Commit 6f2f724f authored by Casey Schaufler's avatar Casey Schaufler Committed by Paul Moore
Browse files

lsm: add lsmprop_to_secctx hook 



Add a new hook security_lsmprop_to_secctx() and its LSM specific
implementations. The LSM specific code will use the lsm_prop element
allocated for that module. This allows for the possibility that more
than one module may be called upon to translate a secid to a string,
as can occur in the audit code.

Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
[PM: subject line tweak]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 870b7fdc

include/linux/lsm_hook_defs.h

+2 −0
Original line number Diff line number Diff line
@@ -294,6 +294,8 @@ LSM_HOOK(int, -EINVAL, setprocattr, const char *name, void *value, size_t size) 
LSM_HOOK(int, 0, ismaclabel, const char *name)

LSM_HOOK(int, -EOPNOTSUPP, secid_to_secctx, u32 secid, char **secdata,

	 u32 *seclen)

LSM_HOOK(int, -EOPNOTSUPP, lsmprop_to_secctx, struct lsm_prop *prop,

	 char **secdata, u32 *seclen)

LSM_HOOK(int, 0, secctx_to_secid, const char *secdata, u32 seclen, u32 *secid)

LSM_HOOK(void, LSM_RET_VOID, release_secctx, char *secdata, u32 seclen)

LSM_HOOK(void, LSM_RET_VOID, inode_invalidate_secctx, struct inode *inode)

include/linux/security.h

+9 −1
Original line number Diff line number Diff line
@@ -535,6 +535,7 @@ int security_setprocattr(int lsmid, const char *name, void *value, size_t size); 
int security_netlink_send(struct sock *sk, struct sk_buff *skb);

int security_ismaclabel(const char *name);

int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);

int security_lsmprop_to_secctx(struct lsm_prop *prop, char **secdata, u32 *seclen);

int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);

void security_release_secctx(char *secdata, u32 seclen);

void security_inode_invalidate_secctx(struct inode *inode);
@@ -1488,7 +1489,14 @@ static inline int security_ismaclabel(const char *name) 
	return 0;

}



static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)

static inline int security_secid_to_secctx(u32 secid, char **secdata,

					   u32 *seclen)

{

	return -EOPNOTSUPP;

}



static inline int security_lsmprop_to_secctx(struct lsm_prop *prop,

					     char **secdata, u32 *seclen)

{

	return -EOPNOTSUPP;

}

security/apparmor/include/secid.h

+2 −0
Original line number Diff line number Diff line
@@ -26,6 +26,8 @@ extern int apparmor_display_secid_mode; 


struct aa_label *aa_secid_to_label(u32 secid);

int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);

int apparmor_lsmprop_to_secctx(struct lsm_prop *prop, char **secdata,

			       u32 *seclen);

int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);

void apparmor_release_secctx(char *secdata, u32 seclen);

security/apparmor/lsm.c

+1 −0
Original line number Diff line number Diff line
@@ -1517,6 +1517,7 @@ static struct security_hook_list apparmor_hooks[] __ro_after_init = { 
#endif



	LSM_HOOK_INIT(secid_to_secctx, apparmor_secid_to_secctx),

	LSM_HOOK_INIT(lsmprop_to_secctx, apparmor_lsmprop_to_secctx),

	LSM_HOOK_INIT(secctx_to_secid, apparmor_secctx_to_secid),

	LSM_HOOK_INIT(release_secctx, apparmor_release_secctx),

security/apparmor/secid.c

+23 −2
Original line number Diff line number Diff line
@@ -61,10 +61,10 @@ struct aa_label *aa_secid_to_label(u32 secid) 
	return xa_load(&aa_secids, secid);

}



int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)

static int apparmor_label_to_secctx(struct aa_label *label, char **secdata,

				    u32 *seclen)

{

	/* TODO: cache secctx and ref count so we don't have to recreate */

	struct aa_label *label = aa_secid_to_label(secid);

	int flags = FLAG_VIEW_SUBNS | FLAG_HIDDEN_UNCONFINED | FLAG_ABS_ROOT;

	int len;
@@ -90,6 +90,27 @@ int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 
	return 0;

}



int apparmor_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)

{

	struct aa_label *label = aa_secid_to_label(secid);



	return apparmor_label_to_secctx(label, secdata, seclen);

}



int apparmor_lsmprop_to_secctx(struct lsm_prop *prop, char **secdata,

			       u32 *seclen)

{

	struct aa_label *label;



	/* scaffolding */

	if (!prop->apparmor.label && prop->scaffold.secid)

		label = aa_secid_to_label(prop->scaffold.secid);

	else

		label = prop->apparmor.label;



	return apparmor_label_to_secctx(label, secdata, seclen);

}



int apparmor_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)

{

	struct aa_label *label;