummy.c         |    2 +-
 security/selinux/hooks.c |   42 ++++++++++++++++++++++++++----------------
 6 files changed, 76 insertions(+), 48 deletions(-)

Index: linux-2.6.13-rc6-mm1/include/linux/security.h
===================================================================
--- linux-2.6.13-rc6-mm1.orig/include/linux/security.h	2005-08-19 17:00:39.000000000 -0500
+++ linux-2.6.13-rc6-mm1/include/linux/security.h	2005-08-21 21:11:07.000000000 -0500
@@ -161,6 +161,14 @@ struct swap_info_struct;
 
 #ifdef CONFIG_SECURITY
 
+struct xattr_data {
+	struct list_head list;
+	char *name;
+	void *value;
+	int len;
+};
+
+
 /**
  * struct security_operations - main security structure
  *
@@ -343,9 +351,13 @@ struct swap_info_struct;
  *	then it should return -EOPNOTSUPP to skip this processing.
  *	@inode contains the inode structure of the newly created inode.
  *	@dir contains the inode structure of the parent directory.
- *	@name will be set to the allocated name suffix (e.g. selinux).
- *	@value will be set to the allocated attribute value.
- *	@len will be set to the length of the value.
+ *	@head, if not null, points to a listhead to which to append a
+ *		newly allocated struct xattr_data with the following data:
+ *		@data->name will be set to the allocated name suffix
+ * 			(e.g. selinux).
+ *		@data->value will be set to the allocated attribute value.
+ *		@data->len will be set to the length of the value.
+ *		@data->list is used to add the data to the list_head
  *	Returns 0 if @name and @value have been successfully set,
  *		-EOPNOTSUPP if no security attribute is needed, or
  *		-ENOMEM on memory allocation failure.
@@ -1146,7 +1158,7 @@ struct security_operations {
 	int (*inode_alloc_security) (struct inode *inode);	
 	void (*inode_free_security) (struct inode *inode);
 	int (*inode_init_security) (struct inode *inode, struct inode *dir,
-				    char **name, void **value, size_t *len);
+				    struct list_head *head);
 	int (*inode_create) (struct inode *dir,
 	                     struct dentry *dentry, int mode);
 	int (*inode_link) (struct dentry *old_dentry,
@@ -1497,13 +1509,11 @@ static inline void security_inode_free (
 
 static inline int security_inode_init_security (struct inode *inode,
 						struct inode *dir,
-						char **name,
-						void **value,
-						size_t *len)
+						struct list_head *head)
 {
 	if (unlikely (IS_PRIVATE (inode)))
 		return -EOPNOTSUPP;
-	return security_ops->inode_init_security (inode, dir, name, value, len);
+	return security_ops->inode_init_security (inode, dir, head);
 }
 	
 static inline int security_inode_create (struct inode *dir,
@@ -2186,9 +2196,7 @@ static inline void security_inode_free (
 
 static inline int security_inode_init_security (struct inode *inode,
 						struct inode *dir,
-						char **name,
-						void **value,
-						size_t *len)
+						struct list_head *head)
 {
 	return -EOPNOTSUPP;
 }
Index: linux-2.6.13-rc6-mm1/mm/shmem.c
===================================================================
--- linux-2.6.13-rc6-mm1.orig/mm/shmem.c	2005-08-19 16:59:41.000000000 -0500
+++ linux-2.6.13-rc6-mm1/mm/shmem.c	2005-08-19 17:01:49.000000000 -0500
@@ -1611,8 +1611,7 @@ shmem_mknod(struct inode *dir, struct de
 	int error = -ENOSPC;
 
 	if (inode) {
-		error = security_inode_init_security(inode, dir, NULL, NULL,
-						     NULL);
+		error = security_inode_init_security(inode, dir, NULL);
 		if (error) {
 			if (error != -EOPNOTSUPP) {
 				iput(inode);
@@ -1758,8 +1757,7 @@ static int shmem_symlink(struct inode *d
 	if (!inode)
 		return -ENOSPC;
 
-	error = security_inode_init_security(inode, dir, NULL, NULL,
-					     NULL);
+	error = security_inode_init_security(inode, dir, NULL);
 	if (error) {
 		if (error != -EOPNOTSUPP) {
 			iput(inode);
Index: linux-2.6.13-rc6-mm1/security/dummy.c
===================================================================
--- linux-2.6.13-rc6-mm1.orig/security/dummy.c	2005-08-19 16:59:42.000000000 -0500
+++ linux-2.6.13-rc6-mm1/security/dummy.c	2005-08-19 17:01:49.000000000 -0500
@@ -259,7 +259,7 @@ static void dummy_inode_free_security (s
 }
 
 static int dummy_inode_init_security (struct inode *inode, struct inode *dir,
-				      char **name, void **value, size_t *len)
+				      struct list_head *head)
 {
 	return -EOPNOTSUPP;
 }
Index: linux-2.6.13-rc6-mm1/security/selinux/hooks.c
===================================================================
--- linux-2.6.13-rc6-mm1.orig/security/selinux/hooks.c	2005-08-19 17:00:39.000000000 -0500
+++ linux-2.6.13-rc6-mm1/security/selinux/hooks.c	2005-08-19 17:01:49.000000000 -0500
@@ -1960,13 +1960,13 @@ static void selinux_inode_free_security(
 }
 
 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
-				       char **name, void **value,
-				       size_t *len)
+				       struct list_head *head)
 {
 	struct task_security_struct *tsec;
 	struct inode_security_struct *dsec;
 	struct superblock_security_struct *sbsec;
 	struct inode_security_struct *isec;
+	struct xattr_data *datap;
 	u32 newsid, clen;
 	int rc;
 	char *namep = NULL, *context;
@@ -2002,24 +2002,34 @@ static int selinux_inode_init_security(s
 
 	inode_security_set_sid(inode, newsid);
 
-	if (name) {
-		namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
-		if (!namep)
-			return -ENOMEM;
-		*name = namep;
-	}
+	if (!head)
+		return 0;
 
-	if (value && len) {
-		rc = security_sid_to_context(newsid, &context, &clen);
-		if (rc) {
-			kfree(namep);
-			return rc;
-		}
-		*value = context;
-		*len = clen;
+	datap = kmalloc(sizeof(struct xattr_data), GFP_KERNEL);
+	if (!datap)
+		return -ENOMEM;
+
+	namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
+	if (!namep) {
+		rc = -ENOMEM;
+		goto err;
 	}
 
+	rc = security_sid_to_context(newsid, &context, &clen);
+	if (rc)
+		goto err;
+	datap->value = context;
+	datap->len = clen;
+	datap->name = namep;
+	INIT_LIST_HEAD(&datap->list);
+
+	list_add_tail(&datap->list, head);
 	return 0;
+
+err:
+	kfree(namep);
+	kfree(datap);
+	return rc;
 }
 
 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
Index: linux-2.6.13-rc6-mm1/fs/ext2/xattr_security.c
===================================================================
--- linux-2.6.13-rc6-mm1.orig/fs/ext2/xattr_security.c	2005-08-19 16:59:38.000000000 -0500
+++ linux-2.6.13-rc6-mm1/fs/ext2/xattr_security.c	2005-08-19 17:01:49.000000000 -0500
@@ -50,20 +50,26 @@ int
 ext2_init_security(struct inode *inode, struct inode *dir)
 {
 	int err;
-	size_t len;
-	void *value;
-	char *name;
+	struct xattr_data *p, *n;
+	LIST_HEAD(head);
 
-	err = security_inode_init_security(inode, dir, &name, &value, &len);
+	err = security_inode_init_security(inode, dir, &head);
 	if (err) {
 		if (err == -EOPNOTSUPP)
 			return 0;
 		return err;
 	}
-	err = ext2_xattr_set(inode, EXT2_XATTR_INDEX_SECURITY,
-			     name, value, len, 0);
-	kfree(name);
-	kfree(value);
+
+	list_for_each_entry_safe(p, n, &head, list) {
+		if (!err)
+			err = ext2_xattr_set(inode,
+				EXT2_XATTR_INDEX_SECURITY,
+				p->name, p->value, p->len, 0);
+		list_del(&p->list);
+		kfree(p->name);
+		kfree(p->value);
+		kfree(p);
+	}
 	return err;
 }
 
Index: linux-2.6.13-rc6-mm1/fs/ext3/xattr_security.c
===================================================================
--- linux-2.6.13-rc6-mm1.orig/fs/ext3/xattr_security.c	2005-08-19 16:59:38.000000000 -0500
+++ linux-2.6.13-rc6-mm1/fs/ext3/xattr_security.c	2005-08-19 17:01:49.000000000 -0500
@@ -52,20 +52,26 @@ int
 ext3_init_security(handle_t *handle, struct inode *inode, struct inode *dir)
 {
 	int err;
-	size_t len;
-	void *value;
-	char *name;
+	struct xattr_data *p, *n;
+	LIST_HEAD(head);
 
-	err = security_inode_init_security(inode, dir, &name, &value, &len);
+	err = security_inode_init_security(inode, dir, &head);
 	if (err) {
 		if (err == -EOPNOTSUPP)
 			return 0;
 		return err;
 	}
-	err = ext3_xattr_set_handle(handle, inode, EXT3_XATTR_INDEX_SECURITY,
-				    name, value, len, 0);
-	kfree(name);
-	kfree(value);
+
+	list_for_each_entry_safe(p, n, &head, list) {
+		if (!err)
+			err = ext3_xattr_set_handle(handle, inode,
+				EXT3_XATTR_INDEX_SECURITY,
+				p->name, p->value, p->len, 0);
+		list_del(&p->list);
+		kfree(p->name);
+		kfree(p->value);
+		kfree(p);
+	}
 	return err;
 }
 


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf

Re: [PATCH -mm 2/3] [LSM] Stacking support for inode_init_security

[serue]

This patch, against the 2.6.13-rc6-mm1 stacker, defines the
inode_init_security() hook.

thanks,
-serge

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
--
 stacker.c |   35 +++++++++++++++++++++++++++++++++++
 1 files changed, 35 insertions(+)

Index: linux-2.6.13-rc6-mm1/security/stacker.c
===================================================================
--- linux-2.6.13-rc6-mm1.orig/security/stacker.c	2005-08-19 17:00:39.000000000 -0500
+++ linux-2.6.13-rc6-mm1/security/stacker.c	2005-08-19 17:01:54.000000000 -0500
@@ -443,6 +443,40 @@ static void stacker_inode_free_security 
 		security_disown_value(h);
 }
 
+static int stacker_inode_init_security(struct inode *inode, struct inode *dir,
+				       struct list_head *head)
+{
+	int ret, succ_ret = -EOPNOTSUPP;
+	struct xattr_data *p, *n;
+	struct module_entry *m;
+
+	rcu_read_lock();
+	stack_for_each_entry(m, &stacked_modules, lsm_list) {
+		if (!m->module_operations.inode_init_security)
+			continue;
+		rcu_read_unlock();
+		ret = m->module_operations.inode_init_security(inode,dir,head);
+		rcu_read_lock();
+		if (ret && ret != -EOPNOTSUPP)
+			goto out_free_data;
+		if (ret == 0)
+			succ_ret = 0;
+	}
+	rcu_read_unlock();
+	return succ_ret;
+
+out_free_data:
+	if (!head)
+		return ret;
+	list_for_each_entry_safe(p, n, head, list) {
+		list_del(&p->list);
+		kfree(p->value);
+		kfree(p->name);
+		kfree(p);
+	}
+	return ret;
+}
+
 static int stacker_inode_create (struct inode *inode, struct dentry *dentry,
 			       int mask)
 {
@@ -1315,6 +1349,7 @@ static struct security_operations stacke
 
 	.inode_alloc_security		= stacker_inode_alloc_security,
 	.inode_free_security		= stacker_inode_free_security,
+	.inode_init_security		= stacker_inode_init_security,
 	.inode_create			= stacker_inode_create,
 	.inode_link			= stacker_inode_link,
 	.inode_unlink			= stacker_inode_unlink,

Re: [PATCH -mm 2/3] [LSM] Stacking support for inode_init_security

[serue]

This patch, against the 2.6.13-rc6-mm1 stacker, defines the
inode_init_security() hook.

thanks,
-serge

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
--
 stacker.c |   35 +++++++++++++++++++++++++++++++++++
 1 files changed, 35 insertions(+)

Index: linux-2.6.13-rc6-mm1/security/stacker.c
===================================================================
--- linux-2.6.13-rc6-mm1.orig/security/stacker.c	2005-08-19 17:00:39.000000000 -0500
+++ linux-2.6.13-rc6-mm1/security/stacker.c	2005-08-19 17:01:54.000000000 -0500
@@ -443,6 +443,40 @@ static void stacker_inode_free_security 
 		security_disown_value(h);
 }
 
+static int stacker_inode_init_security(struct inode *inode, struct inode *dir,
+				       struct list_head *head)
+{
+	int ret, succ_ret = -EOPNOTSUPP;
+	struct xattr_data *p, *n;
+	struct module_entry *m;
+
+	rcu_read_lock();
+	stack_for_each_entry(m, &stacked_modules, lsm_list) {
+		if (!m->module_operations.inode_init_security)
+			continue;
+		rcu_read_unlock();
+		ret = m->module_operations.inode_init_security(inode,dir,head);
+		rcu_read_lock();
+		if (ret && ret != -EOPNOTSUPP)
+			goto out_free_data;
+		if (ret == 0)
+			succ_ret = 0;
+	}
+	rcu_read_unlock();
+	return succ_ret;
+
+out_free_data:
+	if (!head)
+		return ret;
+	list_for_each_entry_safe(p, n, head, list) {
+		list_del(&p->list);
+		kfree(p->value);
+		kfree(p->name);
+		kfree(p);
+	}
+	return ret;
+}
+
 static int stacker_inode_create (struct inode *inode, struct dentry *dentry,
 			       int mask)
 {
@@ -1315,6 +1349,7 @@ static struct security_operations stacke
 
 	.inode_alloc_security		= stacker_inode_alloc_security,
 	.inode_free_security		= stacker_inode_free_security,
+	.inode_init_security		= stacker_inode_init_security,
 	.inode_create			= stacker_inode_create,
 	.inode_link			= stacker_inode_link,
 	.inode_unlink			= stacker_inode_unlink,

Re: [PATCH -mm 3/3] [LSM] Stacking support for inode_init_security

[serue]

This patch adds two stackable test LSMs which only define
inode_init_security().  Any file created while these modules are
loaded should have the xattrs ("security.name1", "value1") and
("security.name2", "value2").

thanks,
-serge

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
--
 testinitsec1.c |   75 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 testinitsec2.c |   75 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 150 insertions(+)

Index: linux-2.6.13-rc6-mm1/security/testinitsec1.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.13-rc6-mm1/security/testinitsec1.c	2005-08-19 17:01:57.000000000 -0500
@@ -0,0 +1,75 @@
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/security.h>
+
+#define VALUE "value1"
+#define NAME "name1"
+#define MY_NAME "testinitsec1"
+static int test_init_security(struct inode *inode, struct inode *dir,
+				       struct list_head *head)
+{
+	char *namep = NULL, *valuep = NULL;
+	struct xattr_data *data = NULL;
+
+	if (!head)
+		return 0;
+
+	data = kmalloc(sizeof(struct xattr_data), GFP_KERNEL);
+	if (!data)
+		goto err;
+	namep = kmalloc(32, GFP_KERNEL);
+	if (!namep)
+		goto err;
+	valuep = kmalloc(32, GFP_KERNEL);
+	if (!valuep)
+		goto err;
+
+	strcpy(namep, NAME);
+	strcpy(valuep, VALUE);
+	data->name = namep;
+	data->value = valuep;
+	data->len = strlen(VALUE);
+	INIT_LIST_HEAD(&data->list);
+	list_add_tail(&data->list, head);
+	return 0;
+err:
+	kfree(namep);
+	kfree(valuep);
+	kfree(data);
+	return -ENOMEM;
+}
+
+static struct security_operations testlsm_security_ops = {
+	.owner =			THIS_MODULE,
+
+	.inode_init_security =		test_init_security,
+};
+
+static int __init testlsm_init (void)
+{
+	if (mod_reg_security (MY_NAME, &testlsm_security_ops, NULL)) {
+		printk (KERN_INFO "Failure registering testlsm "
+			" module with primary security module.\n");
+		return -EINVAL;
+	}
+	return 0;
+}
+
+
+static void __exit testlsm_exit (void)
+{
+	if (unregister_security (&testlsm_security_ops)) {
+		printk (KERN_INFO "Failure unregistering testlsm "
+			"module with the kernel\n");
+	}
+	printk (KERN_INFO "init_security test module removed\n");
+}
+
+security_initcall (testlsm_init);
+module_exit (testlsm_exit);
+
+MODULE_DESCRIPTION("inode_initsecurity test LSM module");
+MODULE_LICENSE("GPL");
+
Index: linux-2.6.13-rc6-mm1/security/testinitsec2.c
===================================================================
--- /dev/null	1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.13-rc6-mm1/security/testinitsec2.c	2005-08-19 17:01:57.000000000 -0500
@@ -0,0 +1,75 @@
+#include <linux/config.h>
+#include <linux/module.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/security.h>
+
+#define VALUE "value2"
+#define NAME "name2"
+#define MY_NAME "testinitsec2"
+static int test_init_security(struct inode *inode, struct inode *dir,
+				       struct list_head *head)
+{
+	char *namep = NULL, *valuep = NULL;
+	struct xattr_data *data = NULL;
+
+	if (!head)
+		return 0;
+
+	data = kmalloc(sizeof(struct xattr_data), GFP_KERNEL);
+	if (!data)
+		goto err;
+	namep = kmalloc(32, GFP_KERNEL);
+	if (!namep)
+		goto err;
+	valuep = kmalloc(32, GFP_KERNEL);
+	if (!valuep)
+		goto err;
+
+	strcpy(namep, NAME);
+	strcpy(valuep, VALUE);
+	data->name = namep;
+	data->value = valuep;
+	data->len = strlen(VALUE);
+	INIT_LIST_HEAD(&data->list);
+	list_add_tail(&data->list, head);
+	return 0;
+err:
+	kfree(namep);
+	kfree(valuep);
+	kfree(data);
+	return -ENOMEM;
+}
+
+static struct security_operations testlsm_security_ops = {
+	.owner =			THIS_MODULE,
+
+	.inode_init_security =		test_init_security,
+};
+
+static int __init testlsm_init (void)
+{
+	if (mod_reg_security (MY_NAME, &testlsm_security_ops, NULL)) {
+		printk (KERN_INFO "Failure registering testlsm "
+			" module with primary security module.\n");
+		return -EINVAL;
+	}
+	return 0;
+}
+
+
+static void __exit testlsm_exit (void)
+{
+	if (unregister_security (&testlsm_security_ops)) {
+		printk (KERN_INFO "Failure unregistering testlsm "
+			"module with the kernel\n");
+	}
+	printk (KERN_INFO "init_security test module removed\n");
+}
+
+security_initcall (testlsm_init);
+module_exit (testlsm_exit);
+
+MODULE_DESCRIPTION("inode_initsecurity test LSM module");
+MODULE_LICENSE("GPL");
+

Re: [PATCH -mm] [LSM] Stacking support for inode_init_security

[serue]

The previous patch used int instead of size_t for the xattr value
length.  A new patch just for include/linux/security.h is appended.

thanks,
-serge

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
--
  include/linux/security.h |   30 +++++++++++++++++++-----------

Index: linux-2.6.13-rc6-mm1/include/linux/security.h
===================================================================
--- linux-2.6.13-rc6-mm1.orig/include/linux/security.h	2005-08-21 21:19:32.000000000 -0500
+++ linux-2.6.13-rc6-mm1/include/linux/security.h	2005-08-22 14:46:21.000000000 -0500
@@ -161,6 +161,14 @@ struct swap_info_struct;
 
 #ifdef CONFIG_SECURITY
 
+struct xattr_data {
+	struct list_head list;
+	char *name;
+	void *value;
+	size_t len;
+};
+
+
 /**
  * struct security_operations - main security structure
  *
@@ -343,9 +351,13 @@ struct swap_info_struct;
  *	then it should return -EOPNOTSUPP to skip this processing.
  *	@inode contains the inode structure of the newly created inode.
  *	@dir contains the inode structure of the parent directory.
- *	@name will be set to the allocated name suffix (e.g. selinux).
- *	@value will be set to the allocated attribute value.
- *	@len will be set to the length of the value.
+ *	@head, if not null, points to a listhead to which to append a
+ *		newly allocated struct xattr_data with the following data:
+ *		@data->name will be set to the allocated name suffix
+ * 			(e.g. selinux).
+ *		@data->value will be set to the allocated attribute value.
+ *		@data->len will be set to the length of the value.
+ *		@data->list is used to add the data to the list_head
  *	Returns 0 if @name and @value have been successfully set,
  *		-EOPNOTSUPP if no security attribute is needed, or
  *		-ENOMEM on memory allocation failure.
@@ -1146,7 +1158,7 @@ struct security_operations {
 	int (*inode_alloc_security) (struct inode *inode);	
 	void (*inode_free_security) (struct inode *inode);
 	int (*inode_init_security) (struct inode *inode, struct inode *dir,
-				    char **name, void **value, size_t *len);
+				    struct list_head *head);
 	int (*inode_create) (struct inode *dir,
 	                     struct dentry *dentry, int mode);
 	int (*inode_link) (struct dentry *old_dentry,
@@ -1497,13 +1509,11 @@ static inline void security_inode_free (
 
 static inline int security_inode_init_security (struct inode *inode,
 						struct inode *dir,
-						char **name,
-						void **value,
-						size_t *len)
+						struct list_head *head)
 {
 	if (unlikely (IS_PRIVATE (inode)))
 		return -EOPNOTSUPP;
-	return security_ops->inode_init_security (inode, dir, name, value, len);
+	return security_ops->inode_init_security (inode, dir, head);
 }
 	
 static inline int security_inode_create (struct inode *dir,
@@ -2186,9 +2196,7 @@ static inline void security_inode_free (
 
 static inline int security_inode_init_security (struct inode *inode,
 						struct inode *dir,
-						char **name,
-						void **value,
-						size_t *len)
+						struct list_head *head)
 {
 	return -EOPNOTSUPP;
 }

Re: [PATCH -mm] [LSM] Stacking support for inode_init_security

[serue]

The previous patch used int instead of size_t for the xattr value
length.  A new patch just for include/linux/security.h is appended.

thanks,
-serge

Signed-off-by: Serge Hallyn <serue@us.ibm.com>
--
  include/linux/security.h |   30 +++++++++++++++++++-----------

Index: linux-2.6.13-rc6-mm1/include/linux/security.h
===================================================================
--- linux-2.6.13-rc6-mm1.orig/include/linux/security.h	2005-08-21 21:19:32.000000000 -0500
+++ linux-2.6.13-rc6-mm1/include/linux/security.h	2005-08-22 14:46:21.000000000 -0500
@@ -161,6 +161,14 @@ struct swap_info_struct;
 
 #ifdef CONFIG_SECURITY
 
+struct xattr_data {
+	struct list_head list;
+	char *name;
+	void *value;
+	size_t len;
+};
+
+
 /**
  * struct security_operations - main security structure
  *
@@ -343,9 +351,13 @@ struct swap_info_struct;
  *	then it should return -EOPNOTSUPP to skip this processing.
  *	@inode contains the inode structure of the newly created inode.
  *	@dir contains the inode structure of the parent directory.
- *	@name will be set to the allocated name suffix (e.g. selinux).
- *	@value will be set to the allocated attribute value.
- *	@len will be set to the length of the value.
+ *	@head, if not null, points to a listhead to which to append a
+ *		newly allocated struct xattr_data with the following data:
+ *		@data->name will be set to the allocated name suffix
+ * 			(e.g. selinux).
+ *		@data->value will be set to the allocated attribute value.
+ *		@data->len will be set to the length of the value.
+ *		@data->list is used to add the data to the list_head
  *	Returns 0 if @name and @value have been successfully set,
  *		-EOPNOTSUPP if no security attribute is needed, or
  *		-ENOMEM on memory allocation failure.
@@ -1146,7 +1158,7 @@ struct security_operations {
 	int (*inode_alloc_security) (struct inode *inode);	
 	void (*inode_free_security) (struct inode *inode);
 	int (*inode_init_security) (struct inode *inode, struct inode *dir,
-				    char **name, void **value, size_t *len);
+				    struct list_head *head);
 	int (*inode_create) (struct inode *dir,
 	                     struct dentry *dentry, int mode);
 	int (*inode_link) (struct dentry *old_dentry,
@@ -1497,13 +1509,11 @@ static inline void security_inode_free (
 
 static inline int security_inode_init_security (struct inode *inode,
 						struct inode *dir,
-						char **name,
-						void **value,
-						size_t *len)
+						struct list_head *head)
 {
 	if (unlikely (IS_PRIVATE (inode)))
 		return -EOPNOTSUPP;
-	return security_ops->inode_init_security (inode, dir, name, value, len);
+	return security_ops->inode_init_security (inode, dir, head);
 }
 	
 static inline int security_inode_create (struct inode *dir,
@@ -2186,9 +2196,7 @@ static inline void security_inode_free (
 
 static inline int security_inode_init_security (struct inode *inode,
 						struct inode *dir,
-						char **name,
-						void **value,
-						size_t *len)
+						struct list_head *head)
 {
 	return -EOPNOTSUPP;
 }


-------------------------------------------------------
SF.Net email is Sponsored by the Better Software Conference & EXPO
September 19-22, 2005 * San Francisco, CA * Development Lifecycle Practices
Agile & Plan-Driven Development * Managing Projects & Teams * Testing & QA
Security * Process Improvement & Measurement * http://www.sqe.com/bsce5sf

Re: [PATCH -mm 3/3] [LSM] Stacking support for inode_init_security

[serue]

Quoting serue@us.ibm.com (serue@us.ibm.com):
> This patch adds two stackable test LSMs which only define
> inode_init_security().  Any file created while these modules are
> loaded should have the xattrs ("security.name1", "value1") and
> ("security.name2", "value2").
> 
> thanks,
> -serge

I'd forgotten a 'quilt add'.  The following trivial patch against
security/Makefile is necessary to actually compile the test LSMs...

thanks,
-serge

Signed-off-by: Serge Hallyn <serue@us.ibm.com>

Index: linux-2.6.13-rc6-mm1/security/Makefile
===================================================================
--- linux-2.6.13-rc6-mm1.orig/security/Makefile	2005-08-21 21:19:32.000000000 -0500
+++ linux-2.6.13-rc6-mm1/security/Makefile	2005-08-22 15:19:41.000000000 -0500
@@ -19,3 +19,4 @@ obj-$(CONFIG_SECURITY_CAPABILITIES)	+= c
 obj-$(CONFIG_SECURITY_CAP_STACK)	+= commoncap.o cap_stack.o
 obj-$(CONFIG_SECURITY_ROOTPLUG)		+= commoncap.o root_plug.o
 obj-$(CONFIG_SECURITY_SECLVL)		+= seclvl.o
+obj-m					+= testinitsec1.o testinitsec2.o

Re: [PATCH -mm 3/3] [LSM] Stacking support for inode_init_security

[serue]

Quoting Chris Wright (chrisw@osdl.org):
> * Adrian Bunk (bunk@stusta.de) wrote:
> > You want to build these modules always and always modular?
> > 
> > No matter whether the security subsystem is built modular or static?
> > 
> > No matter whether the user has enabled or completely disabled the 
> > security subsystem?
> 
> The modules are just for testing, and shouldn't be added at all.

Right, in no way should the testing modules be upstreamed :)

thanks,
-serge

Re: [PATCH -mm 3/3] [LSM] Stacking support for inode_init_security

[Adrian Bunk]

On Mon, Aug 22, 2005 at 11:52:09AM -0500, serue@us.ibm.com wrote:
> Quoting serue@us.ibm.com (serue@us.ibm.com):
> > This patch adds two stackable test LSMs which only define
> > inode_init_security().  Any file created while these modules are
> > loaded should have the xattrs ("security.name1", "value1") and
> > ("security.name2", "value2").
> > 
> > thanks,
> > -serge
> 
> I'd forgotten a 'quilt add'.  The following trivial patch against
> security/Makefile is necessary to actually compile the test LSMs...
> 
> thanks,
> -serge
> 
> Signed-off-by: Serge Hallyn <serue@us.ibm.com>
> 
> Index: linux-2.6.13-rc6-mm1/security/Makefile
> ===================================================================
> --- linux-2.6.13-rc6-mm1.orig/security/Makefile	2005-08-21 21:19:32.000000000 -0500
> +++ linux-2.6.13-rc6-mm1/security/Makefile	2005-08-22 15:19:41.000000000 -0500
> @@ -19,3 +19,4 @@ obj-$(CONFIG_SECURITY_CAPABILITIES)	+= c
>  obj-$(CONFIG_SECURITY_CAP_STACK)	+= commoncap.o cap_stack.o
>  obj-$(CONFIG_SECURITY_ROOTPLUG)		+= commoncap.o root_plug.o
>  obj-$(CONFIG_SECURITY_SECLVL)		+= seclvl.o
> +obj-m					+= testinitsec1.o testinitsec2.o

You want to build these modules always and always modular?

No matter whether the security subsystem is built modular or static?

No matter whether the user has enabled or completely disabled the 
security subsystem?

...

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

Re: [PATCH -mm 3/3] [LSM] Stacking support for inode_init_security

[Chris Wright]

* Adrian Bunk (bunk@stusta.de) wrote:
> You want to build these modules always and always modular?
> 
> No matter whether the security subsystem is built modular or static?
> 
> No matter whether the user has enabled or completely disabled the 
> security subsystem?

The modules are just for testing, and shouldn't be added at all.