From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 7248AEC8742 for ; Thu, 7 Sep 2023 17:37:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S244527AbjIGRhc (ORCPT ); Thu, 7 Sep 2023 13:37:32 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:56086 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S244565AbjIGRhb (ORCPT ); Thu, 7 Sep 2023 13:37:31 -0400 Received: from smtp-190f.mail.infomaniak.ch (smtp-190f.mail.infomaniak.ch [IPv6:2001:1600:3:17::190f]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id AAEFE199A for ; Thu, 7 Sep 2023 10:37:04 -0700 (PDT) Received: from smtp-3-0001.mail.infomaniak.ch (unknown [10.4.36.108]) by smtp-2-3000.mail.infomaniak.ch (Postfix) with ESMTPS id 4RhNf72X8ZzMq2vS; Thu, 7 Sep 2023 15:37:19 +0000 (UTC) Received: from unknown by smtp-3-0001.mail.infomaniak.ch (Postfix) with ESMTPA id 4RhNf54vqczMpnPd; Thu, 7 Sep 2023 17:37:17 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=digikod.net; s=20191114; t=1694101039; bh=HTiZwHVg8F7uVKSD4j4wLDwhc/PFGcVuJRCd0AKedao=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=vOLj3EIcmbKasCKmy+JVIdqDOT3jHOrUOcq01dx4d1aFtqAYO+4vbajrOpjnr9QCA yFtoR4vnyfyl+VU0F76dLcoLu0RJxKQoGjmX4xdPHd8KklPlNXsBzWc4cJHNtJyVee Fd9rI1wvoT70eJVGAptNwkveUz9+NCiYU3YVErFE= Date: Thu, 7 Sep 2023 17:37:09 +0200 From: =?utf-8?Q?Micka=C3=ABl_Sala=C3=BCn?= To: Casey Schaufler Cc: Paul Moore , linux-security-module@vger.kernel.org, jmorris@namei.org, serge@hallyn.com, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, linux-kernel@vger.kernel.org, linux-api@vger.kernel.org Subject: Re: [PATCH v14 4/11] LSM: syscalls for current process attributes Message-ID: <20230907.eFie4boo3sei@digikod.net> References: <20230828195802.135055-5-casey@schaufler-ca.com> <6bdfc1b73926b16fc4eea848f25275ed.paul@paul-moore.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Infomaniak-Routing: alpha Precedence: bulk List-ID: X-Mailing-List: linux-api@vger.kernel.org On Wed, Sep 06, 2023 at 04:48:04PM -0700, Casey Schaufler wrote: > On 9/6/2023 4:22 PM, Paul Moore wrote: > > On Aug 28, 2023 Casey Schaufler wrote: > >> Create a system call lsm_get_self_attr() to provide the security > >> module maintained attributes of the current process. > >> Create a system call lsm_set_self_attr() to set a security > >> module maintained attribute of the current process. > >> Historically these attributes have been exposed to user space via > >> entries in procfs under /proc/self/attr. > >> > >> The attribute value is provided in a lsm_ctx structure. The structure > >> identifies the size of the attribute, and the attribute value. The format > >> of the attribute value is defined by the security module. A flags field > >> is included for LSM specific information. It is currently unused and must > >> be 0. The total size of the data, including the lsm_ctx structure and any > >> padding, is maintained as well. > >> > >> struct lsm_ctx { > >> __u64 id; > >> __u64 flags; > >> __u64 len; > >> __u64 ctx_len; > >> __u8 ctx[]; > >> }; > >> > >> Two new LSM hooks are used to interface with the LSMs. > >> security_getselfattr() collects the lsm_ctx values from the > >> LSMs that support the hook, accounting for space requirements. > >> security_setselfattr() identifies which LSM the attribute is > >> intended for and passes it along. > >> > >> Signed-off-by: Casey Schaufler > >> Reviewed-by: Kees Cook > >> Reviewed-by: Serge Hallyn > >> Reviewed-by: John Johansen > >> --- > >> +int security_getselfattr(unsigned int attr, struct lsm_ctx __user *uctx, > >> + size_t __user *size, u32 flags) > >> +{ > >> + struct security_hook_list *hp; > >> + struct lsm_ctx lctx = { .id = LSM_ID_UNDEF, }; > >> + u8 __user *base = (u8 __user *)uctx; > >> + size_t total = 0; > >> + size_t entrysize; > >> + size_t left; > >> + bool toobig = false; > >> + bool single = false; > >> + int count = 0; > >> + int rc; > >> + > >> + if (attr == LSM_ATTR_UNDEF) > >> + return -EINVAL; > >> + if (size == NULL) > >> + return -EINVAL; > >> + if (get_user(left, size)) > >> + return -EFAULT; > >> + > >> + if (flags) { > >> + /* > >> + * Only flag supported is LSM_FLAG_SINGLE > >> + */ > >> + if (flags & LSM_FLAG_SINGLE) > >> + return -EINVAL; > > Should this be something like the following? > > > > if (flags & ~LSM_FLAG_SINGLE) > > return -EINVAL; > > Yes. I have a fix ready. There are a couple other touch-ups, too. This is already part of patch 11. It should be squashed here.