From: Kees Cook <keescook@chromium.org>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: casey.schaufler@intel.com, jmorris@namei.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org,
john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp,
paul@paul-moore.com, sds@tycho.nsa.gov
Subject: Re: [PATCH v2 13/25] LSM: Use lsmblob in security_cred_getsecid
Date: Tue, 18 Jun 2019 22:11:08 -0700 [thread overview]
Message-ID: <201906182210.8765003E11@keescook> (raw)
In-Reply-To: <20190618230551.7475-14-casey@schaufler-ca.com>
On Tue, Jun 18, 2019 at 04:05:39PM -0700, Casey Schaufler wrote:
> Change the security_cred_getsecid() interface to fill in a
> lsmblob instead of a u32 secid. The associated data elements
> in the audit sub-system are changed from a secid to a lsmblob
> to accomodate multiple possible LSM audit users.
Cool, cool. I'm digging the clean conversions all the way through this
patch. I didn't see patch 14/25 for some reason, though...
-Kees
>
> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
> ---
> include/linux/security.h | 2 +-
> kernel/audit.c | 14 +++++-------
> kernel/audit.h | 5 +++--
> kernel/auditsc.c | 37 +++++++++++--------------------
> security/integrity/ima/ima_main.c | 6 ++---
> security/security.c | 9 +++++---
> 6 files changed, 32 insertions(+), 41 deletions(-)
>
> diff --git a/include/linux/security.h b/include/linux/security.h
> index b28d4f9c7714..07a239292e02 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -383,7 +383,7 @@ int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
> void security_cred_free(struct cred *cred);
> int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
> void security_transfer_creds(struct cred *new, const struct cred *old);
> -void security_cred_getsecid(const struct cred *c, u32 *secid);
> +void security_cred_getsecid(const struct cred *c, struct lsmblob *l);
> int security_kernel_act_as(struct cred *new, struct lsmblob *l);
> int security_kernel_create_files_as(struct cred *new, struct inode *inode);
> int security_kernel_module_request(char *kmod_name);
> diff --git a/kernel/audit.c b/kernel/audit.c
> index 3ab2a1c0ba61..a52f8772477f 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -137,7 +137,7 @@ static u32 audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME;
> /* The identity of the user shutting down the audit system. */
> kuid_t audit_sig_uid = INVALID_UID;
> pid_t audit_sig_pid = -1;
> -u32 audit_sig_sid = 0;
> +struct lsmblob audit_sig_lsm;
>
> /* Records can be lost in several ways:
> 0) [suppressed in audit_alloc]
> @@ -1429,23 +1429,21 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
> }
> case AUDIT_SIGNAL_INFO:
> len = 0;
> - if (audit_sig_sid) {
> - struct lsmblob le;
> -
> - lsmblob_init(&le, audit_sig_sid);
> - err = security_secid_to_secctx(&le, &ctx, &len);
> + if (lsmblob_is_set(&audit_sig_lsm)) {
> + err = security_secid_to_secctx(&audit_sig_lsm, &ctx,
> + &len);
> if (err)
> return err;
> }
> sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
> if (!sig_data) {
> - if (audit_sig_sid)
> + if (lsmblob_is_set(&audit_sig_lsm))
> security_release_secctx(ctx, len);
> return -ENOMEM;
> }
> sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid);
> sig_data->pid = audit_sig_pid;
> - if (audit_sig_sid) {
> + if (lsmblob_is_set(&audit_sig_lsm)) {
> memcpy(sig_data->ctx, ctx, len);
> security_release_secctx(ctx, len);
> }
> diff --git a/kernel/audit.h b/kernel/audit.h
> index 958d5b8fc1b3..29e29c6f4afb 100644
> --- a/kernel/audit.h
> +++ b/kernel/audit.h
> @@ -22,6 +22,7 @@
> #include <linux/fs.h>
> #include <linux/audit.h>
> #include <linux/skbuff.h>
> +#include <linux/security.h>
> #include <uapi/linux/mqueue.h>
> #include <linux/tty.h>
>
> @@ -147,7 +148,7 @@ struct audit_context {
> kuid_t target_auid;
> kuid_t target_uid;
> unsigned int target_sessionid;
> - u32 target_sid;
> + struct lsmblob target_lsm;
> char target_comm[TASK_COMM_LEN];
>
> struct audit_tree_refs *trees, *first_trees;
> @@ -338,7 +339,7 @@ extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);
>
> extern pid_t audit_sig_pid;
> extern kuid_t audit_sig_uid;
> -extern u32 audit_sig_sid;
> +extern struct lsmblob audit_sig_lsm;
>
> extern int audit_filter(int msgtype, unsigned int listtype);
>
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index cdd1dd9e0eec..ebdd7eab9247 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -112,7 +112,7 @@ struct audit_aux_data_pids {
> kuid_t target_auid[AUDIT_AUX_PIDS];
> kuid_t target_uid[AUDIT_AUX_PIDS];
> unsigned int target_sessionid[AUDIT_AUX_PIDS];
> - u32 target_sid[AUDIT_AUX_PIDS];
> + struct lsmblob target_lsm[AUDIT_AUX_PIDS];
> char target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
> int pid_count;
> };
> @@ -937,14 +937,14 @@ static inline void audit_free_context(struct audit_context *context)
> }
>
> static int audit_log_pid_context(struct audit_context *context, pid_t pid,
> - kuid_t auid, kuid_t uid, unsigned int sessionid,
> - u32 sid, char *comm)
> + kuid_t auid, kuid_t uid,
> + unsigned int sessionid,
> + struct lsmblob *l, char *comm)
> {
> struct audit_buffer *ab;
> char *ctx = NULL;
> u32 len;
> int rc = 0;
> - struct lsmblob le;
>
> ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
> if (!ab)
> @@ -953,9 +953,8 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
> audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid,
> from_kuid(&init_user_ns, auid),
> from_kuid(&init_user_ns, uid), sessionid);
> - if (sid) {
> - lsmblob_init(&le, sid);
> - if (security_secid_to_secctx(&le, &ctx, &len)) {
> + if (lsmblob_is_set(l)) {
> + if (security_secid_to_secctx(l, &ctx, &len)) {
> audit_log_format(ab, " obj=(none)");
> rc = 1;
> } else {
> @@ -1525,7 +1524,7 @@ static void audit_log_exit(void)
> axs->target_auid[i],
> axs->target_uid[i],
> axs->target_sessionid[i],
> - axs->target_sid[i],
> + &axs->target_lsm[i],
> axs->target_comm[i]))
> call_panic = 1;
> }
> @@ -1534,7 +1533,7 @@ static void audit_log_exit(void)
> audit_log_pid_context(context, context->target_pid,
> context->target_auid, context->target_uid,
> context->target_sessionid,
> - context->target_sid, context->target_comm))
> + &context->target_lsm, context->target_comm))
> call_panic = 1;
>
> if (context->pwd.dentry && context->pwd.mnt) {
> @@ -1711,7 +1710,7 @@ void __audit_syscall_exit(int success, long return_code)
> context->aux = NULL;
> context->aux_pids = NULL;
> context->target_pid = 0;
> - context->target_sid = 0;
> + lsmblob_init(&context->target_lsm, 0);
> context->sockaddr_len = 0;
> context->type = 0;
> context->fds[0] = -1;
> @@ -2365,15 +2364,12 @@ int __audit_sockaddr(int len, void *a)
> void __audit_ptrace(struct task_struct *t)
> {
> struct audit_context *context = audit_context();
> - struct lsmblob le;
>
> context->target_pid = task_tgid_nr(t);
> context->target_auid = audit_get_loginuid(t);
> context->target_uid = task_uid(t);
> context->target_sessionid = audit_get_sessionid(t);
> - security_task_getsecid(t, &le);
> - /* scaffolding - until target_sid is converted */
> - context->target_sid = le.secid[1];
> + security_task_getsecid(t, &context->target_lsm);
> memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
> }
>
> @@ -2390,7 +2386,6 @@ int audit_signal_info(int sig, struct task_struct *t)
> struct audit_aux_data_pids *axp;
> struct audit_context *ctx = audit_context();
> kuid_t uid = current_uid(), auid, t_uid = task_uid(t);
> - struct lsmblob le;
>
> if (auditd_test_task(t) &&
> (sig == SIGTERM || sig == SIGHUP ||
> @@ -2401,9 +2396,7 @@ int audit_signal_info(int sig, struct task_struct *t)
> audit_sig_uid = auid;
> else
> audit_sig_uid = uid;
> - security_task_getsecid(current, &le);
> - /* scaffolding until audit_sig_sid is converted */
> - audit_sig_sid = le.secid[1];
> + security_task_getsecid(current, &audit_sig_lsm);
> }
>
> if (!audit_signals || audit_dummy_context())
> @@ -2416,9 +2409,7 @@ int audit_signal_info(int sig, struct task_struct *t)
> ctx->target_auid = audit_get_loginuid(t);
> ctx->target_uid = t_uid;
> ctx->target_sessionid = audit_get_sessionid(t);
> - security_task_getsecid(t, &le);
> - /* scaffolding until target_sid is converted */
> - ctx->target_sid = le.secid[1];
> + security_task_getsecid(t, &ctx->target_lsm);
> memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
> return 0;
> }
> @@ -2439,9 +2430,7 @@ int audit_signal_info(int sig, struct task_struct *t)
> axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
> axp->target_uid[axp->pid_count] = t_uid;
> axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t);
> - security_task_getsecid(t, &le);
> - /* scaffolding until target_sid is converted */
> - axp->target_sid[axp->pid_count] = le.secid[1];
> + security_task_getsecid(t, &axp->target_lsm[axp->pid_count]);
> memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
> axp->pid_count++;
>
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index 99870a6286a9..9959d7cbe42e 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -363,7 +363,6 @@ int ima_file_mmap(struct file *file, unsigned long prot)
> int ima_bprm_check(struct linux_binprm *bprm)
> {
> int ret;
> - u32 secid;
> struct lsmblob le;
>
> security_task_getsecid(current, &le);
> @@ -373,8 +372,9 @@ int ima_bprm_check(struct linux_binprm *bprm)
> if (ret)
> return ret;
>
> - security_cred_getsecid(bprm->cred, &secid);
> - return process_measurement(bprm->file, bprm->cred, secid, NULL, 0,
> + security_cred_getsecid(bprm->cred, &le);
> + /* scaffolding until process_measurement changes */
> + return process_measurement(bprm->file, bprm->cred, le.secid[1], NULL, 0,
> MAY_EXEC, CREDS_CHECK);
> }
>
> diff --git a/security/security.c b/security/security.c
> index e82994667263..46f6cf21d33c 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -1638,10 +1638,13 @@ void security_transfer_creds(struct cred *new, const struct cred *old)
> call_void_hook(cred_transfer, new, old);
> }
>
> -void security_cred_getsecid(const struct cred *c, u32 *secid)
> +void security_cred_getsecid(const struct cred *c, struct lsmblob *l)
> {
> - *secid = 0;
> - call_void_hook(cred_getsecid, c, secid);
> + struct security_hook_list *hp;
> +
> + lsmblob_init(l, 0);
> + hlist_for_each_entry(hp, &security_hook_heads.cred_getsecid, list)
> + hp->hook.cred_getsecid(c, &l->secid[hp->slot]);
> }
> EXPORT_SYMBOL(security_cred_getsecid);
>
> --
> 2.20.1
>
--
Kees Cook
next prev parent reply other threads:[~2019-06-19 5:11 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-18 23:05 [PATCH v2 00/25] LSM: Module stacking for AppArmor Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 01/25] LSM: Infrastructure management of the superblock Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 02/25] LSM: Infrastructure management of the sock security Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 03/25] LSM: Infrastructure management of the key blob Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 04/25] LSM: Create and manage the lsmblob data structure Casey Schaufler
2019-06-19 4:52 ` Kees Cook
2019-06-19 6:17 ` Kees Cook
2019-06-19 16:34 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 05/25] Use lsmblob in security_audit_rule_match Casey Schaufler
2019-06-19 4:55 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 06/25] LSM: Use lsmblob in security_kernel_act_as Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 07/25] net: Prepare UDS for secuirty module stacking Casey Schaufler
2019-06-19 4:59 ` Kees Cook
2019-06-19 16:42 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 08/25] LSM: Use lsmblob in security_secctx_to_secid Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 09/25] LSM: Use lsmblob in security_secid_to_secctx Casey Schaufler
2019-06-19 5:03 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 10/25] LSM: Use lsmblob in security_ipc_getsecid Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 11/25] LSM: Use lsmblob in security_task_getsecid Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 12/25] LSM: Use lsmblob in security_inode_getsecid Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 13/25] LSM: Use lsmblob in security_cred_getsecid Casey Schaufler
2019-06-19 5:11 ` Kees Cook [this message]
2019-06-18 23:05 ` [PATCH v2 14/25] IMA: Change internal interfaces to use lsmblobs Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 15/25] LSM: Specify which LSM to display Casey Schaufler
2019-06-19 4:33 ` Kees Cook
2019-06-19 15:33 ` Casey Schaufler
2019-06-19 5:28 ` Kees Cook
2019-06-19 17:00 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 16/25] LSM: Ensure the correct LSM context releaser Casey Schaufler
2019-06-19 5:34 ` Kees Cook
2019-06-19 17:10 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 17/25] LSM: Use lsmcontext in security_secid_to_secctx Casey Schaufler
2019-06-19 5:36 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 18/25] LSM: Use lsmcontext in security_dentry_init_security Casey Schaufler
2019-06-19 5:41 ` Kees Cook
2019-06-19 17:31 ` Casey Schaufler
2019-06-20 17:25 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 19/25] LSM: Use lsmcontext in security_inode_getsecctx Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 20/25] LSM: security_secid_to_secctx in netlink netfilter Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 21/25] Audit: Store LSM audit information in an lsmblob Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 22/25] LSM: Return the lsmblob slot on initialization Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 23/25] NET: Store LSM netlabel data in a lsmblob Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 24/25] Fix slotted list and getpeersec_d Casey Schaufler
2019-06-19 5:50 ` Kees Cook
2019-06-19 17:36 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 25/25] AppArmor: Remove the exclusive flag Casey Schaufler
2019-06-19 4:34 ` [PATCH v2 00/25] LSM: Module stacking for AppArmor Kees Cook
2019-06-19 15:39 ` Casey Schaufler
2019-06-19 20:08 ` James Morris
2019-06-20 17:33 ` Stacked LSMs (was Re: [PATCH v2 00/25] LSM: Module stacking for AppArmor) Kees Cook
2019-06-22 14:15 ` Mickaël Salaün
2019-06-19 5:21 ` [PATCH v2 00/25] LSM: Module stacking for AppArmor Kees Cook
2019-06-19 16:48 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201906182210.8765003E11@keescook \
--to=keescook@chromium.org \
--cc=casey.schaufler@intel.com \
--cc=casey@schaufler-ca.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.