From mboxrd@z Thu Jan 1 00:00:00 1970 From: casey.schaufler@intel.com (Casey Schaufler) Date: Mon, 20 Aug 2018 17:04:44 -0700 Subject: [PATCH v3 5/5] SELinux: Support SELinux determination of side-channel In-Reply-To: <20180821000444.7004-1-casey.schaufler@intel.com> References: <20180821000444.7004-1-casey.schaufler@intel.com> Message-ID: <20180821000444.7004-6-casey.schaufler@intel.com> To: linux-security-module@vger.kernel.org List-Id: linux-security-module.vger.kernel.org SELinux considers tasks to be side-channel safe if they have FILE__READ access. Signed-off-by: Casey Schaufler --- security/selinux/hooks.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index a8bf324130f5..992f2402edaa 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -4219,6 +4219,14 @@ static void selinux_task_to_inode(struct task_struct *p, spin_unlock(&isec->lock); } +static int selinux_task_safe_sidechannel(struct task_struct *p) +{ + struct av_decision avd; + + return avc_has_perm_noaudit(&selinux_state, current_sid(), task_sid(p), + SECCLASS_FILE, FILE__READ, 0, &avd); +} + /* Returns error only if unable to parse addresses */ static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct common_audit_data *ad, u8 *proto) @@ -7002,6 +7010,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(task_movememory, selinux_task_movememory), LSM_HOOK_INIT(task_kill, selinux_task_kill), LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode), + LSM_HOOK_INIT(task_safe_sidechannel, selinux_task_safe_sidechannel), LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission), LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid), -- 2.17.1