Commit 267c068e authored by Casey Schaufler's avatar Casey Schaufler Committed by Paul Moore
Browse files

proc: Use lsmids instead of lsm names for attrs 



Use the LSM ID number instead of the LSM name to identify which
security module's attibute data should be shown in /proc/self/attr.
The security_[gs]etprocattr() functions have been changed to expect
the LSM ID. The change from a string comparison to an integer comparison
in these functions will provide a minor performance improvement.

Cc: linux-fsdevel@vger.kernel.org
Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarSerge Hallyn <serge@hallyn.com>
Reviewed-by: default avatarMickael Salaun <mic@digikod.net>
Reviewed-by: default avatarJohn Johansen <john.johansen@canonical.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 9285c5ad

fs/proc/base.c

+15 −14
Original line number Diff line number Diff line
@@ -97,6 +97,7 @@ 
#include <linux/resctrl.h>

#include <linux/cn_proc.h>

#include <linux/ksm.h>

#include <uapi/linux/lsm.h>

#include <trace/events/oom.h>

#include "internal.h"

#include "fd.h"
@@ -146,10 +147,10 @@ struct pid_entry { 
	NOD(NAME, (S_IFREG|(MODE)),			\

		NULL, &proc_single_file_operations,	\

		{ .proc_show = show } )

#define ATTR(LSM, NAME, MODE)				\

#define ATTR(LSMID, NAME, MODE)				\

	NOD(NAME, (S_IFREG|(MODE)),			\

		NULL, &proc_pid_attr_operations,	\

		{ .lsm = LSM })

		{ .lsmid = LSMID })



/*

 * Count the number of hardlinks for the pid_entry table, excluding the .
@@ -2726,7 +2727,7 @@ static ssize_t proc_pid_attr_read(struct file * file, char __user * buf, 
	if (!task)

		return -ESRCH;



	length = security_getprocattr(task, PROC_I(inode)->op.lsm,

	length = security_getprocattr(task, PROC_I(inode)->op.lsmid,

				      file->f_path.dentry->d_name.name,

				      &p);

	put_task_struct(task);
@@ -2784,7 +2785,7 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf, 
	if (rv < 0)

		goto out_free;



	rv = security_setprocattr(PROC_I(inode)->op.lsm,

	rv = security_setprocattr(PROC_I(inode)->op.lsmid,

				  file->f_path.dentry->d_name.name, page,

				  count);

	mutex_unlock(&current->signal->cred_guard_mutex);
@@ -2833,27 +2834,27 @@ static const struct inode_operations proc_##LSM##_attr_dir_inode_ops = { \ 


#ifdef CONFIG_SECURITY_SMACK

static const struct pid_entry smack_attr_dir_stuff[] = {

	ATTR("smack", "current",	0666),

	ATTR(LSM_ID_SMACK, "current",	0666),

};

LSM_DIR_OPS(smack);

#endif



#ifdef CONFIG_SECURITY_APPARMOR

static const struct pid_entry apparmor_attr_dir_stuff[] = {

	ATTR("apparmor", "current",	0666),

	ATTR("apparmor", "prev",	0444),

	ATTR("apparmor", "exec",	0666),

	ATTR(LSM_ID_APPARMOR, "current",	0666),

	ATTR(LSM_ID_APPARMOR, "prev",		0444),

	ATTR(LSM_ID_APPARMOR, "exec",		0666),

};

LSM_DIR_OPS(apparmor);

#endif



static const struct pid_entry attr_dir_stuff[] = {

	ATTR(NULL, "current",		0666),

	ATTR(NULL, "prev",		0444),

	ATTR(NULL, "exec",		0666),

	ATTR(NULL, "fscreate",		0666),

	ATTR(NULL, "keycreate",		0666),

	ATTR(NULL, "sockcreate",	0666),

	ATTR(LSM_ID_UNDEF, "current",	0666),

	ATTR(LSM_ID_UNDEF, "prev",		0444),

	ATTR(LSM_ID_UNDEF, "exec",		0666),

	ATTR(LSM_ID_UNDEF, "fscreate",	0666),

	ATTR(LSM_ID_UNDEF, "keycreate",	0666),

	ATTR(LSM_ID_UNDEF, "sockcreate",	0666),

#ifdef CONFIG_SECURITY_SMACK

	DIR("smack",			0555,

	    proc_smack_attr_dir_inode_ops, proc_smack_attr_dir_ops),

fs/proc/internal.h

+1 −1
Original line number Diff line number Diff line
@@ -92,7 +92,7 @@ union proc_op { 
	int (*proc_show)(struct seq_file *m,

		struct pid_namespace *ns, struct pid *pid,

		struct task_struct *task);

	const char *lsm;

	int lsmid;

};



struct proc_inode {

include/linux/security.h

+5 −6
Original line number Diff line number Diff line
@@ -472,10 +472,9 @@ int security_sem_semctl(struct kern_ipc_perm *sma, int cmd); 
int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,

			unsigned nsops, int alter);

void security_d_instantiate(struct dentry *dentry, struct inode *inode);

int security_getprocattr(struct task_struct *p, const char *lsm, const char *name,

int security_getprocattr(struct task_struct *p, int lsmid, const char *name,

			 char **value);

int security_setprocattr(const char *lsm, const char *name, void *value,

			 size_t size);

int security_setprocattr(int lsmid, const char *name, void *value, size_t size);

int security_netlink_send(struct sock *sk, struct sk_buff *skb);

int security_ismaclabel(const char *name);

int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
@@ -1339,14 +1338,14 @@ static inline void security_d_instantiate(struct dentry *dentry, 
					  struct inode *inode)

{ }



static inline int security_getprocattr(struct task_struct *p, const char *lsm,

static inline int security_getprocattr(struct task_struct *p, int lsmid,

				       const char *name, char **value)

{

	return -EINVAL;

}



static inline int security_setprocattr(const char *lsm, char *name,

				       void *value, size_t size)

static inline int security_setprocattr(int lsmid, char *name, void *value,

				       size_t size)

{

	return -EINVAL;

}

security/security.c

+7 −8
Original line number Diff line number Diff line
@@ -3840,7 +3840,7 @@ EXPORT_SYMBOL(security_d_instantiate); 
/**

 * security_getprocattr() - Read an attribute for a task

 * @p: the task

 * @lsm: LSM name

 * @lsmid: LSM identification

 * @name: attribute name

 * @value: attribute value

 *
@@ -3848,13 +3848,13 @@ EXPORT_SYMBOL(security_d_instantiate); 
 *

 * Return: Returns the length of @value on success, a negative value otherwise.

 */

int security_getprocattr(struct task_struct *p, const char *lsm,

			 const char *name, char **value)

int security_getprocattr(struct task_struct *p, int lsmid, const char *name,

			 char **value)

{

	struct security_hook_list *hp;



	hlist_for_each_entry(hp, &security_hook_heads.getprocattr, list) {

		if (lsm != NULL && strcmp(lsm, hp->lsmid->name))

		if (lsmid != 0 && lsmid != hp->lsmid->id)

			continue;

		return hp->hook.getprocattr(p, name, value);

	}
@@ -3863,7 +3863,7 @@ int security_getprocattr(struct task_struct *p, const char *lsm, 


/**

 * security_setprocattr() - Set an attribute for a task

 * @lsm: LSM name

 * @lsmid: LSM identification

 * @name: attribute name

 * @value: attribute value

 * @size: attribute value size
@@ -3873,13 +3873,12 @@ int security_getprocattr(struct task_struct *p, const char *lsm, 
 *

 * Return: Returns bytes written on success, a negative value otherwise.

 */

int security_setprocattr(const char *lsm, const char *name, void *value,

			 size_t size)

int security_setprocattr(int lsmid, const char *name, void *value, size_t size)

{

	struct security_hook_list *hp;



	hlist_for_each_entry(hp, &security_hook_heads.setprocattr, list) {

		if (lsm != NULL && strcmp(lsm, hp->lsmid->name))

		if (lsmid != 0 && lsmid != hp->lsmid->id)

			continue;

		return hp->hook.setprocattr(name, value, size);

	}