* [PATCH 1/6] Security: define security_sk_getsecid.
2011-08-09 7:28 [v2 PATCH 0/6] Export the sock's security context to proc rongqing.li
@ 2011-08-09 7:28 ` rongqing.li
2011-08-09 16:13 ` Casey Schaufler
2011-08-09 7:28 ` [PATCH 2/6] Define the function to write sock's security context to seq_file rongqing.li
` (4 subsequent siblings)
5 siblings, 1 reply; 16+ messages in thread
From: rongqing.li @ 2011-08-09 7:28 UTC (permalink / raw)
To: netdev, selinux, linux-security-module, sds
From: Roy.Li <rongqing.li@windriver.com>
Define security_sk_getsecid to get the security id of a sock.
Signed-off-by: Roy.Li <rongqing.li@windriver.com>
---
include/linux/security.h | 6 ++++++
security/security.c | 6 ++++++
2 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/include/linux/security.h b/include/linux/security.h
index ebd2a53..739ac39 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -2560,6 +2560,7 @@ int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
void security_sk_free(struct sock *sk);
void security_sk_clone(const struct sock *sk, struct sock *newsk);
void security_sk_classify_flow(struct sock *sk, struct flowi *fl);
+void security_sk_getsecid(struct sock *sk, u32 *secid);
void security_req_classify_flow(const struct request_sock *req, struct flowi *fl);
void security_sock_graft(struct sock*sk, struct socket *parent);
int security_inet_conn_request(struct sock *sk,
@@ -2701,6 +2702,11 @@ static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
{
}
+static inline void security_sk_getsecid(struct sock *sk, u32 *secid)
+{
+ *secid = 0;
+}
+
static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
{
}
diff --git a/security/security.c b/security/security.c
index 0e4fccf..b0e0825 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1104,6 +1104,12 @@ void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
}
EXPORT_SYMBOL(security_sk_classify_flow);
+void security_sk_getsecid(struct sock *sk, u32 *secid)
+{
+ security_ops->sk_getsecid(sk, secid);
+}
+EXPORT_SYMBOL(security_sk_getsecid);
+
void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
{
security_ops->req_classify_flow(req, fl);
--
1.7.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* Re: [PATCH 1/6] Security: define security_sk_getsecid.
2011-08-09 7:28 ` [PATCH 1/6] Security: define security_sk_getsecid rongqing.li
@ 2011-08-09 16:13 ` Casey Schaufler
2011-08-10 0:43 ` Rongqing Li
0 siblings, 1 reply; 16+ messages in thread
From: Casey Schaufler @ 2011-08-09 16:13 UTC (permalink / raw)
To: rongqing.li; +Cc: netdev, selinux, linux-security-module, sds, Casey Schaufler
On 8/9/2011 12:28 AM, rongqing.li@windriver.com wrote:
> From: Roy.Li <rongqing.li@windriver.com>
>
> Define security_sk_getsecid to get the security id of a sock.
Why are you requesting the secid when you're just going to
use it to get the secctx? Why not ask for that directly?
Is there ever a case where you only want the secid?
>
> Signed-off-by: Roy.Li <rongqing.li@windriver.com>
> ---
> include/linux/security.h | 6 ++++++
> security/security.c | 6 ++++++
> 2 files changed, 12 insertions(+), 0 deletions(-)
>
> diff --git a/include/linux/security.h b/include/linux/security.h
> index ebd2a53..739ac39 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -2560,6 +2560,7 @@ int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
> void security_sk_free(struct sock *sk);
> void security_sk_clone(const struct sock *sk, struct sock *newsk);
> void security_sk_classify_flow(struct sock *sk, struct flowi *fl);
> +void security_sk_getsecid(struct sock *sk, u32 *secid);
> void security_req_classify_flow(const struct request_sock *req, struct flowi *fl);
> void security_sock_graft(struct sock*sk, struct socket *parent);
> int security_inet_conn_request(struct sock *sk,
> @@ -2701,6 +2702,11 @@ static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
> {
> }
>
> +static inline void security_sk_getsecid(struct sock *sk, u32 *secid)
> +{
> + *secid = 0;
> +}
> +
> static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
> {
> }
> diff --git a/security/security.c b/security/security.c
> index 0e4fccf..b0e0825 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -1104,6 +1104,12 @@ void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
> }
> EXPORT_SYMBOL(security_sk_classify_flow);
>
> +void security_sk_getsecid(struct sock *sk, u32 *secid)
> +{
> + security_ops->sk_getsecid(sk, secid);
> +}
> +EXPORT_SYMBOL(security_sk_getsecid);
> +
> void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
> {
> security_ops->req_classify_flow(req, fl);
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH 1/6] Security: define security_sk_getsecid.
2011-08-09 16:13 ` Casey Schaufler
@ 2011-08-10 0:43 ` Rongqing Li
2011-08-10 0:57 ` Casey Schaufler
0 siblings, 1 reply; 16+ messages in thread
From: Rongqing Li @ 2011-08-10 0:43 UTC (permalink / raw)
To: Casey Schaufler; +Cc: netdev, selinux, linux-security-module, sds
On 08/10/2011 12:13 AM, Casey Schaufler wrote:
> On 8/9/2011 12:28 AM, rongqing.li@windriver.com wrote:
>> From: Roy.Li<rongqing.li@windriver.com>
>>
>> Define security_sk_getsecid to get the security id of a sock.
>
> Why are you requesting the secid when you're just going to
> use it to get the secctx? Why not ask for that directly?
> Is there ever a case where you only want the secid?
>
Hi:
As I know, we have not method to get secctx directly.
On the most of time, we get secctx like this.
The below comes from kernel/auditsc.c
void audit_log_task_context(struct audit_buffer *ab)
{
char *ctx = NULL;
unsigned len;
int error;
u32 sid;
security_task_getsecid(current, &sid);
if (!sid)
return;
error = security_secid_to_secctx(sid, &ctx, &len);
if (error) {
if (error != -EINVAL)
goto error_path;
return;
}
audit_log_format(ab, " subj=%s", ctx);
security_release_secctx(ctx, len);
return;
error_path:
audit_panic("error in audit_log_task_context");
return;
}
-Roy
>>
>> Signed-off-by: Roy.Li<rongqing.li@windriver.com>
>> ---
>> include/linux/security.h | 6 ++++++
>> security/security.c | 6 ++++++
>> 2 files changed, 12 insertions(+), 0 deletions(-)
>>
>> diff --git a/include/linux/security.h b/include/linux/security.h
>> index ebd2a53..739ac39 100644
>> --- a/include/linux/security.h
>> +++ b/include/linux/security.h
>> @@ -2560,6 +2560,7 @@ int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
>> void security_sk_free(struct sock *sk);
>> void security_sk_clone(const struct sock *sk, struct sock *newsk);
>> void security_sk_classify_flow(struct sock *sk, struct flowi *fl);
>> +void security_sk_getsecid(struct sock *sk, u32 *secid);
>> void security_req_classify_flow(const struct request_sock *req, struct flowi *fl);
>> void security_sock_graft(struct sock*sk, struct socket *parent);
>> int security_inet_conn_request(struct sock *sk,
>> @@ -2701,6 +2702,11 @@ static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
>> {
>> }
>>
>> +static inline void security_sk_getsecid(struct sock *sk, u32 *secid)
>> +{
>> + *secid = 0;
>> +}
>> +
>> static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
>> {
>> }
>> diff --git a/security/security.c b/security/security.c
>> index 0e4fccf..b0e0825 100644
>> --- a/security/security.c
>> +++ b/security/security.c
>> @@ -1104,6 +1104,12 @@ void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
>> }
>> EXPORT_SYMBOL(security_sk_classify_flow);
>>
>> +void security_sk_getsecid(struct sock *sk, u32 *secid)
>> +{
>> + security_ops->sk_getsecid(sk, secid);
>> +}
>> +EXPORT_SYMBOL(security_sk_getsecid);
>> +
>> void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
>> {
>> security_ops->req_classify_flow(req, fl);
>
>
--
Best Reagrds,
Roy | RongQing Li
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH 1/6] Security: define security_sk_getsecid.
2011-08-10 0:43 ` Rongqing Li
@ 2011-08-10 0:57 ` Casey Schaufler
2011-08-10 1:24 ` Rongqing Li
0 siblings, 1 reply; 16+ messages in thread
From: Casey Schaufler @ 2011-08-10 0:57 UTC (permalink / raw)
To: Rongqing Li; +Cc: netdev, selinux, linux-security-module, sds
On 8/9/2011 5:43 PM, Rongqing Li wrote:
> On 08/10/2011 12:13 AM, Casey Schaufler wrote:
>> On 8/9/2011 12:28 AM, rongqing.li@windriver.com wrote:
>>> From: Roy.Li<rongqing.li@windriver.com>
>>>
>>> Define security_sk_getsecid to get the security id of a sock.
>>
>> Why are you requesting the secid when you're just going to
>> use it to get the secctx? Why not ask for that directly?
>> Is there ever a case where you only want the secid?
>>
> Hi:
>
> As I know, we have not method to get secctx directly.
You are defining the method! Ask for what you want!
The whole notion of secids is a holdover from the bad old
days when SELinux was a user space based enforcement mechanism.
The audit system was implemented when SELinux was the lone LSM
and unfortunately and unnecessarily propagated the use of secids.
If an object has a secid it must also have a secctx. The
interfaces that use secids could just as well use the secctx.
It is wasteful to create a new interface that fetches a secid
just to turn around and ask for the secctx in all cases.
> On the most of time, we get secctx like this.
>
> The below comes from kernel/auditsc.c
>
> void audit_log_task_context(struct audit_buffer *ab)
> {
> char *ctx = NULL;
> unsigned len;
> int error;
> u32 sid;
>
> security_task_getsecid(current, &sid);
> if (!sid)
> return;
>
> error = security_secid_to_secctx(sid, &ctx, &len);
> if (error) {
> if (error != -EINVAL)
> goto error_path;
> return;
> }
>
> audit_log_format(ab, " subj=%s", ctx);
> security_release_secctx(ctx, len);
> return;
>
> error_path:
> audit_panic("error in audit_log_task_context");
> return;
> }
>
>
> -Roy
>
>
>>>
>>> Signed-off-by: Roy.Li<rongqing.li@windriver.com>
>>> ---
>>> include/linux/security.h | 6 ++++++
>>> security/security.c | 6 ++++++
>>> 2 files changed, 12 insertions(+), 0 deletions(-)
>>>
>>> diff --git a/include/linux/security.h b/include/linux/security.h
>>> index ebd2a53..739ac39 100644
>>> --- a/include/linux/security.h
>>> +++ b/include/linux/security.h
>>> @@ -2560,6 +2560,7 @@ int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
>>> void security_sk_free(struct sock *sk);
>>> void security_sk_clone(const struct sock *sk, struct sock *newsk);
>>> void security_sk_classify_flow(struct sock *sk, struct flowi *fl);
>>> +void security_sk_getsecid(struct sock *sk, u32 *secid);
>>> void security_req_classify_flow(const struct request_sock *req, struct flowi *fl);
>>> void security_sock_graft(struct sock*sk, struct socket *parent);
>>> int security_inet_conn_request(struct sock *sk,
>>> @@ -2701,6 +2702,11 @@ static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
>>> {
>>> }
>>>
>>> +static inline void security_sk_getsecid(struct sock *sk, u32 *secid)
>>> +{
>>> + *secid = 0;
>>> +}
>>> +
>>> static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
>>> {
>>> }
>>> diff --git a/security/security.c b/security/security.c
>>> index 0e4fccf..b0e0825 100644
>>> --- a/security/security.c
>>> +++ b/security/security.c
>>> @@ -1104,6 +1104,12 @@ void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
>>> }
>>> EXPORT_SYMBOL(security_sk_classify_flow);
>>>
>>> +void security_sk_getsecid(struct sock *sk, u32 *secid)
>>> +{
>>> + security_ops->sk_getsecid(sk, secid);
>>> +}
>>> +EXPORT_SYMBOL(security_sk_getsecid);
>>> +
>>> void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
>>> {
>>> security_ops->req_classify_flow(req, fl);
>>
>>
>
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH 1/6] Security: define security_sk_getsecid.
2011-08-10 0:57 ` Casey Schaufler
@ 2011-08-10 1:24 ` Rongqing Li
2011-08-10 1:35 ` Casey Schaufler
2011-08-10 12:49 ` Stephen Smalley
0 siblings, 2 replies; 16+ messages in thread
From: Rongqing Li @ 2011-08-10 1:24 UTC (permalink / raw)
To: Casey Schaufler; +Cc: netdev, selinux, linux-security-module, sds
On 08/10/2011 08:57 AM, Casey Schaufler wrote:
> On 8/9/2011 5:43 PM, Rongqing Li wrote:
>> On 08/10/2011 12:13 AM, Casey Schaufler wrote:
>>> On 8/9/2011 12:28 AM, rongqing.li@windriver.com wrote:
>>>> From: Roy.Li<rongqing.li@windriver.com>
>>>>
>>>> Define security_sk_getsecid to get the security id of a sock.
>>>
>>> Why are you requesting the secid when you're just going to
>>> use it to get the secctx? Why not ask for that directly?
>>> Is there ever a case where you only want the secid?
>>>
>> Hi:
>>
>> As I know, we have not method to get secctx directly.
>
> You are defining the method! Ask for what you want!
>
> The whole notion of secids is a holdover from the bad old
> days when SELinux was a user space based enforcement mechanism.
> The audit system was implemented when SELinux was the lone LSM
> and unfortunately and unnecessarily propagated the use of secids.
> If an object has a secid it must also have a secctx. The
> interfaces that use secids could just as well use the secctx.
> It is wasteful to create a new interface that fetches a secid
> just to turn around and ask for the secctx in all cases.
>
Do you means I should write a method like below
security_sk_getsecctx(struct sock *sk, char *secctx, int *len)?
But secctx only is used to user. secid is used to source code to
compute and compare the access permission.
And I do not see the same method like
security_task_getsecctx(). but security_task_getsecid() has been
implemented in kernel source code.
-Roy
>> On the most of time, we get secctx like this.
>>
>> The below comes from kernel/auditsc.c
>>
>> void audit_log_task_context(struct audit_buffer *ab)
>> {
>> char *ctx = NULL;
>> unsigned len;
>> int error;
>> u32 sid;
>>
>> security_task_getsecid(current,&sid);
>> if (!sid)
>> return;
>>
>> error = security_secid_to_secctx(sid,&ctx,&len);
>> if (error) {
>> if (error != -EINVAL)
>> goto error_path;
>> return;
>> }
>>
>> audit_log_format(ab, " subj=%s", ctx);
>> security_release_secctx(ctx, len);
>> return;
>>
>> error_path:
>> audit_panic("error in audit_log_task_context");
>> return;
>> }
>>
>>
>> -Roy
>>
>>
>>>>
>>>> Signed-off-by: Roy.Li<rongqing.li@windriver.com>
>>>> ---
>>>> include/linux/security.h | 6 ++++++
>>>> security/security.c | 6 ++++++
>>>> 2 files changed, 12 insertions(+), 0 deletions(-)
>>>>
>>>> diff --git a/include/linux/security.h b/include/linux/security.h
>>>> index ebd2a53..739ac39 100644
>>>> --- a/include/linux/security.h
>>>> +++ b/include/linux/security.h
>>>> @@ -2560,6 +2560,7 @@ int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
>>>> void security_sk_free(struct sock *sk);
>>>> void security_sk_clone(const struct sock *sk, struct sock *newsk);
>>>> void security_sk_classify_flow(struct sock *sk, struct flowi *fl);
>>>> +void security_sk_getsecid(struct sock *sk, u32 *secid);
>>>> void security_req_classify_flow(const struct request_sock *req, struct flowi *fl);
>>>> void security_sock_graft(struct sock*sk, struct socket *parent);
>>>> int security_inet_conn_request(struct sock *sk,
>>>> @@ -2701,6 +2702,11 @@ static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
>>>> {
>>>> }
>>>>
>>>> +static inline void security_sk_getsecid(struct sock *sk, u32 *secid)
>>>> +{
>>>> + *secid = 0;
>>>> +}
>>>> +
>>>> static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
>>>> {
>>>> }
>>>> diff --git a/security/security.c b/security/security.c
>>>> index 0e4fccf..b0e0825 100644
>>>> --- a/security/security.c
>>>> +++ b/security/security.c
>>>> @@ -1104,6 +1104,12 @@ void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
>>>> }
>>>> EXPORT_SYMBOL(security_sk_classify_flow);
>>>>
>>>> +void security_sk_getsecid(struct sock *sk, u32 *secid)
>>>> +{
>>>> + security_ops->sk_getsecid(sk, secid);
>>>> +}
>>>> +EXPORT_SYMBOL(security_sk_getsecid);
>>>> +
>>>> void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
>>>> {
>>>> security_ops->req_classify_flow(req, fl);
>>>
>>>
>>
>
>
--
Best Reagrds,
Roy | RongQing Li
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH 1/6] Security: define security_sk_getsecid.
2011-08-10 1:24 ` Rongqing Li
@ 2011-08-10 1:35 ` Casey Schaufler
2011-08-10 1:44 ` Rongqing Li
2011-08-10 12:49 ` Stephen Smalley
1 sibling, 1 reply; 16+ messages in thread
From: Casey Schaufler @ 2011-08-10 1:35 UTC (permalink / raw)
To: Rongqing Li; +Cc: netdev, selinux, linux-security-module, sds, Casey Schaufler
On 8/9/2011 6:24 PM, Rongqing Li wrote:
> On 08/10/2011 08:57 AM, Casey Schaufler wrote:
>> On 8/9/2011 5:43 PM, Rongqing Li wrote:
>>> On 08/10/2011 12:13 AM, Casey Schaufler wrote:
>>>> On 8/9/2011 12:28 AM, rongqing.li@windriver.com wrote:
>>>>> From: Roy.Li<rongqing.li@windriver.com>
>>>>>
>>>>> Define security_sk_getsecid to get the security id of a sock.
>>>>
>>>> Why are you requesting the secid when you're just going to
>>>> use it to get the secctx? Why not ask for that directly?
>>>> Is there ever a case where you only want the secid?
>>>>
>>> Hi:
>>>
>>> As I know, we have not method to get secctx directly.
>>
>> You are defining the method! Ask for what you want!
>>
>> The whole notion of secids is a holdover from the bad old
>> days when SELinux was a user space based enforcement mechanism.
>> The audit system was implemented when SELinux was the lone LSM
>> and unfortunately and unnecessarily propagated the use of secids.
>> If an object has a secid it must also have a secctx. The
>> interfaces that use secids could just as well use the secctx.
>> It is wasteful to create a new interface that fetches a secid
>> just to turn around and ask for the secctx in all cases.
>>
>
> Do you means I should write a method like below
> security_sk_getsecctx(struct sock *sk, char *secctx, int *len)?
Yes. That is exactly what you should do.
>
> But secctx only is used to user.
But all you're doing is printing out the secctx. The only
thing you are doing with the secid is converting it to a
secctx.
> secid is used to source code to
> compute and compare the access permission.
That will depend on the LSM involved. You are making a change to
the LSM, not just SELinux.
>
> And I do not see the same method like
> security_task_getsecctx(). but security_task_getsecid() has been
> implemented in kernel source code.
Have a look at how those interfaces are used.
>
> -Roy
>
>
>>> On the most of time, we get secctx like this.
>>>
>>> The below comes from kernel/auditsc.c
>>>
>>> void audit_log_task_context(struct audit_buffer *ab)
>>> {
>>> char *ctx = NULL;
>>> unsigned len;
>>> int error;
>>> u32 sid;
>>>
>>> security_task_getsecid(current,&sid);
>>> if (!sid)
>>> return;
>>>
>>> error = security_secid_to_secctx(sid,&ctx,&len);
>>> if (error) {
>>> if (error != -EINVAL)
>>> goto error_path;
>>> return;
>>> }
>>>
>>> audit_log_format(ab, " subj=%s", ctx);
>>> security_release_secctx(ctx, len);
>>> return;
>>>
>>> error_path:
>>> audit_panic("error in audit_log_task_context");
>>> return;
>>> }
>>>
>>>
>>> -Roy
>>>
>>>
>>>>>
>>>>> Signed-off-by: Roy.Li<rongqing.li@windriver.com>
>>>>> ---
>>>>> include/linux/security.h | 6 ++++++
>>>>> security/security.c | 6 ++++++
>>>>> 2 files changed, 12 insertions(+), 0 deletions(-)
>>>>>
>>>>> diff --git a/include/linux/security.h b/include/linux/security.h
>>>>> index ebd2a53..739ac39 100644
>>>>> --- a/include/linux/security.h
>>>>> +++ b/include/linux/security.h
>>>>> @@ -2560,6 +2560,7 @@ int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
>>>>> void security_sk_free(struct sock *sk);
>>>>> void security_sk_clone(const struct sock *sk, struct sock *newsk);
>>>>> void security_sk_classify_flow(struct sock *sk, struct flowi *fl);
>>>>> +void security_sk_getsecid(struct sock *sk, u32 *secid);
>>>>> void security_req_classify_flow(const struct request_sock *req, struct flowi *fl);
>>>>> void security_sock_graft(struct sock*sk, struct socket *parent);
>>>>> int security_inet_conn_request(struct sock *sk,
>>>>> @@ -2701,6 +2702,11 @@ static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
>>>>> {
>>>>> }
>>>>>
>>>>> +static inline void security_sk_getsecid(struct sock *sk, u32 *secid)
>>>>> +{
>>>>> + *secid = 0;
>>>>> +}
>>>>> +
>>>>> static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
>>>>> {
>>>>> }
>>>>> diff --git a/security/security.c b/security/security.c
>>>>> index 0e4fccf..b0e0825 100644
>>>>> --- a/security/security.c
>>>>> +++ b/security/security.c
>>>>> @@ -1104,6 +1104,12 @@ void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
>>>>> }
>>>>> EXPORT_SYMBOL(security_sk_classify_flow);
>>>>>
>>>>> +void security_sk_getsecid(struct sock *sk, u32 *secid)
>>>>> +{
>>>>> + security_ops->sk_getsecid(sk, secid);
>>>>> +}
>>>>> +EXPORT_SYMBOL(security_sk_getsecid);
>>>>> +
>>>>> void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
>>>>> {
>>>>> security_ops->req_classify_flow(req, fl);
>>>>
>>>>
>>>
>>
>>
>
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH 1/6] Security: define security_sk_getsecid.
2011-08-10 1:35 ` Casey Schaufler
@ 2011-08-10 1:44 ` Rongqing Li
0 siblings, 0 replies; 16+ messages in thread
From: Rongqing Li @ 2011-08-10 1:44 UTC (permalink / raw)
To: Casey Schaufler; +Cc: netdev, selinux, linux-security-module, sds
On 08/10/2011 09:35 AM, Casey Schaufler wrote:
> On 8/9/2011 6:24 PM, Rongqing Li wrote:
>> On 08/10/2011 08:57 AM, Casey Schaufler wrote:
>>> On 8/9/2011 5:43 PM, Rongqing Li wrote:
>>>> On 08/10/2011 12:13 AM, Casey Schaufler wrote:
>>>>> On 8/9/2011 12:28 AM, rongqing.li@windriver.com wrote:
>>>>>> From: Roy.Li<rongqing.li@windriver.com>
>>>>>>
>>>>>> Define security_sk_getsecid to get the security id of a sock.
>>>>>
>>>>> Why are you requesting the secid when you're just going to
>>>>> use it to get the secctx? Why not ask for that directly?
>>>>> Is there ever a case where you only want the secid?
>>>>>
>>>> Hi:
>>>>
>>>> As I know, we have not method to get secctx directly.
>>>
>>> You are defining the method! Ask for what you want!
>>>
>>> The whole notion of secids is a holdover from the bad old
>>> days when SELinux was a user space based enforcement mechanism.
>>> The audit system was implemented when SELinux was the lone LSM
>>> and unfortunately and unnecessarily propagated the use of secids.
>>> If an object has a secid it must also have a secctx. The
>>> interfaces that use secids could just as well use the secctx.
>>> It is wasteful to create a new interface that fetches a secid
>>> just to turn around and ask for the secctx in all cases.
>>>
>>
>> Do you means I should write a method like below
>> security_sk_getsecctx(struct sock *sk, char *secctx, int *len)?
>
> Yes. That is exactly what you should do.
>
>>
>> But secctx only is used to user.
>
> But all you're doing is printing out the secctx. The only
> thing you are doing with the secid is converting it to a
> secctx.
>
>> secid is used to source code to
>> compute and compare the access permission.
>
> That will depend on the LSM involved. You are making a change to
> the LSM, not just SELinux.
>
>>
>> And I do not see the same method like
>> security_task_getsecctx(). but security_task_getsecid() has been
>> implemented in kernel source code.
>
> Have a look at how those interfaces are used.
>
>
Thank you very much.
I will study these interfaces, and hope get your comments when
I send new patches.
Thanks.
>>
>> -Roy
>>
>>
>>>> On the most of time, we get secctx like this.
>>>>
>>>> The below comes from kernel/auditsc.c
>>>>
>>>> void audit_log_task_context(struct audit_buffer *ab)
>>>> {
>>>> char *ctx = NULL;
>>>> unsigned len;
>>>> int error;
>>>> u32 sid;
>>>>
>>>> security_task_getsecid(current,&sid);
>>>> if (!sid)
>>>> return;
>>>>
>>>> error = security_secid_to_secctx(sid,&ctx,&len);
>>>> if (error) {
>>>> if (error != -EINVAL)
>>>> goto error_path;
>>>> return;
>>>> }
>>>>
>>>> audit_log_format(ab, " subj=%s", ctx);
>>>> security_release_secctx(ctx, len);
>>>> return;
>>>>
>>>> error_path:
>>>> audit_panic("error in audit_log_task_context");
>>>> return;
>>>> }
>>>>
>>>>
>>>> -Roy
>>>>
>>>>
>>>>>>
>>>>>> Signed-off-by: Roy.Li<rongqing.li@windriver.com>
>>>>>> ---
>>>>>> include/linux/security.h | 6 ++++++
>>>>>> security/security.c | 6 ++++++
>>>>>> 2 files changed, 12 insertions(+), 0 deletions(-)
>>>>>>
>>>>>> diff --git a/include/linux/security.h b/include/linux/security.h
>>>>>> index ebd2a53..739ac39 100644
>>>>>> --- a/include/linux/security.h
>>>>>> +++ b/include/linux/security.h
>>>>>> @@ -2560,6 +2560,7 @@ int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
>>>>>> void security_sk_free(struct sock *sk);
>>>>>> void security_sk_clone(const struct sock *sk, struct sock *newsk);
>>>>>> void security_sk_classify_flow(struct sock *sk, struct flowi *fl);
>>>>>> +void security_sk_getsecid(struct sock *sk, u32 *secid);
>>>>>> void security_req_classify_flow(const struct request_sock *req, struct flowi *fl);
>>>>>> void security_sock_graft(struct sock*sk, struct socket *parent);
>>>>>> int security_inet_conn_request(struct sock *sk,
>>>>>> @@ -2701,6 +2702,11 @@ static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
>>>>>> {
>>>>>> }
>>>>>>
>>>>>> +static inline void security_sk_getsecid(struct sock *sk, u32 *secid)
>>>>>> +{
>>>>>> + *secid = 0;
>>>>>> +}
>>>>>> +
>>>>>> static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
>>>>>> {
>>>>>> }
>>>>>> diff --git a/security/security.c b/security/security.c
>>>>>> index 0e4fccf..b0e0825 100644
>>>>>> --- a/security/security.c
>>>>>> +++ b/security/security.c
>>>>>> @@ -1104,6 +1104,12 @@ void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
>>>>>> }
>>>>>> EXPORT_SYMBOL(security_sk_classify_flow);
>>>>>>
>>>>>> +void security_sk_getsecid(struct sock *sk, u32 *secid)
>>>>>> +{
>>>>>> + security_ops->sk_getsecid(sk, secid);
>>>>>> +}
>>>>>> +EXPORT_SYMBOL(security_sk_getsecid);
>>>>>> +
>>>>>> void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
>>>>>> {
>>>>>> security_ops->req_classify_flow(req, fl);
>>>>>
>>>>>
>>>>
>>>
>>>
>>
>
>
--
Best Reagrds,
Roy | RongQing Li
^ permalink raw reply [flat|nested] 16+ messages in thread
* Re: [PATCH 1/6] Security: define security_sk_getsecid.
2011-08-10 1:24 ` Rongqing Li
2011-08-10 1:35 ` Casey Schaufler
@ 2011-08-10 12:49 ` Stephen Smalley
1 sibling, 0 replies; 16+ messages in thread
From: Stephen Smalley @ 2011-08-10 12:49 UTC (permalink / raw)
To: Rongqing Li; +Cc: Casey Schaufler, netdev, selinux, linux-security-module
On Wed, 2011-08-10 at 09:24 +0800, Rongqing Li wrote:
> On 08/10/2011 08:57 AM, Casey Schaufler wrote:
> > On 8/9/2011 5:43 PM, Rongqing Li wrote:
> >> On 08/10/2011 12:13 AM, Casey Schaufler wrote:
> >>> On 8/9/2011 12:28 AM, rongqing.li@windriver.com wrote:
> >>>> From: Roy.Li<rongqing.li@windriver.com>
> >>>>
> >>>> Define security_sk_getsecid to get the security id of a sock.
> >>>
> >>> Why are you requesting the secid when you're just going to
> >>> use it to get the secctx? Why not ask for that directly?
> >>> Is there ever a case where you only want the secid?
> >>>
> >> Hi:
> >>
> >> As I know, we have not method to get secctx directly.
> >
> > You are defining the method! Ask for what you want!
> >
> > The whole notion of secids is a holdover from the bad old
> > days when SELinux was a user space based enforcement mechanism.
> > The audit system was implemented when SELinux was the lone LSM
> > and unfortunately and unnecessarily propagated the use of secids.
> > If an object has a secid it must also have a secctx. The
> > interfaces that use secids could just as well use the secctx.
> > It is wasteful to create a new interface that fetches a secid
> > just to turn around and ask for the secctx in all cases.
> >
>
> Do you means I should write a method like below
> security_sk_getsecctx(struct sock *sk, char *secctx, int *len)?
>
> But secctx only is used to user. secid is used to source code to
> compute and compare the access permission.
>
> And I do not see the same method like
> security_task_getsecctx(). but security_task_getsecid() has been
> implemented in kernel source code.
Unlike Casey, I don't think secids are a bad idea or just a holdover -
we find them to be quite useful and efficient in SELinux. But in this
instance, he is correct that there is no reason to first fetch a secid
only to convert it into a context. There are other cases where you do
in fact want to avoid generating and managing the life cycle of a
security context string until you truly need it, and thus a secid makes
sense. So if you want to add a security_sk_getsecctx() hook, feel free.
There are some existing examples, e.g. security_inode_getsecctx() for
inodes, security_getprocattr() for tasks. Note that they use a slightly
different interface than what you describe above.
--
Stephen Smalley
National Security Agency
^ permalink raw reply [flat|nested] 16+ messages in thread
* [PATCH 2/6] Define the function to write sock's security context to seq_file.
2011-08-09 7:28 [v2 PATCH 0/6] Export the sock's security context to proc rongqing.li
2011-08-09 7:28 ` [PATCH 1/6] Security: define security_sk_getsecid rongqing.li
@ 2011-08-09 7:28 ` rongqing.li
2011-08-09 7:28 ` [PATCH 3/6] Export the raw sock's security context to proc rongqing.li
` (3 subsequent siblings)
5 siblings, 0 replies; 16+ messages in thread
From: rongqing.li @ 2011-08-09 7:28 UTC (permalink / raw)
To: netdev, selinux, linux-security-module, sds
From: Roy.Li <rongqing.li@windriver.com>
sock_write_secctx will write the sock's security context to a seq_file
and return the number of characters successfully written.
This function will be called when export socket information to proc.
Signed-off-by: Roy.Li <rongqing.li@windriver.com>
---
include/net/sock.h | 1 +
net/core/sock.c | 28 ++++++++++++++++++++++++++++
2 files changed, 29 insertions(+), 0 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index 8e4062f..8bedb0c 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1828,6 +1828,7 @@ static inline struct sock *skb_steal_sock(struct sk_buff *skb)
extern void sock_enable_timestamp(struct sock *sk, int flag);
extern int sock_get_timestamp(struct sock *, struct timeval __user *);
extern int sock_get_timestampns(struct sock *, struct timespec __user *);
+extern int sock_write_secctx(struct sock *sk, struct seq_file *seq);
/*
* Enable debug/info messages
diff --git a/net/core/sock.c b/net/core/sock.c
index bc745d0..032ea72 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2254,6 +2254,34 @@ void sk_common_release(struct sock *sk)
}
EXPORT_SYMBOL(sk_common_release);
+int sock_write_secctx(struct sock *sk, struct seq_file *seq)
+{
+ char *ctx = NULL;
+ u32 ctxlen, secid;
+ int len;
+
+ if (sk == NULL)
+ goto error;
+
+ if (security_socket_getsockname(sk->sk_socket))
+ goto error;
+
+ security_sk_getsecid(sk, &secid);
+ if (!secid)
+ goto error;
+
+ if (security_secid_to_secctx(secid, &ctx, &ctxlen))
+ goto error;
+
+ seq_printf(seq, " %s%n", ctx, &len);
+ security_release_secctx(ctx, ctxlen);
+ return len;
+
+error:
+ seq_printf(seq, " %s%n", "-", &len);
+ return len;
+}
+
static DEFINE_RWLOCK(proto_list_lock);
static LIST_HEAD(proto_list);
--
1.7.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH 3/6] Export the raw sock's security context to proc.
2011-08-09 7:28 [v2 PATCH 0/6] Export the sock's security context to proc rongqing.li
2011-08-09 7:28 ` [PATCH 1/6] Security: define security_sk_getsecid rongqing.li
2011-08-09 7:28 ` [PATCH 2/6] Define the function to write sock's security context to seq_file rongqing.li
@ 2011-08-09 7:28 ` rongqing.li
2011-08-09 7:28 ` [PATCH 4/6] Export the udp " rongqing.li
` (2 subsequent siblings)
5 siblings, 0 replies; 16+ messages in thread
From: rongqing.li @ 2011-08-09 7:28 UTC (permalink / raw)
To: netdev, selinux, linux-security-module, sds
From: Roy.Li <rongqing.li@windriver.com>
The element sk_security of struct sock represents the socket
security context ID, which is inheriting from the process when
creates this socket on most of the time.
but when SELinux type_transition rule is applied to socket, or
application sets /proc/xxx/attr/createsock, the socket security
context would be different from the creating process. on this
condition, the "netstat -Z" will return wrong value, since
"netstat -Z" only returns the process security context as socket
process security.
Export the raw sock's security context to proc, so that "netstat -Z"
could be fixed by reading procfs.
Signed-off-by: Roy.Li <rongqing.li@windriver.com>
---
net/ipv4/raw.c | 7 +++++--
1 files changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 1457acb..79c17e5 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -979,12 +979,15 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
srcp = inet->inet_num;
seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
- " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n",
+ " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d",
i, src, srcp, dest, destp, sp->sk_state,
sk_wmem_alloc_get(sp),
sk_rmem_alloc_get(sp),
0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
+
+ sock_write_secctx(sp, seq);
+ seq_putc(seq, '\n');
}
static int raw_seq_show(struct seq_file *seq, void *v)
@@ -992,7 +995,7 @@ static int raw_seq_show(struct seq_file *seq, void *v)
if (v == SEQ_START_TOKEN)
seq_printf(seq, " sl local_address rem_address st tx_queue "
"rx_queue tr tm->when retrnsmt uid timeout "
- "inode ref pointer drops\n");
+ "inode ref pointer drops seclabel\n");
else
raw_sock_seq_show(seq, v, raw_seq_private(seq)->bucket);
return 0;
--
1.7.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH 4/6] Export the udp sock's security context to proc.
2011-08-09 7:28 [v2 PATCH 0/6] Export the sock's security context to proc rongqing.li
` (2 preceding siblings ...)
2011-08-09 7:28 ` [PATCH 3/6] Export the raw sock's security context to proc rongqing.li
@ 2011-08-09 7:28 ` rongqing.li
2011-08-09 7:28 ` [PATCH 5/6] Export the unix " rongqing.li
2011-08-09 7:28 ` [PATCH 6/6] Export the tcp " rongqing.li
5 siblings, 0 replies; 16+ messages in thread
From: rongqing.li @ 2011-08-09 7:28 UTC (permalink / raw)
To: netdev, selinux, linux-security-module, sds
From: Roy.Li <rongqing.li@windriver.com>
Export the udp sock's security context to proc, since it maybe
different from the sock's owner process security context.
Signed-off-by: Roy.Li <rongqing.li@windriver.com>
---
net/ipv4/udp.c | 8 +++++---
1 files changed, 5 insertions(+), 3 deletions(-)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 1b5a193..6a1aff9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2102,21 +2102,23 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
atomic_read(&sp->sk_refcnt), sp,
atomic_read(&sp->sk_drops), len);
+
+ *len += sock_write_secctx(sp, f);
}
int udp4_seq_show(struct seq_file *seq, void *v)
{
if (v == SEQ_START_TOKEN)
- seq_printf(seq, "%-127s\n",
+ seq_printf(seq, "%-150s\n",
" sl local_address rem_address st tx_queue "
"rx_queue tr tm->when retrnsmt uid timeout "
- "inode ref pointer drops");
+ "inode ref pointer drops seclabel");
else {
struct udp_iter_state *state = seq->private;
int len;
udp4_format_sock(v, seq, state->bucket, &len);
- seq_printf(seq, "%*s\n", 127 - len, "");
+ seq_printf(seq, "%*s\n", (150 - len) > 0 ? 150 - len : 0, "");
}
return 0;
}
--
1.7.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH 5/6] Export the unix sock's security context to proc.
2011-08-09 7:28 [v2 PATCH 0/6] Export the sock's security context to proc rongqing.li
` (3 preceding siblings ...)
2011-08-09 7:28 ` [PATCH 4/6] Export the udp " rongqing.li
@ 2011-08-09 7:28 ` rongqing.li
2011-08-09 7:28 ` [PATCH 6/6] Export the tcp " rongqing.li
5 siblings, 0 replies; 16+ messages in thread
From: rongqing.li @ 2011-08-09 7:28 UTC (permalink / raw)
To: netdev, selinux, linux-security-module, sds
From: Roy.Li <rongqing.li@windriver.com>
Export the unix sock's security context to proc, since it maybe
different from the sock's owner process security context.
Output '-' on Path column if the addr of unix_sock is NULL, rather
than nothing.
Signed-off-by: Roy.Li <rongqing.li@windriver.com>
---
net/unix/af_unix.c | 20 ++++++++++++++++----
1 files changed, 16 insertions(+), 4 deletions(-)
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index ec68e1c..9021f9b 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2239,12 +2239,14 @@ static void unix_seq_stop(struct seq_file *seq, void *v)
spin_unlock(&unix_table_lock);
}
+#define OFFSET_PATH_START 40
static int unix_seq_show(struct seq_file *seq, void *v)
{
+ int len, offset = OFFSET_PATH_START;
if (v == SEQ_START_TOKEN)
seq_puts(seq, "Num RefCount Protocol Flags Type St "
- "Inode Path\n");
+ "Inode Path SecLabel\n");
else {
struct sock *s = v;
struct unix_sock *u = unix_sk(s);
@@ -2261,9 +2263,9 @@ static int unix_seq_show(struct seq_file *seq, void *v)
(s->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING),
sock_i_ino(s));
+ seq_putc(seq, ' ');
if (u->addr) {
- int i, len;
- seq_putc(seq, ' ');
+ int i;
i = 0;
len = u->addr->len - sizeof(short);
@@ -2275,7 +2277,17 @@ static int unix_seq_show(struct seq_file *seq, void *v)
}
for ( ; i < len; i++)
seq_putc(seq, u->addr->name->sun_path[i]);
- }
+ } else
+ seq_printf(seq, " %s%n", "-", &len);
+
+ if (offset > len)
+ offset -= (len + 1);
+ else
+ offset = 0;
+
+ seq_printf(seq, "%*s", offset, " ");
+ sock_write_secctx(s, seq);
+
unix_state_unlock(s);
seq_putc(seq, '\n');
}
--
1.7.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH 6/6] Export the tcp sock's security context to proc.
2011-08-09 7:28 [v2 PATCH 0/6] Export the sock's security context to proc rongqing.li
` (4 preceding siblings ...)
2011-08-09 7:28 ` [PATCH 5/6] Export the unix " rongqing.li
@ 2011-08-09 7:28 ` rongqing.li
2011-08-09 7:33 ` David Miller
5 siblings, 1 reply; 16+ messages in thread
From: rongqing.li @ 2011-08-09 7:28 UTC (permalink / raw)
To: netdev, selinux, linux-security-module, sds
From: Roy.Li <rongqing.li@windriver.com>
Export the tcp sock's security context to proc, since it maybe
different from the sock's owner process security context.
Signed-off-by: Roy.Li <rongqing.li@windriver.com>
---
net/ipv4/tcp_ipv4.c | 10 ++++++++--
1 files changed, 8 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 955b8e6..ddac912 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2479,12 +2479,13 @@ static int tcp4_seq_show(struct seq_file *seq, void *v)
{
struct tcp_iter_state *st;
int len;
+ struct sock *s = NULL;
if (v == SEQ_START_TOKEN) {
seq_printf(seq, "%-*s\n", TMPSZ - 1,
" sl local_address rem_address st tx_queue "
"rx_queue tr tm->when retrnsmt uid timeout "
- "inode");
+ "inode seclabel");
goto out;
}
st = seq->private;
@@ -2493,15 +2494,20 @@ static int tcp4_seq_show(struct seq_file *seq, void *v)
case TCP_SEQ_STATE_LISTENING:
case TCP_SEQ_STATE_ESTABLISHED:
get_tcp4_sock(v, seq, st->num, &len);
+ s = v;
break;
case TCP_SEQ_STATE_OPENREQ:
get_openreq4(st->syn_wait_sk, v, seq, st->num, st->uid, &len);
+ s = st->syn_wait_sk;
break;
case TCP_SEQ_STATE_TIME_WAIT:
get_timewait4_sock(v, seq, st->num, &len);
break;
}
- seq_printf(seq, "%*s\n", TMPSZ - 1 - len, "");
+
+ len += sock_write_secctx(s, seq);
+ len = TMPSZ - 1 - len;
+ seq_printf(seq, "%*s\n", len > 0 ? len : 0, "");
out:
return 0;
}
--
1.7.1
^ permalink raw reply related [flat|nested] 16+ messages in thread* Re: [PATCH 6/6] Export the tcp sock's security context to proc.
2011-08-09 7:28 ` [PATCH 6/6] Export the tcp " rongqing.li
@ 2011-08-09 7:33 ` David Miller
2011-08-09 8:54 ` Rongqing Li
0 siblings, 1 reply; 16+ messages in thread
From: David Miller @ 2011-08-09 7:33 UTC (permalink / raw)
To: rongqing.li; +Cc: netdev, selinux, linux-security-module, sds
From: <rongqing.li@windriver.com>
Date: Tue, 9 Aug 2011 15:28:30 +0800
> if (v == SEQ_START_TOKEN) {
> seq_printf(seq, "%-*s\n", TMPSZ - 1,
> " sl local_address rem_address st tx_queue "
> "rx_queue tr tm->when retrnsmt uid timeout "
> - "inode");
> + "inode seclabel");
> goto out;
> }
Unfortunately you cannot change the layout of procfs file output in
this way. It has the potential to break programs which are parsing
this file in userspace already.
The layout hasn't changed in a very long time because it is essentially
a uservisible ABI.
If you want to export new information you'll have to do it using the
facility that is extensible, and that's the netlink based socket dumping
facility implemented in inet_diag.c, tcp_diag.c and friends.
There, you can simply add a new netlink attribute that gets dumped with
the entry, which will provide the security context.
^ permalink raw reply [flat|nested] 16+ messages in thread* Re: [PATCH 6/6] Export the tcp sock's security context to proc.
2011-08-09 7:33 ` David Miller
@ 2011-08-09 8:54 ` Rongqing Li
0 siblings, 0 replies; 16+ messages in thread
From: Rongqing Li @ 2011-08-09 8:54 UTC (permalink / raw)
To: David Miller; +Cc: netdev, selinux, linux-security-module, sds
On 08/09/2011 03:33 PM, David Miller wrote:
> From:<rongqing.li@windriver.com>
> Date: Tue, 9 Aug 2011 15:28:30 +0800
>
>> if (v == SEQ_START_TOKEN) {
>> seq_printf(seq, "%-*s\n", TMPSZ - 1,
>> " sl local_address rem_address st tx_queue "
>> "rx_queue tr tm->when retrnsmt uid timeout "
>> - "inode");
>> + "inode seclabel");
>> goto out;
>> }
>
> Unfortunately you cannot change the layout of procfs file output in
> this way. It has the potential to break programs which are parsing
> this file in userspace already.
>
> The layout hasn't changed in a very long time because it is essentially
> a uservisible ABI.
>
> If you want to export new information you'll have to do it using the
> facility that is extensible, and that's the netlink based socket dumping
> facility implemented in inet_diag.c, tcp_diag.c and friends.
>
> There, you can simply add a new netlink attribute that gets dumped with
> the entry, which will provide the security context.
>
>
Thanks, I see how I should do.
I will continue to develop it and hope get your help.
Thanks.
--
Best Reagrds,
Roy | RongQing Li
^ permalink raw reply [flat|nested] 16+ messages in thread