Commit 870b7fdc authored by Casey Schaufler's avatar Casey Schaufler Committed by Paul Moore
Browse files

lsm: use lsm_prop in security_audit_rule_match 



Change the secid parameter of security_audit_rule_match
to a lsm_prop structure pointer. Pass the entry from the
lsm_prop structure for the approprite slot to the LSM hook.

Change the users of security_audit_rule_match to use the
lsm_prop instead of a u32. The scaffolding function lsmprop_init()
fills the structure with the value of the old secid, ensuring that
it is available to the appropriate module hook. The sources of
the secid, security_task_getsecid() and security_inode_getsecid(),
will be converted to use the lsm_prop structure later in the series.
At that point the use of lsmprop_init() is dropped.

Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
[PM: subject line tweak]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent ed870e35

include/linux/lsm_hook_defs.h

+2 −1
Original line number Diff line number Diff line
@@ -416,7 +416,8 @@ LSM_HOOK(void, LSM_RET_VOID, key_post_create_or_update, struct key *keyring, 
LSM_HOOK(int, 0, audit_rule_init, u32 field, u32 op, char *rulestr,

	 void **lsmrule, gfp_t gfp)

LSM_HOOK(int, 0, audit_rule_known, struct audit_krule *krule)

LSM_HOOK(int, 0, audit_rule_match, u32 secid, u32 field, u32 op, void *lsmrule)

LSM_HOOK(int, 0, audit_rule_match, struct lsm_prop *prop, u32 field, u32 op,

	 void *lsmrule)

LSM_HOOK(void, LSM_RET_VOID, audit_rule_free, void *lsmrule)

#endif /* CONFIG_AUDIT */

include/linux/security.h

+4 −3
Original line number Diff line number Diff line
@@ -2115,7 +2115,8 @@ static inline void security_key_post_create_or_update(struct key *keyring, 
int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule,

			     gfp_t gfp);

int security_audit_rule_known(struct audit_krule *krule);

int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule);

int security_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op,

			      void *lsmrule);

void security_audit_rule_free(void *lsmrule);



#else
@@ -2131,8 +2132,8 @@ static inline int security_audit_rule_known(struct audit_krule *krule) 
	return 0;

}



static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,

					    void *lsmrule)

static inline int security_audit_rule_match(struct lsm_prop *prop, u32 field,

					    u32 op, void *lsmrule)

{

	return 0;

}

kernel/auditfilter.c

+7 −4
Original line number Diff line number Diff line
@@ -1339,8 +1339,8 @@ int audit_filter(int msgtype, unsigned int listtype) 


		for (i = 0; i < e->rule.field_count; i++) {

			struct audit_field *f = &e->rule.fields[i];

			struct lsm_prop prop = { };

			pid_t pid;

			u32 sid;



			switch (f->type) {

			case AUDIT_PID:
@@ -1370,9 +1370,12 @@ int audit_filter(int msgtype, unsigned int listtype) 
			case AUDIT_SUBJ_SEN:

			case AUDIT_SUBJ_CLR:

				if (f->lsm_rule) {

					security_current_getsecid_subj(&sid);

					result = security_audit_rule_match(sid,

						   f->type, f->op, f->lsm_rule);

					/* scaffolding */

					security_current_getsecid_subj(

							&prop.scaffold.secid);

					result = security_audit_rule_match(

						   &prop, f->type, f->op,

						   f->lsm_rule);

				}

				break;

			case AUDIT_EXE:

kernel/auditsc.c

+14 −4
Original line number Diff line number Diff line
@@ -471,6 +471,7 @@ static int audit_filter_rules(struct task_struct *tsk, 
	const struct cred *cred;

	int i, need_sid = 1;

	u32 sid;

	struct lsm_prop prop = { };

	unsigned int sessionid;



	if (ctx && rule->prio <= ctx->prio)
@@ -681,7 +682,10 @@ static int audit_filter_rules(struct task_struct *tsk, 
					security_current_getsecid_subj(&sid);

					need_sid = 0;

				}

				result = security_audit_rule_match(sid, f->type,

				/* scaffolding */

				prop.scaffold.secid = sid;

				result = security_audit_rule_match(&prop,

								   f->type,

								   f->op,

								   f->lsm_rule);

			}
@@ -696,15 +700,19 @@ static int audit_filter_rules(struct task_struct *tsk, 
			if (f->lsm_rule) {

				/* Find files that match */

				if (name) {

					/* scaffolding */

					prop.scaffold.secid = name->osid;

					result = security_audit_rule_match(

								name->osid,

								&prop,

								f->type,

								f->op,

								f->lsm_rule);

				} else if (ctx) {

					list_for_each_entry(n, &ctx->names_list, list) {

						/* scaffolding */

						prop.scaffold.secid = n->osid;

						if (security_audit_rule_match(

								n->osid,

								&prop,

								f->type,

								f->op,

								f->lsm_rule)) {
@@ -716,7 +724,9 @@ static int audit_filter_rules(struct task_struct *tsk, 
				/* Find ipc objects that match */

				if (!ctx || ctx->type != AUDIT_IPC)

					break;

				if (security_audit_rule_match(ctx->ipc.osid,

				/* scaffolding */

				prop.scaffold.secid = ctx->ipc.osid;

				if (security_audit_rule_match(&prop,

							      f->type, f->op,

							      f->lsm_rule))

					++result;

security/apparmor/audit.c

+6 −2
Original line number Diff line number Diff line
@@ -264,13 +264,17 @@ int aa_audit_rule_known(struct audit_krule *rule) 
	return 0;

}



int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule)

int aa_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, void *vrule)

{

	struct aa_audit_rule *rule = vrule;

	struct aa_label *label;

	int found = 0;



	label = aa_secid_to_label(sid);

	/* scaffolding */

	if (!prop->apparmor.label && prop->scaffold.secid)

		label = aa_secid_to_label(prop->scaffold.secid);

	else

		label = prop->apparmor.label;



	if (!label)

		return -ENOENT;