Commit 7183abcc authored by Casey Schaufler's avatar Casey Schaufler Committed by Paul Moore
Browse files

audit: maintain an lsm_prop in audit_context 



Replace the secid value stored in struct audit_context with a struct
lsm_prop. Change the code that uses this value to accommodate the
change. security_audit_rule_match() expects a lsm_prop, so existing
scaffolding can be removed. A call to security_secid_to_secctx()
is changed to security_lsmprop_to_secctx().  The call to
security_ipc_getsecid() is scaffolded.

A new function lsmprop_is_set() is introduced to identify whether
an lsm_prop contains a non-zero value.

Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
[PM: subject line tweak, fix lsmprop_is_set() typo]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 6f2f724f

include/linux/security.h

+24 −0
Original line number Diff line number Diff line
@@ -291,6 +291,19 @@ static inline const char *kernel_load_data_id_str(enum kernel_load_data_id id) 


#ifdef CONFIG_SECURITY



/**

 * lsmprop_is_set - report if there is a value in the lsm_prop

 * @prop: Pointer to the exported LSM data

 *

 * Returns true if there is a value set, false otherwise

 */

static inline bool lsmprop_is_set(struct lsm_prop *prop)

{

	const struct lsm_prop empty = {};



	return !!memcmp(prop, &empty, sizeof(*prop));

}



int call_blocking_lsm_notifier(enum lsm_event event, void *data);

int register_blocking_lsm_notifier(struct notifier_block *nb);

int unregister_blocking_lsm_notifier(struct notifier_block *nb);
@@ -552,6 +565,17 @@ int security_bdev_setintegrity(struct block_device *bdev, 
			       size_t size);

#else /* CONFIG_SECURITY */



/**

 * lsmprop_is_set - report if there is a value in the lsm_prop

 * @prop: Pointer to the exported LSM data

 *

 * Returns true if there is a value set, false otherwise

 */

static inline bool lsmprop_is_set(struct lsm_prop *prop)

{

	return false;

}



static inline int call_blocking_lsm_notifier(enum lsm_event event, void *data)

{

	return 0;

kernel/audit.h

+2 −1
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 


#include <linux/fs.h>

#include <linux/audit.h>

#include <linux/security.h>

#include <linux/skbuff.h>

#include <uapi/linux/mqueue.h>

#include <linux/tty.h>
@@ -160,7 +161,7 @@ struct audit_context { 
			kuid_t			uid;

			kgid_t			gid;

			umode_t			mode;

			u32			osid;

			struct lsm_prop		oprop;

			int			has_perm;

			uid_t			perm_uid;

			gid_t			perm_gid;

kernel/auditsc.c

+8 −11
Original line number Diff line number Diff line
@@ -724,9 +724,7 @@ static int audit_filter_rules(struct task_struct *tsk, 
				/* Find ipc objects that match */

				if (!ctx || ctx->type != AUDIT_IPC)

					break;

				/* scaffolding */

				prop.scaffold.secid = ctx->ipc.osid;

				if (security_audit_rule_match(&prop,

				if (security_audit_rule_match(&ctx->ipc.oprop,

							      f->type, f->op,

							      f->lsm_rule))

					++result;
@@ -1394,19 +1392,17 @@ static void show_special(struct audit_context *context, int *call_panic) 
			audit_log_format(ab, " a%d=%lx", i,

				context->socketcall.args[i]);

		break; }

	case AUDIT_IPC: {

		u32 osid = context->ipc.osid;



	case AUDIT_IPC:

		audit_log_format(ab, "ouid=%u ogid=%u mode=%#ho",

				 from_kuid(&init_user_ns, context->ipc.uid),

				 from_kgid(&init_user_ns, context->ipc.gid),

				 context->ipc.mode);

		if (osid) {

		if (lsmprop_is_set(&context->ipc.oprop)) {

			char *ctx = NULL;

			u32 len;



			if (security_secid_to_secctx(osid, &ctx, &len)) {

				audit_log_format(ab, " osid=%u", osid);

			if (security_lsmprop_to_secctx(&context->ipc.oprop,

						       &ctx, &len)) {

				*call_panic = 1;

			} else {

				audit_log_format(ab, " obj=%s", ctx);
@@ -1426,7 +1422,7 @@ static void show_special(struct audit_context *context, int *call_panic) 
				context->ipc.perm_gid,

				context->ipc.perm_mode);

		}

		break; }

		break;

	case AUDIT_MQ_OPEN:

		audit_log_format(ab,

			"oflag=0x%x mode=%#ho mq_flags=0x%lx mq_maxmsg=%ld "
@@ -2642,7 +2638,8 @@ void __audit_ipc_obj(struct kern_ipc_perm *ipcp) 
	context->ipc.gid = ipcp->gid;

	context->ipc.mode = ipcp->mode;

	context->ipc.has_perm = 0;

	security_ipc_getsecid(ipcp, &context->ipc.osid);

	/* scaffolding */

	security_ipc_getsecid(ipcp, &context->ipc.oprop.scaffold.secid);

	context->type = AUDIT_IPC;

}