[PATCH] Smack: getting the Smack security context of keys

[PATCH] Smack: getting the Smack security context of keys

[José Bollo]

With this commit, the LSM Smack implements the LSM
side part of the system call keyctl with the action
code KEYCTL_GET_SECURITY.

It is now possible to get the context of, for example,
the user session key using the command "keyctl security @s".

Signed-off-by: José Bollo <jose.bollo@open.eurogiciel.org>
---
 security/smack/smack_lsm.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index fa64740..c1ff996 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -3208,6 +3208,35 @@ static int smack_key_permission(key_ref_t
key_ref,
        return smk_access(tsp, keyp->security,
                                 MAY_READWRITE, &ad);
 }
+
+/*
+ * smack_key_getsecurity - Smack label tagging the key
+ * @key points to the key to be queried
+ * @_buffer points to a pointer that should be set to point to the
+ * resulting string (if no label or an error occurs).
+ * Return the length of the string (including terminating NUL) or -ve
if
+ * an error.
+ * May also return 0 (and a NULL buffer pointer) if there is no label.
+ */
+static int smack_key_getsecurity(struct key *key, char **_buffer)
+{
+       int length;
+       char *copy;
+
+       if (key->security == NULL) {
+               *_buffer = NULL;
+               return 0;
+       }
+
+       length = (int)strlen(key->security) + 1;
+       copy = kmalloc((size_t)length, GFP_KERNEL);
+       if (copy == NULL)
+               return -ENOMEM;
+
+       memcpy(copy, key->security, (size_t)length);
+       *_buffer = copy;
+       return length;
+}
 #endif /* CONFIG_KEYS */
 
 /*
@@ -3514,6 +3543,7 @@ struct security_operations smack_ops = {
        .key_alloc =                    smack_key_alloc,
        .key_free =                     smack_key_free,
        .key_permission =               smack_key_permission,
+       .key_getsecurity =              smack_key_getsecurity,
 #endif /* CONFIG_KEYS */
 
  /* Audit hooks */
-- 
2.1.2

Re: [PATCH] Smack: getting the Smack security context of keys

[Casey Schaufler]

On 2/17/2015 6:41 AM, José Bollo wrote:
> With this commit, the LSM Smack implements the LSM
> side part of the system call keyctl with the action
> code KEYCTL_GET_SECURITY.
>
> It is now possible to get the context of, for example,
> the user session key using the command "keyctl security @s".
>
> Signed-off-by: José Bollo <jose.bollo@open.eurogiciel.org>

Applied to git://git.gitorious.org/smack-next/kernel.git#smack-for-4.1

> ---
>  security/smack/smack_lsm.c | 30 ++++++++++++++++++++++++++++++
>  1 file changed, 30 insertions(+)
>
> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
> index fa64740..c1ff996 100644
> --- a/security/smack/smack_lsm.c
> +++ b/security/smack/smack_lsm.c
> @@ -3208,6 +3208,35 @@ static int smack_key_permission(key_ref_t
> key_ref,
>         return smk_access(tsp, keyp->security,
>                                  MAY_READWRITE, &ad);
>  }
> +
> +/*
> + * smack_key_getsecurity - Smack label tagging the key
> + * @key points to the key to be queried
> + * @_buffer points to a pointer that should be set to point to the
> + * resulting string (if no label or an error occurs).
> + * Return the length of the string (including terminating NUL) or -ve
> if
> + * an error.
> + * May also return 0 (and a NULL buffer pointer) if there is no label.
> + */
> +static int smack_key_getsecurity(struct key *key, char **_buffer)
> +{
> +       int length;
> +       char *copy;
> +
> +       if (key->security == NULL) {
> +               *_buffer = NULL;
> +               return 0;
> +       }
> +
> +       length = (int)strlen(key->security) + 1;
> +       copy = kmalloc((size_t)length, GFP_KERNEL);
> +       if (copy == NULL)
> +               return -ENOMEM;
> +
> +       memcpy(copy, key->security, (size_t)length);
> +       *_buffer = copy;
> +       return length;
> +}
>  #endif /* CONFIG_KEYS */
>  
>  /*
> @@ -3514,6 +3543,7 @@ struct security_operations smack_ops = {
>         .key_alloc =                    smack_key_alloc,
>         .key_free =                     smack_key_free,
>         .key_permission =               smack_key_permission,
> +       .key_getsecurity =              smack_key_getsecurity,
>  #endif /* CONFIG_KEYS */
>  
>   /* Audit hooks */