From: Elena Reshetova <elena.reshetova@intel.com>
To: kernel-hardening@lists.openwall.com
Cc: linux-security-module@vger.kernel.org, keescook@chromium.org,
spender@grsecurity.net, jmorris@namei.org,
casey.schaufler@intel.com, michael.leibowitz@intel.com,
william.c.roberts@intel.com,
Elena Reshetova <elena.reshetova@intel.com>
Subject: [kernel-hardening] [RFC] [PATCH 0/5] Hardchroot LSM + additional hooks
Date: Fri, 29 Jul 2016 10:34:35 +0300 [thread overview]
Message-ID: <1469777680-3687-1-git-send-email-elena.reshetova@intel.com> (raw)
This introduces a new Hardchroot LSM that is
based on GRKERNSEC_CHROOT feature, as well
as couple of new LSM hooks needed for its
operation.
The Hardchroot is implemented as LSM in
order to better fit the upstream kernel
design, as well as coexist with other
security subsystems. The Hardchroot LSM
is a minor LSM, and can easily be stacked
with other major and minor LSMs.
Chroot is still quite widely used in Linux
for jailing some system daemons (despite
its security limitations), and therefore
having an LSM that can be used to make
such jails more secure can bring value.
For more information about Harchroot and
its features, see commit message on
Patch 5.
In order to implement certain features of
Hardchroot, it was necessary to create
additional LSM hooks. If there is a way to
achieve the same functionality with
existing hooks, the implementation can be
easily adjusted.
Elena Reshetova (5):
path_fchdir and path_fhandle LSM hooks
task_unshare LSM hook
sb_unsharefs LSM hook
invoke path_chroot() LSM hook on mntns_install()
Hardchroot LSM
fs/fhandle.c | 5 +
fs/fs_struct.c | 7 +-
fs/namespace.c | 15 +-
fs/open.c | 3 +
include/linux/lsm_hooks.h | 37 ++
include/linux/security.h | 19 +
kernel/fork.c | 5 +
security/Kconfig | 1 +
security/Makefile | 2 +
security/hardchroot/Kconfig | 10 +
security/hardchroot/Makefile | 3 +
security/hardchroot/hardchroot_lsm.c | 654 +++++++++++++++++++++++++++++++++++
security/security.c | 30 ++
13 files changed, 786 insertions(+), 5 deletions(-)
create mode 100644 security/hardchroot/Kconfig
create mode 100644 security/hardchroot/Makefile
create mode 100644 security/hardchroot/hardchroot_lsm.c
--
1.9.1
next reply other threads:[~2016-07-29 7:34 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-29 7:34 Elena Reshetova [this message]
2016-07-29 7:34 ` [kernel-hardening] [RFC] [PATCH 1/5] path_fchdir and path_fhandle LSM hooks Elena Reshetova
2016-07-29 18:12 ` Jann Horn
2016-07-31 10:55 ` Reshetova, Elena
2016-07-31 12:02 ` Jann Horn
2016-07-31 18:28 ` Reshetova, Elena
2016-07-31 21:23 ` Jann Horn
2016-08-01 8:38 ` Reshetova, Elena
2016-07-29 7:34 ` [kernel-hardening] [RFC] [PATCH 2/5] task_unshare LSM hook Elena Reshetova
2016-07-29 17:58 ` Jann Horn
2016-07-29 18:17 ` Reshetova, Elena
2016-07-29 7:34 ` [kernel-hardening] [RFC] [PATCH 3/5] sb_unsharefs " Elena Reshetova
2016-07-29 18:02 ` Jann Horn
2016-07-29 18:09 ` Reshetova, Elena
2016-07-29 18:15 ` Jann Horn
2016-07-29 18:19 ` Reshetova, Elena
2016-07-29 7:34 ` [kernel-hardening] [RFC] [PATCH 4/5] invoke path_chroot() LSM hook on mntns_install() Elena Reshetova
2016-07-29 18:11 ` Jann Horn
2016-07-31 10:39 ` Reshetova, Elena
2016-07-31 11:29 ` Jann Horn
2016-08-01 9:26 ` Reshetova, Elena
2016-07-29 7:34 ` [kernel-hardening] [RFC] [PATCH 5/5] Hardchroot LSM Elena Reshetova
2016-07-29 11:44 ` [kernel-hardening] " Brad Spengler
2016-07-29 12:15 ` [kernel-hardening] " Reshetova, Elena
2016-07-29 12:25 ` Reshetova, Elena
2016-07-29 18:53 ` [kernel-hardening] " Jann Horn
2016-07-29 19:20 ` Casey Schaufler
2016-07-29 20:53 ` Jann Horn
2016-07-29 21:10 ` Casey Schaufler
2016-07-29 21:50 ` Jann Horn
2016-07-30 6:10 ` Reshetova, Elena
2016-08-03 6:36 ` [kernel-hardening] Re: [RFC] [PATCH 0/5] Hardchroot LSM + additional hooks James Morris
2016-08-05 7:53 ` [kernel-hardening] " Reshetova, Elena
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1469777680-3687-1-git-send-email-elena.reshetova@intel.com \
--to=elena.reshetova@intel.com \
--cc=casey.schaufler@intel.com \
--cc=jmorris@namei.org \
--cc=keescook@chromium.org \
--cc=kernel-hardening@lists.openwall.com \
--cc=linux-security-module@vger.kernel.org \
--cc=michael.leibowitz@intel.com \
--cc=spender@grsecurity.net \
--cc=william.c.roberts@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.