Commit 1086eeac authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'lsm-pr-20230829' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm 

Pull LSM updates from Paul Moore:

 - Add proper multi-LSM support for xattrs in the
   security_inode_init_security() hook

   Historically the LSM layer has only allowed a single LSM to add an
   xattr to an inode, with IMA/EVM measuring that and adding its own as
   well. As we work towards promoting IMA/EVM to a "proper LSM" instead
   of the special case that it is now, we need to better support the
   case of multiple LSMs each adding xattrs to an inode and after
   several attempts we now appear to have something that is working
   well. It is worth noting that in the process of making this change we
   uncovered a problem with Smack's SMACK64TRANSMUTE xattr which is also
   fixed in this pull request.

 - Additional LSM hook constification

   Two patches to constify parameters to security_capget() and
   security_binder_transfer_file(). While I generally don't make a
   special note of who submitted these patches, these were the work of
   an Outreachy intern, Khadija Kamran, and that makes me happy;
   hopefully it does the same for all of you reading this.

 - LSM hook comment header fixes

   One patch to add a missing hook comment header, one to fix a minor
   typo.

 - Remove an old, unused credential function declaration

   It wasn't clear to me who should pick this up, but it was trivial,
   obviously correct, and arguably the LSM layer has a vested interest
   in credentials so I merged it. Sadly I'm now noticing that despite my
   subject line cleanup I didn't cleanup the "unsued" misspelling, sigh

* tag 'lsm-pr-20230829' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm:
  lsm: constify the 'file' parameter in security_binder_transfer_file()
  lsm: constify the 'target' parameter in security_capget()
  lsm: add comment block for security_sk_classify_flow LSM hook
  security: Fix ret values doc for security_inode_init_security()
  cred: remove unsued extern declaration change_create_files_as()
  evm: Support multiple LSMs providing an xattr
  evm: Align evm_inode_init_security() definition with LSM infrastructure
  smack: Set the SMACK64TRANSMUTE xattr in smack_inode_init_security()
  security: Allow all LSMs to provide xattrs for inode_init_security hook
  lsm: fix typo in security_file_lock() comment header
parents 1dbae189 8e4672d6

include/linux/cred.h

+0 −1
Original line number Diff line number Diff line
@@ -164,7 +164,6 @@ extern void abort_creds(struct cred *); 
extern const struct cred *override_creds(const struct cred *);

extern void revert_creds(const struct cred *);

extern struct cred *prepare_kernel_cred(struct task_struct *);

extern int change_create_files_as(struct cred *, struct inode *);

extern int set_security_override(struct cred *, u32);

extern int set_security_override_from_ctx(struct cred *, const char *);

extern int set_create_files_as(struct cred *, struct inode *);

include/linux/evm.h

+8 −6
Original line number Diff line number Diff line
@@ -56,9 +56,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry, 
{

	return evm_inode_post_setxattr(dentry, acl_name, NULL, 0);

}

extern int evm_inode_init_security(struct inode *inode,

				   const struct xattr *xattr_array,

				   struct xattr *evm);



int evm_inode_init_security(struct inode *inode, struct inode *dir,

			    const struct qstr *qstr, struct xattr *xattrs,

			    int *xattr_count);

extern bool evm_revalidate_status(const char *xattr_name);

extern int evm_protected_xattr_if_enabled(const char *req_xattr_name);

extern int evm_read_protected_xattrs(struct dentry *dentry, u8 *buffer,
@@ -157,9 +158,10 @@ static inline void evm_inode_post_set_acl(struct dentry *dentry, 
	return;

}



static inline int evm_inode_init_security(struct inode *inode,

					  const struct xattr *xattr_array,

					  struct xattr *evm)

static inline int evm_inode_init_security(struct inode *inode, struct inode *dir,

					  const struct qstr *qstr,

					  struct xattr *xattrs,

					  int *xattr_count)

{

	return 0;

}

include/linux/lsm_hook_defs.h

+5 −5
Original line number Diff line number Diff line
@@ -32,11 +32,11 @@ LSM_HOOK(int, 0, binder_transaction, const struct cred *from, 
LSM_HOOK(int, 0, binder_transfer_binder, const struct cred *from,

	 const struct cred *to)

LSM_HOOK(int, 0, binder_transfer_file, const struct cred *from,

	 const struct cred *to, struct file *file)

	 const struct cred *to, const struct file *file)

LSM_HOOK(int, 0, ptrace_access_check, struct task_struct *child,

	 unsigned int mode)

LSM_HOOK(int, 0, ptrace_traceme, struct task_struct *parent)

LSM_HOOK(int, 0, capget, struct task_struct *target, kernel_cap_t *effective,

LSM_HOOK(int, 0, capget, const struct task_struct *target, kernel_cap_t *effective,

	 kernel_cap_t *inheritable, kernel_cap_t *permitted)

LSM_HOOK(int, 0, capset, struct cred *new, const struct cred *old,

	 const kernel_cap_t *effective, const kernel_cap_t *inheritable,
@@ -112,9 +112,9 @@ LSM_HOOK(int, 0, path_notify, const struct path *path, u64 mask, 
	 unsigned int obj_type)

LSM_HOOK(int, 0, inode_alloc_security, struct inode *inode)

LSM_HOOK(void, LSM_RET_VOID, inode_free_security, struct inode *inode)

LSM_HOOK(int, 0, inode_init_security, struct inode *inode,

	 struct inode *dir, const struct qstr *qstr, const char **name,

	 void **value, size_t *len)

LSM_HOOK(int, -EOPNOTSUPP, inode_init_security, struct inode *inode,

	 struct inode *dir, const struct qstr *qstr, struct xattr *xattrs,

	 int *xattr_count)

LSM_HOOK(int, 0, inode_init_security_anon, struct inode *inode,

	 const struct qstr *name, const struct inode *context_inode)

LSM_HOOK(int, 0, inode_create, struct inode *dir, struct dentry *dentry,

include/linux/lsm_hooks.h

+20 −0
Original line number Diff line number Diff line
@@ -28,6 +28,7 @@ 
#include <linux/security.h>

#include <linux/init.h>

#include <linux/rculist.h>

#include <linux/xattr.h>



union security_list_options {

	#define LSM_HOOK(RET, DEFAULT, NAME, ...) RET (*NAME)(__VA_ARGS__);
@@ -63,8 +64,27 @@ struct lsm_blob_sizes { 
	int	lbs_ipc;

	int	lbs_msg_msg;

	int	lbs_task;

	int	lbs_xattr_count; /* number of xattr slots in new_xattrs array */

};



/**

 * lsm_get_xattr_slot - Return the next available slot and increment the index

 * @xattrs: array storing LSM-provided xattrs

 * @xattr_count: number of already stored xattrs (updated)

 *

 * Retrieve the first available slot in the @xattrs array to fill with an xattr,

 * and increment @xattr_count.

 *

 * Return: The slot to fill in @xattrs if non-NULL, NULL otherwise.

 */

static inline struct xattr *lsm_get_xattr_slot(struct xattr *xattrs,

					       int *xattr_count)

{

	if (unlikely(!xattrs))

		return NULL;

	return &xattrs[(*xattr_count)++];

}



/*

 * LSM_RET_VOID is used as the default value in LSM_HOOK definitions for void

 * LSM hooks (in include/linux/lsm_hook_defs.h).

include/linux/security.h

+6 −5
Original line number Diff line number Diff line
@@ -145,7 +145,8 @@ extern int cap_capable(const struct cred *cred, struct user_namespace *ns, 
extern int cap_settime(const struct timespec64 *ts, const struct timezone *tz);

extern int cap_ptrace_access_check(struct task_struct *child, unsigned int mode);

extern int cap_ptrace_traceme(struct task_struct *parent);

extern int cap_capget(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);

extern int cap_capget(const struct task_struct *target, kernel_cap_t *effective,

		      kernel_cap_t *inheritable, kernel_cap_t *permitted);

extern int cap_capset(struct cred *new, const struct cred *old,

		      const kernel_cap_t *effective,

		      const kernel_cap_t *inheritable,
@@ -268,10 +269,10 @@ int security_binder_transaction(const struct cred *from, 
int security_binder_transfer_binder(const struct cred *from,

				    const struct cred *to);

int security_binder_transfer_file(const struct cred *from,

				  const struct cred *to, struct file *file);

				  const struct cred *to, const struct file *file);

int security_ptrace_access_check(struct task_struct *child, unsigned int mode);

int security_ptrace_traceme(struct task_struct *parent);

int security_capget(struct task_struct *target,

int security_capget(const struct task_struct *target,

		    kernel_cap_t *effective,

		    kernel_cap_t *inheritable,

		    kernel_cap_t *permitted);
@@ -538,7 +539,7 @@ static inline int security_binder_transfer_binder(const struct cred *from, 


static inline int security_binder_transfer_file(const struct cred *from,

						const struct cred *to,

						struct file *file)

						const struct file *file)

{

	return 0;

}
@@ -554,7 +555,7 @@ static inline int security_ptrace_traceme(struct task_struct *parent) 
	return cap_ptrace_traceme(parent);

}



static inline int security_capget(struct task_struct *target,

static inline int security_capget(const struct task_struct *target,

				   kernel_cap_t *effective,

				   kernel_cap_t *inheritable,

				   kernel_cap_t *permitted)