From: Kees Cook <keescook@chromium.org>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: casey.schaufler@intel.com, jmorris@namei.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org,
john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp,
paul@paul-moore.com, sds@tycho.nsa.gov
Subject: Re: [PATCH v2 15/25] LSM: Specify which LSM to display
Date: Tue, 18 Jun 2019 22:28:55 -0700 [thread overview]
Message-ID: <201906182221.8E3938600D@keescook> (raw)
In-Reply-To: <20190618230551.7475-16-casey@schaufler-ca.com>
On Tue, Jun 18, 2019 at 04:05:41PM -0700, Casey Schaufler wrote:
> Create a new entry "display" in /proc/.../attr for controlling
> which LSM security information is displayed for a process.
> The name of an active LSM that supplies hooks for human readable
> data may be written to "display" to set the value. The name of
> the LSM currently in use can be read from "display".
> At this point there can only be one LSM capable of display
> active.
>
> This affects /proc/.../attr/current and SO_PEERSEC.
>
> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
> ---
> fs/proc/base.c | 1 +
> security/security.c | 108 +++++++++++++++++++++++++++++++++++---------
> 2 files changed, 88 insertions(+), 21 deletions(-)
>
> diff --git a/fs/proc/base.c b/fs/proc/base.c
> index ddef482f1334..7bf70e041315 100644
> --- a/fs/proc/base.c
> +++ b/fs/proc/base.c
> @@ -2618,6 +2618,7 @@ static const struct pid_entry attr_dir_stuff[] = {
> ATTR(NULL, "fscreate", 0666),
> ATTR(NULL, "keycreate", 0666),
> ATTR(NULL, "sockcreate", 0666),
> + ATTR(NULL, "display", 0666),
> #ifdef CONFIG_SECURITY_SMACK
> DIR("smack", 0555,
> proc_smack_attr_dir_inode_ops, proc_smack_attr_dir_ops),
> diff --git a/security/security.c b/security/security.c
> index 46f6cf21d33c..9cfdc664239e 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -46,7 +46,9 @@ static struct kmem_cache *lsm_file_cache;
> static struct kmem_cache *lsm_inode_cache;
>
> char *lsm_names;
> -static struct lsm_blob_sizes blob_sizes __lsm_ro_after_init;
> +static struct lsm_blob_sizes blob_sizes __lsm_ro_after_init = {
> + .lbs_task = sizeof(int),
> +};
This needs some comments. I know what's happening here only because I
understand very well how the blob sizing works. :) Perhaps:
.lbs_task = sizeof(int), /* storage for selected "display" LSM */
>
> /* Boot-time LSM user choice */
> static __initdata const char *chosen_lsm_order;
> @@ -578,6 +580,8 @@ int lsm_inode_alloc(struct inode *inode)
> */
> static int lsm_task_alloc(struct task_struct *task)
> {
> + int *display;
> +
> if (blob_sizes.lbs_task == 0) {
> task->security = NULL;
> return 0;
> @@ -586,6 +590,10 @@ static int lsm_task_alloc(struct task_struct *task)
> task->security = kzalloc(blob_sizes.lbs_task, GFP_KERNEL);
> if (task->security == NULL)
> return -ENOMEM;
> +
> + display = task->security;
> + *display = LSMDATA_INVALID;
Similarly I think a comment here would be nice. "Initialize currently
selected "display" LSM to unselected" or something.
Also: "int" is okay here for now, but if the LSM infrastructure wants to
do more like this we'll want to convert to a struct of some kind at the
start of the lbs_task.
> +
> return 0;
> }
>
> @@ -1574,14 +1582,27 @@ int security_file_open(struct file *file)
>
> int security_task_alloc(struct task_struct *task, unsigned long clone_flags)
> {
> + int *odisplay = current->security;
> + int *ndisplay;
> int rc = lsm_task_alloc(task);
>
> - if (rc)
> + if (unlikely(rc))
> return rc;
> +
> rc = call_int_hook(task_alloc, 0, task, clone_flags);
> - if (unlikely(rc))
> + if (unlikely(rc)) {
> security_task_free(task);
> - return rc;
> + return rc;
> + }
> +
> + ndisplay = task->security;
> + if (ndisplay == NULL)
> + return 0;
> +
> + if (odisplay != NULL)
Perhaps merge these into "if (ndisplay && odisplay)" to drop the early
return 0 check?
> + *ndisplay = *odisplay;
> +
> + return 0;
> }
>
> void security_task_free(struct task_struct *task)
> @@ -1967,10 +1988,28 @@ int security_getprocattr(struct task_struct *p, const char *lsm, char *name,
> char **value)
> {
> struct security_hook_list *hp;
> + int *display = current->security;
> +
> + if (!strcmp(name, "display")) {
> + hlist_for_each_entry(hp, &security_hook_heads.secid_to_secctx,
> + list) {
> + if (*display == LSMDATA_INVALID ||
> + hp->slot == *display) {
> + *value = kstrdup(hp->lsm, GFP_KERNEL);
> + if (*value)
> + return strlen(hp->lsm);
> + return -ENOMEM;
> + }
> + }
> + return -EINVAL;
> + }
>
> hlist_for_each_entry(hp, &security_hook_heads.getprocattr, list) {
> if (lsm != NULL && strcmp(lsm, hp->lsm))
> continue;
> + if (lsm == NULL && *display != LSMDATA_INVALID &&
> + *display != hp->slot)
> + continue;
> return hp->hook.getprocattr(p, name, value);
> }
> return -EINVAL;
> @@ -1980,10 +2019,27 @@ int security_setprocattr(const char *lsm, const char *name, void *value,
> size_t size)
> {
> struct security_hook_list *hp;
> + int *display = current->security;
> + int len;
> +
> + if (!strcmp(name, "display")) {
> + hlist_for_each_entry(hp, &security_hook_heads.secid_to_secctx,
> + list) {
> + len = strlen(hp->lsm);
> + if (size >= len && !strncmp(value, hp->lsm, len)) {
> + *display = hp->slot;
> + return size;
> + }
> + }
> + return -EINVAL;
> + }
>
> hlist_for_each_entry(hp, &security_hook_heads.setprocattr, list) {
> if (lsm != NULL && strcmp(lsm, hp->lsm))
> continue;
> + if (lsm == NULL && *display != LSMDATA_INVALID &&
> + *display != hp->slot)
> + continue;
> return hp->hook.setprocattr(name, value, size);
> }
> return -EINVAL;
> @@ -2002,38 +2058,41 @@ EXPORT_SYMBOL(security_ismaclabel);
>
> int security_secid_to_secctx(struct lsmblob *l, char **secdata, u32 *seclen)
> {
> + int *display = current->security;
> struct security_hook_list *hp;
> - int rc;
>
> - hlist_for_each_entry(hp, &security_hook_heads.secid_to_secctx, list) {
> - rc = hp->hook.secid_to_secctx(l->secid[hp->slot],
> - secdata, seclen);
> - if (rc != 0)
> - return rc;
> - }
> + hlist_for_each_entry(hp, &security_hook_heads.secid_to_secctx, list)
> + if (*display == LSMDATA_INVALID || *display == hp->slot)
> + return hp->hook.secid_to_secctx(l->secid[hp->slot],
> + secdata, seclen);
> return 0;
> }
> EXPORT_SYMBOL(security_secid_to_secctx);
>
> int security_secctx_to_secid(const char *secdata, u32 seclen, struct lsmblob *l)
> {
> + int *display = current->security;
> struct security_hook_list *hp;
> - int rc;
>
> lsmblob_init(l, 0);
> - hlist_for_each_entry(hp, &security_hook_heads.secctx_to_secid, list) {
> - rc = hp->hook.secctx_to_secid(secdata, seclen,
> - &l->secid[hp->slot]);
> - if (rc != 0)
> - return rc;
> - }
> + hlist_for_each_entry(hp, &security_hook_heads.secctx_to_secid, list)
> + if (*display == LSMDATA_INVALID || *display == hp->slot)
> + return hp->hook.secctx_to_secid(secdata, seclen,
> + &l->secid[hp->slot]);
> return 0;
> }
> EXPORT_SYMBOL(security_secctx_to_secid);
>
> void security_release_secctx(char *secdata, u32 seclen)
> {
> - call_void_hook(release_secctx, secdata, seclen);
> + int *display = current->security;
> + struct security_hook_list *hp;
> +
> + hlist_for_each_entry(hp, &security_hook_heads.release_secctx, list)
> + if (*display == LSMDATA_INVALID || *display == hp->slot) {
> + hp->hook.release_secctx(secdata, seclen);
> + return;
> + }
> }
> EXPORT_SYMBOL(security_release_secctx);
>
> @@ -2158,8 +2217,15 @@ EXPORT_SYMBOL(security_sock_rcv_skb);
> int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
> int __user *optlen, unsigned len)
> {
> - return call_int_hook(socket_getpeersec_stream, -ENOPROTOOPT, sock,
> - optval, optlen, len);
> + int *display = current->security;
> + struct security_hook_list *hp;
> +
> + hlist_for_each_entry(hp, &security_hook_heads.socket_getpeersec_stream,
> + list)
> + if (*display == LSMDATA_INVALID || *display == hp->slot)
> + return hp->hook.socket_getpeersec_stream(sock, optval,
> + optlen, len);
> + return -ENOPROTOOPT;
> }
>
> int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb,
> --
> 2.20.1
>
--
Kees Cook
next prev parent reply other threads:[~2019-06-19 5:28 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-18 23:05 [PATCH v2 00/25] LSM: Module stacking for AppArmor Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 01/25] LSM: Infrastructure management of the superblock Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 02/25] LSM: Infrastructure management of the sock security Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 03/25] LSM: Infrastructure management of the key blob Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 04/25] LSM: Create and manage the lsmblob data structure Casey Schaufler
2019-06-19 4:52 ` Kees Cook
2019-06-19 6:17 ` Kees Cook
2019-06-19 16:34 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 05/25] Use lsmblob in security_audit_rule_match Casey Schaufler
2019-06-19 4:55 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 06/25] LSM: Use lsmblob in security_kernel_act_as Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 07/25] net: Prepare UDS for secuirty module stacking Casey Schaufler
2019-06-19 4:59 ` Kees Cook
2019-06-19 16:42 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 08/25] LSM: Use lsmblob in security_secctx_to_secid Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 09/25] LSM: Use lsmblob in security_secid_to_secctx Casey Schaufler
2019-06-19 5:03 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 10/25] LSM: Use lsmblob in security_ipc_getsecid Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 11/25] LSM: Use lsmblob in security_task_getsecid Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 12/25] LSM: Use lsmblob in security_inode_getsecid Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 13/25] LSM: Use lsmblob in security_cred_getsecid Casey Schaufler
2019-06-19 5:11 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 14/25] IMA: Change internal interfaces to use lsmblobs Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 15/25] LSM: Specify which LSM to display Casey Schaufler
2019-06-19 4:33 ` Kees Cook
2019-06-19 15:33 ` Casey Schaufler
2019-06-19 5:28 ` Kees Cook [this message]
2019-06-19 17:00 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 16/25] LSM: Ensure the correct LSM context releaser Casey Schaufler
2019-06-19 5:34 ` Kees Cook
2019-06-19 17:10 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 17/25] LSM: Use lsmcontext in security_secid_to_secctx Casey Schaufler
2019-06-19 5:36 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 18/25] LSM: Use lsmcontext in security_dentry_init_security Casey Schaufler
2019-06-19 5:41 ` Kees Cook
2019-06-19 17:31 ` Casey Schaufler
2019-06-20 17:25 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 19/25] LSM: Use lsmcontext in security_inode_getsecctx Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 20/25] LSM: security_secid_to_secctx in netlink netfilter Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 21/25] Audit: Store LSM audit information in an lsmblob Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 22/25] LSM: Return the lsmblob slot on initialization Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 23/25] NET: Store LSM netlabel data in a lsmblob Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 24/25] Fix slotted list and getpeersec_d Casey Schaufler
2019-06-19 5:50 ` Kees Cook
2019-06-19 17:36 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 25/25] AppArmor: Remove the exclusive flag Casey Schaufler
2019-06-19 4:34 ` [PATCH v2 00/25] LSM: Module stacking for AppArmor Kees Cook
2019-06-19 15:39 ` Casey Schaufler
2019-06-19 20:08 ` James Morris
2019-06-20 17:33 ` Stacked LSMs (was Re: [PATCH v2 00/25] LSM: Module stacking for AppArmor) Kees Cook
2019-06-22 14:15 ` Mickaël Salaün
2019-06-19 5:21 ` [PATCH v2 00/25] LSM: Module stacking for AppArmor Kees Cook
2019-06-19 16:48 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201906182221.8E3938600D@keescook \
--to=keescook@chromium.org \
--cc=casey.schaufler@intel.com \
--cc=casey@schaufler-ca.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.