Commit a04a1198 authored by Casey Schaufler's avatar Casey Schaufler Committed by Paul Moore
Browse files

LSM: syscalls for current process attributes 



Create a system call lsm_get_self_attr() to provide the security
module maintained attributes of the current process.
Create a system call lsm_set_self_attr() to set a security
module maintained attribute of the current process.
Historically these attributes have been exposed to user space via
entries in procfs under /proc/self/attr.

The attribute value is provided in a lsm_ctx structure. The structure
identifies the size of the attribute, and the attribute value. The format
of the attribute value is defined by the security module. A flags field
is included for LSM specific information. It is currently unused and must
be 0. The total size of the data, including the lsm_ctx structure and any
padding, is maintained as well.

struct lsm_ctx {
        __u64 id;
        __u64 flags;
        __u64 len;
        __u64 ctx_len;
        __u8 ctx[];
};

Two new LSM hooks are used to interface with the LSMs.
security_getselfattr() collects the lsm_ctx values from the
LSMs that support the hook, accounting for space requirements.
security_setselfattr() identifies which LSM the attribute is
intended for and passes it along.

Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Reviewed-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarSerge Hallyn <serge@hallyn.com>
Reviewed-by: default avatarJohn Johansen <john.johansen@canonical.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 267c068e

Documentation/userspace-api/lsm.rst

0 → 100644
+70 −0
Original line number Diff line number Diff line 
.. SPDX-License-Identifier: GPL-2.0

.. Copyright (C) 2022 Casey Schaufler <casey@schaufler-ca.com>

.. Copyright (C) 2022 Intel Corporation



=====================================

Linux Security Modules

=====================================



:Author: Casey Schaufler

:Date: July 2023



Linux security modules (LSM) provide a mechanism to implement

additional access controls to the Linux security policies.



The various security modules may support any of these attributes:



``LSM_ATTR_CURRENT`` is the current, active security context of the

process.

The proc filesystem provides this value in ``/proc/self/attr/current``.

This is supported by the SELinux, Smack and AppArmor security modules.

Smack also provides this value in ``/proc/self/attr/smack/current``.

AppArmor also provides this value in ``/proc/self/attr/apparmor/current``.



``LSM_ATTR_EXEC`` is the security context of the process at the time the

current image was executed.

The proc filesystem provides this value in ``/proc/self/attr/exec``.

This is supported by the SELinux and AppArmor security modules.

AppArmor also provides this value in ``/proc/self/attr/apparmor/exec``.



``LSM_ATTR_FSCREATE`` is the security context of the process used when

creating file system objects.

The proc filesystem provides this value in ``/proc/self/attr/fscreate``.

This is supported by the SELinux security module.



``LSM_ATTR_KEYCREATE`` is the security context of the process used when

creating key objects.

The proc filesystem provides this value in ``/proc/self/attr/keycreate``.

This is supported by the SELinux security module.



``LSM_ATTR_PREV`` is the security context of the process at the time the

current security context was set.

The proc filesystem provides this value in ``/proc/self/attr/prev``.

This is supported by the SELinux and AppArmor security modules.

AppArmor also provides this value in ``/proc/self/attr/apparmor/prev``.



``LSM_ATTR_SOCKCREATE`` is the security context of the process used when

creating socket objects.

The proc filesystem provides this value in ``/proc/self/attr/sockcreate``.

This is supported by the SELinux security module.



Kernel interface

================



Set a security attribute of the current process

-----------------------------------------------



.. kernel-doc:: security/lsm_syscalls.c

    :identifiers: sys_lsm_set_self_attr



Get the specified security attributes of the current process

------------------------------------------------------------



.. kernel-doc:: security/lsm_syscalls.c

    :identifiers: sys_lsm_get_self_attr



Additional documentation

========================



* Documentation/security/lsm.rst

* Documentation/security/lsm-development.rst

include/linux/lsm_hook_defs.h

+4 −0
Original line number Diff line number Diff line
@@ -262,6 +262,10 @@ LSM_HOOK(int, 0, sem_semop, struct kern_ipc_perm *perm, struct sembuf *sops, 
LSM_HOOK(int, 0, netlink_send, struct sock *sk, struct sk_buff *skb)

LSM_HOOK(void, LSM_RET_VOID, d_instantiate, struct dentry *dentry,

	 struct inode *inode)

LSM_HOOK(int, -EOPNOTSUPP, getselfattr, unsigned int attr,

	 struct lsm_ctx __user *ctx, size_t *size, u32 flags)

LSM_HOOK(int, -EOPNOTSUPP, setselfattr, unsigned int attr,

	 struct lsm_ctx *ctx, size_t size, u32 flags)

LSM_HOOK(int, -EINVAL, getprocattr, struct task_struct *p, const char *name,

	 char **value)

LSM_HOOK(int, -EINVAL, setprocattr, const char *name, void *value, size_t size)

include/linux/lsm_hooks.h

+1 −0
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 
#ifndef __LINUX_LSM_HOOKS_H

#define __LINUX_LSM_HOOKS_H



#include <uapi/linux/lsm.h>

#include <linux/security.h>

#include <linux/init.h>

#include <linux/rculist.h>

include/linux/security.h

+19 −0
Original line number Diff line number Diff line
@@ -60,6 +60,7 @@ struct fs_parameter; 
enum fs_value_type;

struct watch;

struct watch_notification;

struct lsm_ctx;



/* Default (no) options for the capable function */

#define CAP_OPT_NONE 0x0
@@ -472,6 +473,10 @@ int security_sem_semctl(struct kern_ipc_perm *sma, int cmd); 
int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,

			unsigned nsops, int alter);

void security_d_instantiate(struct dentry *dentry, struct inode *inode);

int security_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,

			 size_t __user *size, u32 flags);

int security_setselfattr(unsigned int attr, struct lsm_ctx __user *ctx,

			 size_t size, u32 flags);

int security_getprocattr(struct task_struct *p, int lsmid, const char *name,

			 char **value);

int security_setprocattr(int lsmid, const char *name, void *value, size_t size);
@@ -1338,6 +1343,20 @@ static inline void security_d_instantiate(struct dentry *dentry, 
					  struct inode *inode)

{ }



static inline int security_getselfattr(unsigned int attr,

				       struct lsm_ctx __user *ctx,

				       size_t __user *size, u32 flags)

{

	return -EOPNOTSUPP;

}



static inline int security_setselfattr(unsigned int attr,

				       struct lsm_ctx __user *ctx,

				       size_t size, u32 flags)

{

	return -EOPNOTSUPP;

}



static inline int security_getprocattr(struct task_struct *p, int lsmid,

				       const char *name, char **value)

{

include/linux/syscalls.h

+5 −0
Original line number Diff line number Diff line
@@ -71,6 +71,7 @@ struct clone_args; 
struct open_how;

struct mount_attr;

struct landlock_ruleset_attr;

struct lsm_ctx;

enum landlock_rule_type;

struct cachestat_range;

struct cachestat;
@@ -949,6 +950,10 @@ asmlinkage long sys_cachestat(unsigned int fd, 
		struct cachestat_range __user *cstat_range,

		struct cachestat __user *cstat, unsigned int flags);

asmlinkage long sys_map_shadow_stack(unsigned long addr, unsigned long size, unsigned int flags);

asmlinkage long sys_lsm_get_self_attr(unsigned int attr, struct lsm_ctx *ctx,

				      size_t *size, __u32 flags);

asmlinkage long sys_lsm_set_self_attr(unsigned int attr, struct lsm_ctx *ctx,

				      size_t size, __u32 flags);



/*

 * Architecture-specific system calls