From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id C4098C433EF for ; Tue, 28 Jun 2022 01:00:55 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-515-H_DWsJXUNpKhMAeF6Mv70A-1; Mon, 27 Jun 2022 21:00:51 -0400 X-MC-Unique: H_DWsJXUNpKhMAeF6Mv70A-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 4BBEF29ABA24; Tue, 28 Jun 2022 01:00:50 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (unknown [10.30.29.100]) by smtp.corp.redhat.com (Postfix) with ESMTP id 3C8E3C26E98; Tue, 28 Jun 2022 01:00:50 +0000 (UTC) Received: from mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (localhost [IPv6:::1]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id EDCC9194704A; Tue, 28 Jun 2022 01:00:49 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx09.intmail.prod.int.rdu2.redhat.com [10.11.54.9]) by mm-prod-listman-01.mail-001.prod.us-east-1.aws.redhat.com (Postfix) with ESMTP id C0DFB19466DF for ; Tue, 28 Jun 2022 01:00:48 +0000 (UTC) Received: by smtp.corp.redhat.com (Postfix) id B3821492CA3; Tue, 28 Jun 2022 01:00:48 +0000 (UTC) Received: from mimecast-mx02.redhat.com (mimecast01.extmail.prod.ext.rdu2.redhat.com [10.11.55.17]) by smtp.corp.redhat.com (Postfix) with ESMTPS id AF667492C3B for ; Tue, 28 Jun 2022 01:00:48 +0000 (UTC) Received: from us-smtp-1.mimecast.com (us-smtp-1.mimecast.com [205.139.110.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 97BD985A582 for ; Tue, 28 Jun 2022 01:00:48 +0000 (UTC) Received: from sonic308-16.consmr.mail.ne1.yahoo.com (sonic308-16.consmr.mail.ne1.yahoo.com [66.163.187.39]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-398-gja035nzNeKVYCapLcq7VQ-1; Mon, 27 Jun 2022 21:00:46 -0400 X-MC-Unique: gja035nzNeKVYCapLcq7VQ-1 X-SONIC-DKIM-SIGN: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1656378045; bh=rMUIqK5xfFHtmytlNaSYqwX1glCHwGhf65Seq8xRYlr=; h=X-Sonic-MF:From:To:Subject:Date:From:Subject; b=MkxBgEYuFcob+6e2kZP0E63TcfoxaMN0mF8kkHLni2vn05CZD8Da525ItXq0gzX44fAsow+GW9FsepU+8B+kV2r8oNGLFtZYtXmKbpWmnaxQzLil5+FUGr+WbC1ObUgn6QyZsTW2/aBKxLFfZLsr/ff4NpK+xpKKkCOomjBOasd7xu8thsws1JsHfQZ1fFZ+tRhUI2lHfEgIruUd1CVthAksP7yy5r1EXTdGK/3CNFy6lhHel+12Wv/72UqvOTcXwH2q7spdVVraZFHa+GEBLMfbJQtRIfgU0StZrd7UWa23AxN3yisIayPCZkf5oqx4vMnda3/oJjGig1ViC62kNA== X-YMail-OSG: FdDUwOsVM1ngCAgPfyvYLDVfY6GwmCd74D9MnbviIDNgHsuGimcttALpm_blp.5 vlj4rJIfeTyNI_K_kjNwfVB5.3bHMKYnbAc.JkYrtkJ9b7.1Zt_LrzZA3Ua295EQ_SnoYfMh_P0O Hwq0leS5P82c4fn_Ua7dtI6wItCXbrefN5UvcGJRMnmrbyjcZ3xQmE2tXBAhIVUAKUXNtof5cC5m Euh6ERshVBRu_HAq6wJ5Xg08j7ov.m8VKIesHbLqMzFd9kbHcMqrT_YIUt74kJqZHhJBe34oYs3_ BF1IskJXX8TvF9YfSjbfoNaGQ_5WaMdYrbQNBGWPdmIDvQEJ.OppCOG5csk9I4IaPzzGc.c5xPmz YKLNnVahclH89Jx69E8_Mvmu4oir0MbdteU_ozeZCctYi9P0Vz.9S8QCcQcbVRoKMOP1SwBbu8yx oHQ_RakF3_PS31lEtEPY_xCujfIDsMfa.6xQMaMwGXfUiMBTBxiCw_LiisrVLuDVJuB1V7KvFq5r rwExSwQUeH9M5z1QJJPqxHrG21EgyfmZ3r2MG0PziKP1Y38K4fFAb9a9iTmkfTiLjmnemlp1UKfK 3P6rSQ7vq.G16f.5m5njvrL26EKtRaqLrl3UiSLIyXseYcCDTtONsR1xQJXKYDa._bYvDKA.Fb_j 82PcehnEytMz8.e6EfpLcDgKLBuUEWCJdl_epvQZIU0.unQB3IFBaSTOCC0mJD8b2iOLxDdgdsnh v6pZDjabcKuAY0YNIOLfvM56NDbKfgNpMx.kaF7LqhcrWj0I.p1ue6hRF1pxdXJsDSepxSyTwXBB 8yuEK0B.uSdSQ1NRXVBHwy0fDJpUha3RaYWJLe7RqXYXIosugR14tFh6jUu9Kryx0twcDoNwEm4I CIN9YrqlP9qi64g31TvFFo6r3eA.9MaESnG8tBvYd2CbvsmzttWQXyYdnnaehOhFcXjbus2jF0w_ cr5mDU9FsHHChItf2AP7hltUglx8SxX.TAFEWNpEuiK5jDBPh1e4BuiC9vkHr7zFzeINI8FxzHHt JV3_4PgEx_2MV6qSVshpn9fkvpIOVhqXtRb6.NKw081Iq.SGfTWV0PV5Q2kZ9439HAM22qR_S4CS vV7LLC5.9lvW_Wb4KdTEMdPSX31mxUPkXXvgj93sdekNFtwZ_d7.wy84QFUiwKqu.zTkYrFfLFYx Y.oexMMKpeocQYat683MNAeLVgrsc72zWTKIr6QhDZcKZH58f5lqdO598ErvzOrC46soFUQdZdxt PV6NszGvsbccSAwLRnCXTYfh3bPAwMS2ubbCTfrjUW7f9voSBfcbYwLhzSt0vKkNrd36AfSIRh9T gHWDbBKIDk340dZKXHMVh8ld80WqM4jwgEGe2gJWKrG8P7xODpa_NfSvCAf5pGsEo0tpJhHTp8yV kFS4abK4cCUutA9Sfi0PpWGPJVf1bQIsmH5MaG06ZO.Y_dq5CblHbCaGkDjHNXngLE8GRxxKYt9K TEyJG_.WOHIS3Bp4qNaQEm_A01kcyjaBAyKh_71Oy.16hUeLx8qTyoRkeECBeN5YqidyjhXGi9Oc WjJfpDJHq4KqeI51rg_W8E.m8_QUvpLQ_cj8WdxWM7S6dFZnfJy6GX6_1wOm1re8MDM9oVm_kkPz 6HJG1UWckNxMtJ22DBmHbG_Yw5fhPh8LC2i_dNSiK7xtGSMuDG.9YZEUJnfOUZRJP.Xd_PiPynqn Q0UCW.uUST7R82gWhj5a1wC5SPYzINtLFokjgcZr0r.8fIh.q.UXu1zsQQkTsuuRVhas2Y1.D85P LQMk5Lquqls2sZWgtuBzR6tzXX33HOxvqSVLQz25bfbz3sDjccSBDZxtb_0a59HWWJwR30OqGcsW GILoj.lM4VlKf79kjURPGtfaHIZQHLeRg1ehGm5j1N1zNh.wo_TbzsLJIMEvMJ0cibIZXXPvDwMM CD.ZmvleEsxaUVer0potz_Jw1dUAKpIvMhoqMePf77DvBtXICYFGGcgTSwYCmZLf22IIE.8f75Kh .gZzwZHX8tfjDp12TNlPFU5A5yPR9mdDU3aqLLAWCnmzh5JmcQuZJyQFbYICLdH7.oYlMmMiuv6w mvBVjpfcpjvLcThRpcM6N0mpLw4XqqITzYTI5aCacO_7J9j2sFdNtteGBpv6CvaJ7fe3pip3P0IA .pTSNFXans7PjQhQ0Em4jGkoz60gNSLrmQrNvCJ9uTCZccfaROPScuUgLPb9TPzmJkVJmZixohfv dPRfGPblnhl9nnyYZM0wF7P.z6Ms6OiPvL8rb00OBu65nEVc4hAGTFJY0Ok.Ttzn0SWoOAcWTUPX MEt6xraSXhcnyEHoxUS3M1bK0Vh._Kkr0TAox X-Sonic-MF: Received: from sonic.gate.mail.ne1.yahoo.com by sonic308.consmr.mail.ne1.yahoo.com with HTTP; Tue, 28 Jun 2022 01:00:45 +0000 Received: by hermes--production-bf1-7f5f59bd5b-wjb4g (Yahoo Inc. Hermes SMTP Server) with ESMTPA ID 2eb209f35c81771290ca3d956ba58232; Tue, 28 Jun 2022 01:00:40 +0000 (UTC) From: Casey Schaufler To: casey.schaufler@intel.com, jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Subject: [PATCH v37 04/33] LSM: provide lsm name and id slot mappings Date: Mon, 27 Jun 2022 17:55:42 -0700 Message-Id: <20220628005611.13106-5-casey@schaufler-ca.com> In-Reply-To: <20220628005611.13106-1-casey@schaufler-ca.com> References: <20220628005611.13106-1-casey@schaufler-ca.com> MIME-Version: 1.0 X-Mimecast-Impersonation-Protect: Policy=CLT - Impersonation Protection Definition; Similar Internal Domain=false; Similar Monitored External Domain=false; Custom External Domain=false; Mimecast External Domain=false; Newly Observed Domain=false; Internal User Name=false; Custom Display Name List=false; Reply-to Address Mismatch=false; Targeted Threat Dictionary=false; Mimecast Threat Dictionary=false; Custom Threat Dictionary=false X-Scanned-By: MIMEDefang 2.85 on 10.11.54.9 X-BeenThere: linux-audit@redhat.com X-Mailman-Version: 2.1.29 Precedence: list List-Id: Linux Audit Discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: john.johansen@canonical.com, linux-kernel@vger.kernel.org, linux-audit@redhat.com Errors-To: linux-audit-bounces@redhat.com Sender: "Linux-audit" X-Scanned-By: MIMEDefang 2.85 on 10.11.54.8 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=linux-audit-bounces@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Provide interfaces to map LSM slot numbers and LSM names. Update the LSM registration code to save this information. Acked-by: Paul Moore Reviewed-by: Kees Cook Signed-off-by: Casey Schaufler --- include/linux/security.h | 4 ++++ security/security.c | 45 ++++++++++++++++++++++++++++++++++++++++ 2 files changed, 49 insertions(+) diff --git a/include/linux/security.h b/include/linux/security.h index 835fbb86a2bc..5b7a21237fea 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -197,6 +197,10 @@ static inline bool lsmblob_equal(const struct lsmblob *bloba, return !memcmp(bloba, blobb, sizeof(*bloba)); } +/* Map lsm names to blob slot numbers */ +extern int lsm_name_to_slot(char *name); +extern const char *lsm_slot_to_name(int slot); + /* These functions are in security/commoncap.c */ extern int cap_capable(const struct cred *cred, struct user_namespace *ns, int cap, unsigned int opts); diff --git a/security/security.c b/security/security.c index 8fdf046fc749..37c14572501e 100644 --- a/security/security.c +++ b/security/security.c @@ -478,6 +478,50 @@ static int lsm_append(const char *new, char **result) * Current index to use while initializing the lsmblob secid list. */ static int lsm_slot __lsm_ro_after_init; +static struct lsm_id *lsm_slotlist[LSMBLOB_ENTRIES] __lsm_ro_after_init; + +/** + * lsm_name_to_slot - Report the slot number for a security module + * @name: name of the security module + * + * Look up the slot number for the named security module. + * Returns the slot number or LSMBLOB_INVALID if @name is not + * a registered security module name. + */ +int lsm_name_to_slot(char *name) +{ + int i; + + for (i = 0; i < lsm_slot; i++) + if (strcmp(lsm_slotlist[i]->lsm, name) == 0) + return i; + + return LSMBLOB_INVALID; +} + +/** + * lsm_slot_to_name - Get the name of the security module in a slot + * @slot: index into the interface LSM slot list. + * + * Provide the name of the security module associated with + * a interface LSM slot. + * + * If @slot is LSMBLOB_INVALID return the value + * for slot 0 if it has been set, otherwise NULL. + * + * Returns a pointer to the name string or NULL. + */ +const char *lsm_slot_to_name(int slot) +{ + if (slot == LSMBLOB_INVALID) + slot = 0; + else if (slot >= LSMBLOB_ENTRIES || slot < 0) + return NULL; + + if (lsm_slotlist[slot] == NULL) + return NULL; + return lsm_slotlist[slot]->lsm; +} /** * security_add_hooks - Add a modules hooks to the hook lists. @@ -499,6 +543,7 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, if (lsmid->slot == LSMBLOB_NEEDED) { if (lsm_slot >= LSMBLOB_ENTRIES) panic("%s Too many LSMs registered.\n", __func__); + lsm_slotlist[lsm_slot] = lsmid; lsmid->slot = lsm_slot++; init_debug("%s assigned lsmblob slot %d\n", lsmid->lsm, lsmid->slot); -- 2.36.1 -- Linux-audit mailing list Linux-audit@redhat.com https://listman.redhat.com/mailman/listinfo/linux-audit