From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Osmialowski Subject: [RFC 4/8] lsm: smack: smack callbacks for kdbus security hooks Date: Wed, 08 Jul 2015 12:25:06 +0200 Message-ID: <1436351110-5902-5-git-send-email-p.osmialowsk@samsung.com> References: <1436351110-5902-1-git-send-email-p.osmialowsk@samsung.com> Return-path: In-reply-to: <1436351110-5902-1-git-send-email-p.osmialowsk-Sze3O3UU22JBDgjK7y7TUQ@public.gmane.org> Sender: linux-api-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org To: Paul Moore , James Morris , Casey Schaufler , "Serge E. Hallyn" , Kees Cook , Tetsuo Handa , Stephen Smalley , Neil Brown , Mark Rustad , Greg Kroah-Hartman , Daniel Mack , David Herrmann , Djalal Harouni , Shuah Khan , Al Viro , linux-security-module-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-api-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Cc: Karol Lewandowski , Paul Osmialowski , Lukasz Skalski List-Id: linux-api@vger.kernel.org This adds implementation of three smack callbacks sitting behind kdbus security hooks as proposed by Karol Lewandowski. Originates from: git://git.infradead.org/users/pcmoore/selinux (branch: working-kdbus) commit: fc3505d058c001fe72a6f66b833e0be5b2d118f3 https://github.com/lmctl/linux.git (branch: kdbus-lsm-v4.for-systemd-v212) commit: 103c26fd27d1ec8c32d85dd3d85681f936ac66fb Signed-off-by: Karol Lewandowski Signed-off-by: Paul Osmialowski --- security/smack/smack_lsm.c | 68 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 68 insertions(+) diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index a143328..033b756 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -41,6 +41,7 @@ #include #include #include +#include #include "smack.h" #define TRANS_TRUE "TRUE" @@ -3336,6 +3337,69 @@ static int smack_setprocattr(struct task_struct *p, char *name, } /** + * smack_kdbus_connect - Set the security blob for a KDBus connection + * @conn: the connection + * @secctx: smack label + * @seclen: smack label length + * + * Returns 0 + */ +static int smack_kdbus_connect(struct kdbus_conn *conn, + const char *secctx, u32 seclen) +{ + struct smack_known *skp; + + if (secctx && seclen > 0) + skp = smk_import_entry(secctx, seclen); + else + skp = smk_of_current(); + conn->security = skp; + + return 0; +} + +/** + * smack_kdbus_conn_free - Clear the security blob for a KDBus connection + * @conn: the connection + * + * Clears the blob pointer + */ +static void smack_kdbus_conn_free(struct kdbus_conn *conn) +{ + conn->security = NULL; +} + +/** + * smack_kdbus_talk - Smack access on KDBus + * @src: source kdbus connection + * @dst: destination kdbus connection + * + * Return 0 if a subject with the smack of sock could access + * an object with the smack of other, otherwise an error code + */ +static int smack_kdbus_talk(const struct kdbus_conn *src, + const struct kdbus_conn *dst) +{ + struct smk_audit_info ad; + struct smack_known *sskp = src->security; + struct smack_known *dskp = dst->security; + int ret; + + BUG_ON(sskp == NULL); + BUG_ON(dskp == NULL); + + if (smack_privileged(CAP_MAC_OVERRIDE)) + return 0; + + smk_ad_init(&ad, __func__, LSM_AUDIT_DATA_NONE); + + ret = smk_access(sskp, dskp, MAY_WRITE, &ad); + if (ret) + return ret; + return 0; +} + +/** * smack_unix_stream_connect - Smack access on UDS * @sock: one sock * @other: the other sock @@ -4393,6 +4457,10 @@ struct security_hook_list smack_hooks[] = { LSM_HOOK_INIT(inode_notifysecctx, smack_inode_notifysecctx), LSM_HOOK_INIT(inode_setsecctx, smack_inode_setsecctx), LSM_HOOK_INIT(inode_getsecctx, smack_inode_getsecctx), + + LSM_HOOK_INIT(kdbus_connect, smack_kdbus_connect), + LSM_HOOK_INIT(kdbus_conn_free, smack_kdbus_conn_free), + LSM_HOOK_INIT(kdbus_talk, smack_kdbus_talk), }; -- 1.9.1