Commit ed870e35 authored by Casey Schaufler's avatar Casey Schaufler Committed by Paul Moore
Browse files

lsm: add the lsm_prop data structure 



When more than one security module is exporting data to audit and
networking sub-systems a single 32 bit integer is no longer
sufficient to represent the data. Add a structure to be used instead.

The lsm_prop structure definition is intended to keep the LSM
specific information private to the individual security modules.
The module specific information is included in a new set of
header files under include/lsm. Each security module is allowed
to define the information included for its use in the lsm_prop.
SELinux includes a u32 secid. Smack includes a pointer into its
global label list. The conditional compilation based on feature
inclusion is contained in the include/lsm files.

Cc: apparmor@lists.ubuntu.com
Cc: bpf@vger.kernel.org
Cc: selinux@vger.kernel.org
Cc: linux-security-module@vger.kernel.org
Suggested-by: default avatarPaul Moore <paul@paul-moore.com>
Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Acked-by: default avatarJohn Johansen <john.johansen@canonical.com>
[PM: added include/linux/lsm/ to MAINTAINERS, subj tweak]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 9852d85e

MAINTAINERS

+1 −0
Original line number Diff line number Diff line
@@ -20846,6 +20846,7 @@ Q: https://patchwork.kernel.org/project/linux-security-module/list 
B:	mailto:linux-security-module@vger.kernel.org

P:	https://github.com/LinuxSecurityModule/kernel/blob/main/README.md

T:	git https://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm.git

F:	include/linux/lsm/

F:	include/linux/lsm_audit.h

F:	include/linux/lsm_hook_defs.h

F:	include/linux/lsm_hooks.h

include/linux/lsm/apparmor.h

0 → 100644
+17 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

/*

 * Linux Security Module interface to other subsystems.

 * AppArmor presents single pointer to an aa_label structure.

 */

#ifndef __LINUX_LSM_APPARMOR_H

#define __LINUX_LSM_APPARMOR_H



struct aa_label;



struct lsm_prop_apparmor {

#ifdef CONFIG_SECURITY_APPARMOR

	struct aa_label *label;

#endif

};



#endif /* ! __LINUX_LSM_APPARMOR_H */

include/linux/lsm/bpf.h

0 → 100644
+16 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

/*

 * Linux Security Module interface to other subsystems.

 * BPF may present a single u32 value.

 */

#ifndef __LINUX_LSM_BPF_H

#define __LINUX_LSM_BPF_H

#include <linux/types.h>



struct lsm_prop_bpf {

#ifdef CONFIG_BPF_LSM

	u32 secid;

#endif

};



#endif /* ! __LINUX_LSM_BPF_H */

include/linux/lsm/selinux.h

0 → 100644
+16 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

/*

 * Linux Security Module interface to other subsystems.

 * SELinux presents a single u32 value which is known as a secid.

 */

#ifndef __LINUX_LSM_SELINUX_H

#define __LINUX_LSM_SELINUX_H

#include <linux/types.h>



struct lsm_prop_selinux {

#ifdef CONFIG_SECURITY_SELINUX

	u32 secid;

#endif

};



#endif /* ! __LINUX_LSM_SELINUX_H */

include/linux/lsm/smack.h

0 → 100644
+17 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

/*

 * Linux Security Module interface to other subsystems.

 * Smack presents a pointer into the global Smack label list.

 */

#ifndef __LINUX_LSM_SMACK_H

#define __LINUX_LSM_SMACK_H



struct smack_known;



struct lsm_prop_smack {

#ifdef CONFIG_SECURITY_SMACK

	struct smack_known *skp;

#endif

};



#endif /* ! __LINUX_LSM_SMACK_H */