From: Kees Cook <keescook@chromium.org>
To: Casey Schaufler <casey@schaufler-ca.com>
Cc: casey.schaufler@intel.com, jmorris@namei.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org,
john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp,
paul@paul-moore.com, sds@tycho.nsa.gov
Subject: Re: [PATCH v2 13/25] LSM: Use lsmblob in security_cred_getsecid
Date: Tue, 18 Jun 2019 22:11:08 -0700 [thread overview]
Message-ID: <201906182210.8765003E11@keescook> (raw)
In-Reply-To: <20190618230551.7475-14-casey@schaufler-ca.com>
On Tue, Jun 18, 2019 at 04:05:39PM -0700, Casey Schaufler wrote:
> Change the security_cred_getsecid() interface to fill in a
> lsmblob instead of a u32 secid. The associated data elements
> in the audit sub-system are changed from a secid to a lsmblob
> to accomodate multiple possible LSM audit users.
Cool, cool. I'm digging the clean conversions all the way through this
patch. I didn't see patch 14/25 for some reason, though...
-Kees
>
> Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
> ---
> include/linux/security.h | 2 +-
> kernel/audit.c | 14 +++++-------
> kernel/audit.h | 5 +++--
> kernel/auditsc.c | 37 +++++++++++--------------------
> security/integrity/ima/ima_main.c | 6 ++---
> security/security.c | 9 +++++---
> 6 files changed, 32 insertions(+), 41 deletions(-)
>
> diff --git a/include/linux/security.h b/include/linux/security.h
> index b28d4f9c7714..07a239292e02 100644
> --- a/include/linux/security.h
> +++ b/include/linux/security.h
> @@ -383,7 +383,7 @@ int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
> void security_cred_free(struct cred *cred);
> int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);
> void security_transfer_creds(struct cred *new, const struct cred *old);
> -void security_cred_getsecid(const struct cred *c, u32 *secid);
> +void security_cred_getsecid(const struct cred *c, struct lsmblob *l);
> int security_kernel_act_as(struct cred *new, struct lsmblob *l);
> int security_kernel_create_files_as(struct cred *new, struct inode *inode);
> int security_kernel_module_request(char *kmod_name);
> diff --git a/kernel/audit.c b/kernel/audit.c
> index 3ab2a1c0ba61..a52f8772477f 100644
> --- a/kernel/audit.c
> +++ b/kernel/audit.c
> @@ -137,7 +137,7 @@ static u32 audit_backlog_wait_time = AUDIT_BACKLOG_WAIT_TIME;
> /* The identity of the user shutting down the audit system. */
> kuid_t audit_sig_uid = INVALID_UID;
> pid_t audit_sig_pid = -1;
> -u32 audit_sig_sid = 0;
> +struct lsmblob audit_sig_lsm;
>
> /* Records can be lost in several ways:
> 0) [suppressed in audit_alloc]
> @@ -1429,23 +1429,21 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
> }
> case AUDIT_SIGNAL_INFO:
> len = 0;
> - if (audit_sig_sid) {
> - struct lsmblob le;
> -
> - lsmblob_init(&le, audit_sig_sid);
> - err = security_secid_to_secctx(&le, &ctx, &len);
> + if (lsmblob_is_set(&audit_sig_lsm)) {
> + err = security_secid_to_secctx(&audit_sig_lsm, &ctx,
> + &len);
> if (err)
> return err;
> }
> sig_data = kmalloc(sizeof(*sig_data) + len, GFP_KERNEL);
> if (!sig_data) {
> - if (audit_sig_sid)
> + if (lsmblob_is_set(&audit_sig_lsm))
> security_release_secctx(ctx, len);
> return -ENOMEM;
> }
> sig_data->uid = from_kuid(&init_user_ns, audit_sig_uid);
> sig_data->pid = audit_sig_pid;
> - if (audit_sig_sid) {
> + if (lsmblob_is_set(&audit_sig_lsm)) {
> memcpy(sig_data->ctx, ctx, len);
> security_release_secctx(ctx, len);
> }
> diff --git a/kernel/audit.h b/kernel/audit.h
> index 958d5b8fc1b3..29e29c6f4afb 100644
> --- a/kernel/audit.h
> +++ b/kernel/audit.h
> @@ -22,6 +22,7 @@
> #include <linux/fs.h>
> #include <linux/audit.h>
> #include <linux/skbuff.h>
> +#include <linux/security.h>
> #include <uapi/linux/mqueue.h>
> #include <linux/tty.h>
>
> @@ -147,7 +148,7 @@ struct audit_context {
> kuid_t target_auid;
> kuid_t target_uid;
> unsigned int target_sessionid;
> - u32 target_sid;
> + struct lsmblob target_lsm;
> char target_comm[TASK_COMM_LEN];
>
> struct audit_tree_refs *trees, *first_trees;
> @@ -338,7 +339,7 @@ extern char *audit_unpack_string(void **bufp, size_t *remain, size_t len);
>
> extern pid_t audit_sig_pid;
> extern kuid_t audit_sig_uid;
> -extern u32 audit_sig_sid;
> +extern struct lsmblob audit_sig_lsm;
>
> extern int audit_filter(int msgtype, unsigned int listtype);
>
> diff --git a/kernel/auditsc.c b/kernel/auditsc.c
> index cdd1dd9e0eec..ebdd7eab9247 100644
> --- a/kernel/auditsc.c
> +++ b/kernel/auditsc.c
> @@ -112,7 +112,7 @@ struct audit_aux_data_pids {
> kuid_t target_auid[AUDIT_AUX_PIDS];
> kuid_t target_uid[AUDIT_AUX_PIDS];
> unsigned int target_sessionid[AUDIT_AUX_PIDS];
> - u32 target_sid[AUDIT_AUX_PIDS];
> + struct lsmblob target_lsm[AUDIT_AUX_PIDS];
> char target_comm[AUDIT_AUX_PIDS][TASK_COMM_LEN];
> int pid_count;
> };
> @@ -937,14 +937,14 @@ static inline void audit_free_context(struct audit_context *context)
> }
>
> static int audit_log_pid_context(struct audit_context *context, pid_t pid,
> - kuid_t auid, kuid_t uid, unsigned int sessionid,
> - u32 sid, char *comm)
> + kuid_t auid, kuid_t uid,
> + unsigned int sessionid,
> + struct lsmblob *l, char *comm)
> {
> struct audit_buffer *ab;
> char *ctx = NULL;
> u32 len;
> int rc = 0;
> - struct lsmblob le;
>
> ab = audit_log_start(context, GFP_KERNEL, AUDIT_OBJ_PID);
> if (!ab)
> @@ -953,9 +953,8 @@ static int audit_log_pid_context(struct audit_context *context, pid_t pid,
> audit_log_format(ab, "opid=%d oauid=%d ouid=%d oses=%d", pid,
> from_kuid(&init_user_ns, auid),
> from_kuid(&init_user_ns, uid), sessionid);
> - if (sid) {
> - lsmblob_init(&le, sid);
> - if (security_secid_to_secctx(&le, &ctx, &len)) {
> + if (lsmblob_is_set(l)) {
> + if (security_secid_to_secctx(l, &ctx, &len)) {
> audit_log_format(ab, " obj=(none)");
> rc = 1;
> } else {
> @@ -1525,7 +1524,7 @@ static void audit_log_exit(void)
> axs->target_auid[i],
> axs->target_uid[i],
> axs->target_sessionid[i],
> - axs->target_sid[i],
> + &axs->target_lsm[i],
> axs->target_comm[i]))
> call_panic = 1;
> }
> @@ -1534,7 +1533,7 @@ static void audit_log_exit(void)
> audit_log_pid_context(context, context->target_pid,
> context->target_auid, context->target_uid,
> context->target_sessionid,
> - context->target_sid, context->target_comm))
> + &context->target_lsm, context->target_comm))
> call_panic = 1;
>
> if (context->pwd.dentry && context->pwd.mnt) {
> @@ -1711,7 +1710,7 @@ void __audit_syscall_exit(int success, long return_code)
> context->aux = NULL;
> context->aux_pids = NULL;
> context->target_pid = 0;
> - context->target_sid = 0;
> + lsmblob_init(&context->target_lsm, 0);
> context->sockaddr_len = 0;
> context->type = 0;
> context->fds[0] = -1;
> @@ -2365,15 +2364,12 @@ int __audit_sockaddr(int len, void *a)
> void __audit_ptrace(struct task_struct *t)
> {
> struct audit_context *context = audit_context();
> - struct lsmblob le;
>
> context->target_pid = task_tgid_nr(t);
> context->target_auid = audit_get_loginuid(t);
> context->target_uid = task_uid(t);
> context->target_sessionid = audit_get_sessionid(t);
> - security_task_getsecid(t, &le);
> - /* scaffolding - until target_sid is converted */
> - context->target_sid = le.secid[1];
> + security_task_getsecid(t, &context->target_lsm);
> memcpy(context->target_comm, t->comm, TASK_COMM_LEN);
> }
>
> @@ -2390,7 +2386,6 @@ int audit_signal_info(int sig, struct task_struct *t)
> struct audit_aux_data_pids *axp;
> struct audit_context *ctx = audit_context();
> kuid_t uid = current_uid(), auid, t_uid = task_uid(t);
> - struct lsmblob le;
>
> if (auditd_test_task(t) &&
> (sig == SIGTERM || sig == SIGHUP ||
> @@ -2401,9 +2396,7 @@ int audit_signal_info(int sig, struct task_struct *t)
> audit_sig_uid = auid;
> else
> audit_sig_uid = uid;
> - security_task_getsecid(current, &le);
> - /* scaffolding until audit_sig_sid is converted */
> - audit_sig_sid = le.secid[1];
> + security_task_getsecid(current, &audit_sig_lsm);
> }
>
> if (!audit_signals || audit_dummy_context())
> @@ -2416,9 +2409,7 @@ int audit_signal_info(int sig, struct task_struct *t)
> ctx->target_auid = audit_get_loginuid(t);
> ctx->target_uid = t_uid;
> ctx->target_sessionid = audit_get_sessionid(t);
> - security_task_getsecid(t, &le);
> - /* scaffolding until target_sid is converted */
> - ctx->target_sid = le.secid[1];
> + security_task_getsecid(t, &ctx->target_lsm);
> memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN);
> return 0;
> }
> @@ -2439,9 +2430,7 @@ int audit_signal_info(int sig, struct task_struct *t)
> axp->target_auid[axp->pid_count] = audit_get_loginuid(t);
> axp->target_uid[axp->pid_count] = t_uid;
> axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t);
> - security_task_getsecid(t, &le);
> - /* scaffolding until target_sid is converted */
> - axp->target_sid[axp->pid_count] = le.secid[1];
> + security_task_getsecid(t, &axp->target_lsm[axp->pid_count]);
> memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN);
> axp->pid_count++;
>
> diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
> index 99870a6286a9..9959d7cbe42e 100644
> --- a/security/integrity/ima/ima_main.c
> +++ b/security/integrity/ima/ima_main.c
> @@ -363,7 +363,6 @@ int ima_file_mmap(struct file *file, unsigned long prot)
> int ima_bprm_check(struct linux_binprm *bprm)
> {
> int ret;
> - u32 secid;
> struct lsmblob le;
>
> security_task_getsecid(current, &le);
> @@ -373,8 +372,9 @@ int ima_bprm_check(struct linux_binprm *bprm)
> if (ret)
> return ret;
>
> - security_cred_getsecid(bprm->cred, &secid);
> - return process_measurement(bprm->file, bprm->cred, secid, NULL, 0,
> + security_cred_getsecid(bprm->cred, &le);
> + /* scaffolding until process_measurement changes */
> + return process_measurement(bprm->file, bprm->cred, le.secid[1], NULL, 0,
> MAY_EXEC, CREDS_CHECK);
> }
>
> diff --git a/security/security.c b/security/security.c
> index e82994667263..46f6cf21d33c 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -1638,10 +1638,13 @@ void security_transfer_creds(struct cred *new, const struct cred *old)
> call_void_hook(cred_transfer, new, old);
> }
>
> -void security_cred_getsecid(const struct cred *c, u32 *secid)
> +void security_cred_getsecid(const struct cred *c, struct lsmblob *l)
> {
> - *secid = 0;
> - call_void_hook(cred_getsecid, c, secid);
> + struct security_hook_list *hp;
> +
> + lsmblob_init(l, 0);
> + hlist_for_each_entry(hp, &security_hook_heads.cred_getsecid, list)
> + hp->hook.cred_getsecid(c, &l->secid[hp->slot]);
> }
> EXPORT_SYMBOL(security_cred_getsecid);
>
> --
> 2.20.1
>
--
Kees Cook
next prev parent reply other threads:[~2019-06-19 5:11 UTC|newest]
Thread overview: 53+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-06-18 23:05 [PATCH v2 00/25] LSM: Module stacking for AppArmor Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 01/25] LSM: Infrastructure management of the superblock Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 02/25] LSM: Infrastructure management of the sock security Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 03/25] LSM: Infrastructure management of the key blob Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 04/25] LSM: Create and manage the lsmblob data structure Casey Schaufler
2019-06-19 4:52 ` Kees Cook
2019-06-19 6:17 ` Kees Cook
2019-06-19 16:34 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 05/25] Use lsmblob in security_audit_rule_match Casey Schaufler
2019-06-19 4:55 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 06/25] LSM: Use lsmblob in security_kernel_act_as Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 07/25] net: Prepare UDS for secuirty module stacking Casey Schaufler
2019-06-19 4:59 ` Kees Cook
2019-06-19 16:42 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 08/25] LSM: Use lsmblob in security_secctx_to_secid Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 09/25] LSM: Use lsmblob in security_secid_to_secctx Casey Schaufler
2019-06-19 5:03 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 10/25] LSM: Use lsmblob in security_ipc_getsecid Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 11/25] LSM: Use lsmblob in security_task_getsecid Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 12/25] LSM: Use lsmblob in security_inode_getsecid Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 13/25] LSM: Use lsmblob in security_cred_getsecid Casey Schaufler
2019-06-19 5:11 ` Kees Cook [this message]
2019-06-18 23:05 ` [PATCH v2 14/25] IMA: Change internal interfaces to use lsmblobs Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 15/25] LSM: Specify which LSM to display Casey Schaufler
2019-06-19 4:33 ` Kees Cook
2019-06-19 15:33 ` Casey Schaufler
2019-06-19 5:28 ` Kees Cook
2019-06-19 17:00 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 16/25] LSM: Ensure the correct LSM context releaser Casey Schaufler
2019-06-19 5:34 ` Kees Cook
2019-06-19 17:10 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 17/25] LSM: Use lsmcontext in security_secid_to_secctx Casey Schaufler
2019-06-19 5:36 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 18/25] LSM: Use lsmcontext in security_dentry_init_security Casey Schaufler
2019-06-19 5:41 ` Kees Cook
2019-06-19 17:31 ` Casey Schaufler
2019-06-20 17:25 ` Kees Cook
2019-06-18 23:05 ` [PATCH v2 19/25] LSM: Use lsmcontext in security_inode_getsecctx Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 20/25] LSM: security_secid_to_secctx in netlink netfilter Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 21/25] Audit: Store LSM audit information in an lsmblob Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 22/25] LSM: Return the lsmblob slot on initialization Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 23/25] NET: Store LSM netlabel data in a lsmblob Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 24/25] Fix slotted list and getpeersec_d Casey Schaufler
2019-06-19 5:50 ` Kees Cook
2019-06-19 17:36 ` Casey Schaufler
2019-06-18 23:05 ` [PATCH v2 25/25] AppArmor: Remove the exclusive flag Casey Schaufler
2019-06-19 4:34 ` [PATCH v2 00/25] LSM: Module stacking for AppArmor Kees Cook
2019-06-19 15:39 ` Casey Schaufler
2019-06-19 20:08 ` James Morris
2019-06-20 17:33 ` Stacked LSMs (was Re: [PATCH v2 00/25] LSM: Module stacking for AppArmor) Kees Cook
2019-06-22 14:15 ` Mickaël Salaün
2019-06-19 5:21 ` [PATCH v2 00/25] LSM: Module stacking for AppArmor Kees Cook
2019-06-19 16:48 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=201906182210.8765003E11@keescook \
--to=keescook@chromium.org \
--cc=casey.schaufler@intel.com \
--cc=casey@schaufler-ca.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).