From: David Howells <dhowells@redhat.com> To: torvalds@linux-foundation.org, viro@zeniv.linux.org.uk Cc: Stephen Smalley <sds@tycho.nsa.gov>, dhowells@redhat.com, casey@schaufler-ca.comsds@tycho.nsa.gov, nicolas.dichtel@6wind.com, raven@themaw.net, christian@brauner.io, andres@anarazel.de, jlayton@redhat.com, dray@redhat.com, kzak@redhat.com, keyrings@vger.kernel.org, linux-api@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 10/17] selinux: Implement the watch_key security hook [ver #5] Date: Wed, 18 Mar 2020 15:04:46 +0000 [thread overview] Message-ID: <158454388633.2863966.17799427202351674141.stgit@warthog.procyon.org.uk> (raw) In-Reply-To: <158454378820.2863966.10496767254293183123.stgit@warthog.procyon.org.uk> Implement the watch_key security hook to make sure that a key grants the caller View permission in order to set a watch on a key. For the moment, the watch_devices security hook is left unimplemented as it's not obvious what the object should be since the queue is global and didn't previously exist. Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> --- security/selinux/hooks.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 1659b59fb5d7..2c19ac4d7894 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6563,6 +6563,17 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer) *_buffer = context; return rc; } + +#ifdef CONFIG_KEY_NOTIFICATIONS +static int selinux_watch_key(struct key *key) +{ + struct key_security_struct *ksec = key->security; + u32 sid = current_sid(); + + return avc_has_perm(&selinux_state, + sid, ksec->sid, SECCLASS_KEY, KEY_NEED_VIEW, NULL); +} +#endif #endif #ifdef CONFIG_SECURITY_INFINIBAND @@ -7078,6 +7089,9 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(key_free, selinux_key_free), LSM_HOOK_INIT(key_permission, selinux_key_permission), LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity), +#ifdef CONFIG_KEY_NOTIFICATIONS + LSM_HOOK_INIT(watch_key, selinux_watch_key), +#endif #endif #ifdef CONFIG_AUDIT
WARNING: multiple messages have this Message-ID (diff)
From: David Howells <dhowells@redhat.com> To: torvalds@linux-foundation.org, viro@zeniv.linux.org.uk Cc: Stephen Smalley <sds@tycho.nsa.gov>, dhowells@redhat.com, casey@schaufler-ca.com, sds@tycho.nsa.gov, nicolas.dichtel@6wind.com, raven@themaw.net, christian@brauner.io, andres@anarazel.de, jlayton@redhat.com, dray@redhat.com, kzak@redhat.com, keyrings@vger.kernel.org, linux-api@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH 10/17] selinux: Implement the watch_key security hook [ver #5] Date: Wed, 18 Mar 2020 15:04:46 +0000 [thread overview] Message-ID: <158454388633.2863966.17799427202351674141.stgit@warthog.procyon.org.uk> (raw) In-Reply-To: <158454378820.2863966.10496767254293183123.stgit@warthog.procyon.org.uk> Implement the watch_key security hook to make sure that a key grants the caller View permission in order to set a watch on a key. For the moment, the watch_devices security hook is left unimplemented as it's not obvious what the object should be since the queue is global and didn't previously exist. Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Stephen Smalley <sds@tycho.nsa.gov> --- security/selinux/hooks.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 1659b59fb5d7..2c19ac4d7894 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -6563,6 +6563,17 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer) *_buffer = context; return rc; } + +#ifdef CONFIG_KEY_NOTIFICATIONS +static int selinux_watch_key(struct key *key) +{ + struct key_security_struct *ksec = key->security; + u32 sid = current_sid(); + + return avc_has_perm(&selinux_state, + sid, ksec->sid, SECCLASS_KEY, KEY_NEED_VIEW, NULL); +} +#endif #endif #ifdef CONFIG_SECURITY_INFINIBAND @@ -7078,6 +7089,9 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(key_free, selinux_key_free), LSM_HOOK_INIT(key_permission, selinux_key_permission), LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity), +#ifdef CONFIG_KEY_NOTIFICATIONS + LSM_HOOK_INIT(watch_key, selinux_watch_key), +#endif #endif #ifdef CONFIG_AUDIT
next prev parent reply other threads:[~2020-03-18 15:04 UTC|newest] Thread overview: 87+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-03-18 15:03 [PATCH 00/17] pipe: Keyrings, mount and superblock notifications [ver #5] David Howells 2020-03-18 15:03 ` David Howells 2020-03-18 15:03 ` [PATCH 01/17] uapi: General notification queue definitions " David Howells 2020-03-18 15:03 ` [PATCH 02/17] security: Add hooks to rule on setting a watch " David Howells 2020-03-18 15:03 ` David Howells 2020-03-18 18:56 ` James Morris 2020-03-18 18:56 ` James Morris 2020-03-18 15:03 ` [PATCH 03/17] security: Add a hook for the point of notification insertion " David Howells 2020-03-18 15:03 ` David Howells 2020-03-18 18:57 ` James Morris 2020-03-18 18:57 ` James Morris 2020-03-18 15:03 ` [PATCH 04/17] pipe: Add O_NOTIFICATION_PIPE " David Howells 2020-03-18 15:03 ` [PATCH 05/17] pipe: Add general notification queue support " David Howells 2020-03-18 15:03 ` David Howells 2020-03-18 15:04 ` [PATCH 06/17] watch_queue: Add a key/keyring notification facility " David Howells 2020-03-18 15:04 ` David Howells 2020-03-18 19:04 ` James Morris 2020-03-18 19:04 ` James Morris 2020-03-18 15:04 ` [PATCH 07/17] Add sample notification program " David Howells 2020-03-18 15:04 ` David Howells 2020-03-18 15:04 ` [PATCH 08/17] pipe: Allow buffers to be marked read-whole-or-error for notifications " David Howells 2020-03-18 15:04 ` David Howells 2020-03-18 15:04 ` [PATCH 09/17] pipe: Add notification lossage handling " David Howells 2020-03-18 15:04 ` David Howells 2020-03-18 15:04 ` David Howells [this message] 2020-03-18 15:04 ` [PATCH 10/17] selinux: Implement the watch_key security hook " David Howells 2020-03-18 19:06 ` James Morris 2020-03-18 19:06 ` James Morris 2020-03-18 15:04 ` [PATCH 11/17] smack: Implement the watch_key and post_notification hooks " David Howells 2020-03-18 15:04 ` David Howells 2020-03-18 15:05 ` [PATCH 12/17] watch_queue: Add security hooks to rule on setting mount and sb watches " David Howells 2020-03-18 15:05 ` David Howells 2020-03-18 19:07 ` James Morris 2020-03-18 19:07 ` James Morris 2020-03-18 15:05 ` [PATCH 13/17] watch_queue: Implement mount topology and attribute change notifications " David Howells 2020-03-18 15:05 ` David Howells 2020-04-02 15:19 ` Miklos Szeredi 2020-04-02 15:19 ` Miklos Szeredi 2020-06-14 3:07 ` Ian Kent 2020-06-14 3:07 ` Ian Kent 2020-06-15 8:44 ` Miklos Szeredi 2020-06-15 8:44 ` Miklos Szeredi 2020-07-23 10:48 ` David Howells 2020-07-23 10:48 ` David Howells 2020-08-03 9:29 ` Miklos Szeredi 2020-08-03 9:29 ` Miklos Szeredi 2020-08-04 11:38 ` Ian Kent 2020-08-04 11:38 ` Ian Kent 2020-08-04 13:19 ` Miklos Szeredi 2020-08-04 13:19 ` Miklos Szeredi 2020-08-05 1:53 ` Ian Kent 2020-08-05 1:53 ` Ian Kent 2020-08-05 7:43 ` Miklos Szeredi 2020-08-05 7:43 ` Miklos Szeredi 2020-08-05 11:36 ` Ian Kent 2020-08-05 11:36 ` Ian Kent 2020-08-05 11:56 ` Miklos Szeredi 2020-08-05 11:56 ` Miklos Szeredi 2020-07-24 10:19 ` David Howells 2020-07-24 10:19 ` David Howells 2020-07-24 10:44 ` Ian Kent 2020-07-24 10:44 ` Ian Kent 2020-07-24 11:36 ` David Howells 2020-07-24 11:36 ` David Howells 2020-08-03 10:02 ` Miklos Szeredi 2020-08-03 10:02 ` Miklos Szeredi 2020-08-03 10:08 ` David Howells 2020-08-03 10:08 ` David Howells 2020-08-03 10:18 ` David Howells 2020-08-03 10:18 ` David Howells 2020-08-03 11:17 ` Miklos Szeredi 2020-08-03 11:17 ` Miklos Szeredi 2020-08-03 11:49 ` David Howells 2020-08-03 11:49 ` David Howells 2020-08-03 12:01 ` Ian Kent 2020-08-03 12:01 ` Ian Kent 2020-08-03 12:31 ` David Howells 2020-08-03 12:31 ` David Howells 2020-08-03 14:30 ` Ian Kent 2020-08-03 14:30 ` Ian Kent 2020-03-18 15:05 ` [PATCH 14/17] watch_queue: sample: Display mount tree " David Howells 2020-03-18 15:05 ` David Howells 2020-03-18 15:05 ` [PATCH 15/17] watch_queue: Introduce a non-repeating system-unique superblock ID " David Howells 2020-03-18 15:05 ` [PATCH 16/17] watch_queue: Add superblock notifications " David Howells 2020-03-18 15:05 ` David Howells 2020-03-18 15:05 ` [PATCH 17/17] watch_queue: sample: Display " David Howells 2020-03-18 15:05 ` David Howells
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=158454388633.2863966.17799427202351674141.stgit@warthog.procyon.org.uk \ --to=dhowells@redhat.com \ --cc=casey@schaufler-ca.comsds \ --cc=sds@tycho.nsa.gov \ --cc=torvalds@linux-foundation.org \ --cc=viro@zeniv.linux.org.uk \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.