From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, jmorris@namei.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: casey@schaufler-ca.com, linux-audit@redhat.com,
keescook@chromium.org, john.johansen@canonical.com,
penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com,
sds@tycho.nsa.gov, linux-kernel@vger.kernel.org,
linux-integrity@vger.kernel.org
Subject: [PATCH v26 13/25] IMA: Change internal interfaces to use lsmblobs
Date: Thu, 13 May 2021 13:07:55 -0700 [thread overview]
Message-ID: <20210513200807.15910-14-casey@schaufler-ca.com> (raw)
In-Reply-To: <20210513200807.15910-1-casey@schaufler-ca.com>
The IMA interfaces ima_get_action() and ima_match_policy()
call LSM functions that use lsmblobs. Change the IMA functions
to pass the lsmblob to be compatible with the LSM functions.
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Cc: linux-integrity@vger.kernel.org
To: Mimi Zohar <zohar@linux.ibm.com>
---
security/integrity/ima/ima.h | 6 ++---
security/integrity/ima/ima_api.c | 6 ++---
security/integrity/ima/ima_appraise.c | 5 ++--
security/integrity/ima/ima_main.c | 36 +++++++++++----------------
security/integrity/ima/ima_policy.c | 17 ++++++-------
5 files changed, 31 insertions(+), 39 deletions(-)
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 55f3bd4f0b01..a6b59fcaf62a 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -251,7 +251,7 @@ static inline void ima_process_queued_keys(void) {}
/* LIM API function definitions */
int ima_get_action(struct user_namespace *mnt_userns, struct inode *inode,
- const struct cred *cred, u32 secid, int mask,
+ const struct cred *cred, struct lsmblob *blob, int mask,
enum ima_hooks func, int *pcr,
struct ima_template_desc **template_desc,
const char *func_data);
@@ -282,8 +282,8 @@ const char *ima_d_path(const struct path *path, char **pathbuf, char *filename);
/* IMA policy related functions */
int ima_match_policy(struct user_namespace *mnt_userns, struct inode *inode,
- const struct cred *cred, u32 secid, enum ima_hooks func,
- int mask, int flags, int *pcr,
+ const struct cred *cred, struct lsmblob *blob,
+ enum ima_hooks func, int mask, int flags, int *pcr,
struct ima_template_desc **template_desc,
const char *func_data);
void ima_init_policy(void);
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index d8e321cc6936..691f68d478f1 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -165,7 +165,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
* @mnt_userns: user namespace of the mount the inode was found from
* @inode: pointer to the inode associated with the object being validated
* @cred: pointer to credentials structure to validate
- * @secid: secid of the task being validated
+ * @blob: LSM data of the task being validated
* @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC,
* MAY_APPEND)
* @func: caller identifier
@@ -185,7 +185,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
*
*/
int ima_get_action(struct user_namespace *mnt_userns, struct inode *inode,
- const struct cred *cred, u32 secid, int mask,
+ const struct cred *cred, struct lsmblob *blob, int mask,
enum ima_hooks func, int *pcr,
struct ima_template_desc **template_desc,
const char *func_data)
@@ -194,7 +194,7 @@ int ima_get_action(struct user_namespace *mnt_userns, struct inode *inode,
flags &= ima_policy_flag;
- return ima_match_policy(mnt_userns, inode, cred, secid, func, mask,
+ return ima_match_policy(mnt_userns, inode, cred, blob, func, mask,
flags, pcr, template_desc, func_data);
}
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index f8c7b593175f..b2af72289f00 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -77,10 +77,9 @@ int ima_must_appraise(struct user_namespace *mnt_userns, struct inode *inode,
return 0;
security_task_getsecid_subj(current, &blob);
- /* scaffolding the .secid[0] */
return ima_match_policy(mnt_userns, inode, current_cred(),
- blob.secid[0], func, mask,
- IMA_APPRAISE | IMA_HASH, NULL, NULL, NULL);
+ &blob, func, mask, IMA_APPRAISE | IMA_HASH,
+ NULL, NULL, NULL);
}
static int ima_fix_xattr(struct dentry *dentry,
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index b3e00340a97c..b63f73d43bd2 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -194,8 +194,8 @@ void ima_file_free(struct file *file)
}
static int process_measurement(struct file *file, const struct cred *cred,
- u32 secid, char *buf, loff_t size, int mask,
- enum ima_hooks func)
+ struct lsmblob *blob, char *buf, loff_t size,
+ int mask, enum ima_hooks func)
{
struct inode *inode = file_inode(file);
struct integrity_iint_cache *iint = NULL;
@@ -218,7 +218,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
* bitmask based on the appraise/audit/measurement policy.
* Included is the appraise submask.
*/
- action = ima_get_action(file_mnt_user_ns(file), inode, cred, secid,
+ action = ima_get_action(file_mnt_user_ns(file), inode, cred, blob,
mask, func, &pcr, &template_desc, NULL);
violation_check = ((func == FILE_CHECK || func == MMAP_CHECK) &&
(ima_policy_flag & IMA_MEASURE));
@@ -392,8 +392,7 @@ int ima_file_mmap(struct file *file, unsigned long prot)
if (file && (prot & PROT_EXEC)) {
security_task_getsecid_subj(current, &blob);
- /* scaffolding - until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0],
+ return process_measurement(file, current_cred(), &blob,
NULL, 0, MAY_EXEC, MMAP_CHECK);
}
@@ -434,7 +433,7 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
inode = file_inode(vma->vm_file);
/* scaffolding */
action = ima_get_action(file_mnt_user_ns(vma->vm_file), inode,
- current_cred(), blob.secid[0], MAY_EXEC,
+ current_cred(), &blob, MAY_EXEC,
MMAP_CHECK, &pcr, &template, 0);
/* Is the mmap'ed file in policy? */
@@ -473,16 +472,14 @@ int ima_bprm_check(struct linux_binprm *bprm)
struct lsmblob blob;
security_task_getsecid_subj(current, &blob);
- /* scaffolding until process_measurement changes */
- ret = process_measurement(bprm->file, current_cred(), blob.secid[0],
- NULL, 0, MAY_EXEC, BPRM_CHECK);
+ ret = process_measurement(bprm->file, current_cred(), &blob, NULL, 0,
+ MAY_EXEC, BPRM_CHECK);
if (ret)
return ret;
security_cred_getsecid(bprm->cred, &blob);
- /* scaffolding until process_measurement changes */
- return process_measurement(bprm->file, bprm->cred, blob.secid[0],
- NULL, 0, MAY_EXEC, CREDS_CHECK);
+ return process_measurement(bprm->file, bprm->cred, &blob, NULL, 0,
+ MAY_EXEC, CREDS_CHECK);
}
/**
@@ -500,8 +497,7 @@ int ima_file_check(struct file *file, int mask)
struct lsmblob blob;
security_task_getsecid_subj(current, &blob);
- /* scaffolding until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0], NULL, 0,
+ return process_measurement(file, current_cred(), &blob, NULL, 0,
mask & (MAY_READ | MAY_WRITE | MAY_EXEC |
MAY_APPEND), FILE_CHECK);
}
@@ -698,9 +694,8 @@ int ima_read_file(struct file *file, enum kernel_read_file_id read_id,
/* Read entire file for all partial reads. */
func = read_idmap[read_id] ?: FILE_CHECK;
security_task_getsecid_subj(current, &blob);
- /* scaffolding - until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0], NULL,
- 0, MAY_READ, func);
+ return process_measurement(file, current_cred(), &blob, NULL, 0,
+ MAY_READ, func);
}
const int read_idmap[READING_MAX_ID] = {
@@ -742,9 +737,8 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size,
func = read_idmap[read_id] ?: FILE_CHECK;
security_task_getsecid_subj(current, &blob);
- /* scaffolding until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0], buf,
- size, MAY_READ, func);
+ return process_measurement(file, current_cred(), &blob, buf, size,
+ MAY_READ, func);
}
/**
@@ -889,7 +883,7 @@ void process_buffer_measurement(struct user_namespace *mnt_userns,
security_task_getsecid_subj(current, &blob);
/* scaffolding */
action = ima_get_action(mnt_userns, inode, current_cred(),
- blob.secid[0], 0, func, &pcr, &template,
+ &blob, 0, func, &pcr, &template,
func_data);
if (!(action & IMA_MEASURE))
return;
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 5ee7629fd782..caacd8bf0462 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -546,7 +546,7 @@ static bool ima_match_rule_data(struct ima_rule_entry *rule,
* @mnt_userns: user namespace of the mount the inode was found from
* @inode: a pointer to an inode
* @cred: a pointer to a credentials structure for user validation
- * @secid: the secid of the task to be validated
+ * @blob: the lsm data of the task to be validated
* @func: LIM hook identifier
* @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
* @func_data: func specific data, may be NULL
@@ -556,8 +556,8 @@ static bool ima_match_rule_data(struct ima_rule_entry *rule,
static bool ima_match_rules(struct ima_rule_entry *rule,
struct user_namespace *mnt_userns,
struct inode *inode, const struct cred *cred,
- u32 secid, enum ima_hooks func, int mask,
- const char *func_data)
+ struct lsmblob *blob, enum ima_hooks func,
+ int mask, const char *func_data)
{
int i;
@@ -626,8 +626,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
case LSM_SUBJ_USER:
case LSM_SUBJ_ROLE:
case LSM_SUBJ_TYPE:
- lsmblob_init(&lsmdata, secid);
- rc = ima_filter_rule_match(&lsmdata, rule->lsm[i].type,
+ rc = ima_filter_rule_match(blob, rule->lsm[i].type,
Audit_equal,
rule->lsm[i].rule);
break;
@@ -671,7 +670,7 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
* @inode: pointer to an inode for which the policy decision is being made
* @cred: pointer to a credentials structure for which the policy decision is
* being made
- * @secid: LSM secid of the task to be validated
+ * @blob: LSM data of the task to be validated
* @func: IMA hook identifier
* @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
* @pcr: set the pcr to extend
@@ -686,8 +685,8 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
* than writes so ima_match_policy() is classical RCU candidate.
*/
int ima_match_policy(struct user_namespace *mnt_userns, struct inode *inode,
- const struct cred *cred, u32 secid, enum ima_hooks func,
- int mask, int flags, int *pcr,
+ const struct cred *cred, struct lsmblob *blob,
+ enum ima_hooks func, int mask, int flags, int *pcr,
struct ima_template_desc **template_desc,
const char *func_data)
{
@@ -703,7 +702,7 @@ int ima_match_policy(struct user_namespace *mnt_userns, struct inode *inode,
if (!(entry->action & actmask))
continue;
- if (!ima_match_rules(entry, mnt_userns, inode, cred, secid,
+ if (!ima_match_rules(entry, mnt_userns, inode, cred, blob,
func, mask, func_data))
continue;
--
2.29.2
WARNING: multiple messages have this Message-ID (diff)
From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, jmorris@namei.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: john.johansen@canonical.com, linux-kernel@vger.kernel.org,
linux-audit@redhat.com, linux-integrity@vger.kernel.org,
sds@tycho.nsa.gov
Subject: [PATCH v26 13/25] IMA: Change internal interfaces to use lsmblobs
Date: Thu, 13 May 2021 13:07:55 -0700 [thread overview]
Message-ID: <20210513200807.15910-14-casey@schaufler-ca.com> (raw)
In-Reply-To: <20210513200807.15910-1-casey@schaufler-ca.com>
The IMA interfaces ima_get_action() and ima_match_policy()
call LSM functions that use lsmblobs. Change the IMA functions
to pass the lsmblob to be compatible with the LSM functions.
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Cc: linux-integrity@vger.kernel.org
To: Mimi Zohar <zohar@linux.ibm.com>
---
security/integrity/ima/ima.h | 6 ++---
security/integrity/ima/ima_api.c | 6 ++---
security/integrity/ima/ima_appraise.c | 5 ++--
security/integrity/ima/ima_main.c | 36 +++++++++++----------------
security/integrity/ima/ima_policy.c | 17 ++++++-------
5 files changed, 31 insertions(+), 39 deletions(-)
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 55f3bd4f0b01..a6b59fcaf62a 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -251,7 +251,7 @@ static inline void ima_process_queued_keys(void) {}
/* LIM API function definitions */
int ima_get_action(struct user_namespace *mnt_userns, struct inode *inode,
- const struct cred *cred, u32 secid, int mask,
+ const struct cred *cred, struct lsmblob *blob, int mask,
enum ima_hooks func, int *pcr,
struct ima_template_desc **template_desc,
const char *func_data);
@@ -282,8 +282,8 @@ const char *ima_d_path(const struct path *path, char **pathbuf, char *filename);
/* IMA policy related functions */
int ima_match_policy(struct user_namespace *mnt_userns, struct inode *inode,
- const struct cred *cred, u32 secid, enum ima_hooks func,
- int mask, int flags, int *pcr,
+ const struct cred *cred, struct lsmblob *blob,
+ enum ima_hooks func, int mask, int flags, int *pcr,
struct ima_template_desc **template_desc,
const char *func_data);
void ima_init_policy(void);
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index d8e321cc6936..691f68d478f1 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -165,7 +165,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
* @mnt_userns: user namespace of the mount the inode was found from
* @inode: pointer to the inode associated with the object being validated
* @cred: pointer to credentials structure to validate
- * @secid: secid of the task being validated
+ * @blob: LSM data of the task being validated
* @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC,
* MAY_APPEND)
* @func: caller identifier
@@ -185,7 +185,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
*
*/
int ima_get_action(struct user_namespace *mnt_userns, struct inode *inode,
- const struct cred *cred, u32 secid, int mask,
+ const struct cred *cred, struct lsmblob *blob, int mask,
enum ima_hooks func, int *pcr,
struct ima_template_desc **template_desc,
const char *func_data)
@@ -194,7 +194,7 @@ int ima_get_action(struct user_namespace *mnt_userns, struct inode *inode,
flags &= ima_policy_flag;
- return ima_match_policy(mnt_userns, inode, cred, secid, func, mask,
+ return ima_match_policy(mnt_userns, inode, cred, blob, func, mask,
flags, pcr, template_desc, func_data);
}
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index f8c7b593175f..b2af72289f00 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -77,10 +77,9 @@ int ima_must_appraise(struct user_namespace *mnt_userns, struct inode *inode,
return 0;
security_task_getsecid_subj(current, &blob);
- /* scaffolding the .secid[0] */
return ima_match_policy(mnt_userns, inode, current_cred(),
- blob.secid[0], func, mask,
- IMA_APPRAISE | IMA_HASH, NULL, NULL, NULL);
+ &blob, func, mask, IMA_APPRAISE | IMA_HASH,
+ NULL, NULL, NULL);
}
static int ima_fix_xattr(struct dentry *dentry,
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index b3e00340a97c..b63f73d43bd2 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -194,8 +194,8 @@ void ima_file_free(struct file *file)
}
static int process_measurement(struct file *file, const struct cred *cred,
- u32 secid, char *buf, loff_t size, int mask,
- enum ima_hooks func)
+ struct lsmblob *blob, char *buf, loff_t size,
+ int mask, enum ima_hooks func)
{
struct inode *inode = file_inode(file);
struct integrity_iint_cache *iint = NULL;
@@ -218,7 +218,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
* bitmask based on the appraise/audit/measurement policy.
* Included is the appraise submask.
*/
- action = ima_get_action(file_mnt_user_ns(file), inode, cred, secid,
+ action = ima_get_action(file_mnt_user_ns(file), inode, cred, blob,
mask, func, &pcr, &template_desc, NULL);
violation_check = ((func == FILE_CHECK || func == MMAP_CHECK) &&
(ima_policy_flag & IMA_MEASURE));
@@ -392,8 +392,7 @@ int ima_file_mmap(struct file *file, unsigned long prot)
if (file && (prot & PROT_EXEC)) {
security_task_getsecid_subj(current, &blob);
- /* scaffolding - until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0],
+ return process_measurement(file, current_cred(), &blob,
NULL, 0, MAY_EXEC, MMAP_CHECK);
}
@@ -434,7 +433,7 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
inode = file_inode(vma->vm_file);
/* scaffolding */
action = ima_get_action(file_mnt_user_ns(vma->vm_file), inode,
- current_cred(), blob.secid[0], MAY_EXEC,
+ current_cred(), &blob, MAY_EXEC,
MMAP_CHECK, &pcr, &template, 0);
/* Is the mmap'ed file in policy? */
@@ -473,16 +472,14 @@ int ima_bprm_check(struct linux_binprm *bprm)
struct lsmblob blob;
security_task_getsecid_subj(current, &blob);
- /* scaffolding until process_measurement changes */
- ret = process_measurement(bprm->file, current_cred(), blob.secid[0],
- NULL, 0, MAY_EXEC, BPRM_CHECK);
+ ret = process_measurement(bprm->file, current_cred(), &blob, NULL, 0,
+ MAY_EXEC, BPRM_CHECK);
if (ret)
return ret;
security_cred_getsecid(bprm->cred, &blob);
- /* scaffolding until process_measurement changes */
- return process_measurement(bprm->file, bprm->cred, blob.secid[0],
- NULL, 0, MAY_EXEC, CREDS_CHECK);
+ return process_measurement(bprm->file, bprm->cred, &blob, NULL, 0,
+ MAY_EXEC, CREDS_CHECK);
}
/**
@@ -500,8 +497,7 @@ int ima_file_check(struct file *file, int mask)
struct lsmblob blob;
security_task_getsecid_subj(current, &blob);
- /* scaffolding until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0], NULL, 0,
+ return process_measurement(file, current_cred(), &blob, NULL, 0,
mask & (MAY_READ | MAY_WRITE | MAY_EXEC |
MAY_APPEND), FILE_CHECK);
}
@@ -698,9 +694,8 @@ int ima_read_file(struct file *file, enum kernel_read_file_id read_id,
/* Read entire file for all partial reads. */
func = read_idmap[read_id] ?: FILE_CHECK;
security_task_getsecid_subj(current, &blob);
- /* scaffolding - until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0], NULL,
- 0, MAY_READ, func);
+ return process_measurement(file, current_cred(), &blob, NULL, 0,
+ MAY_READ, func);
}
const int read_idmap[READING_MAX_ID] = {
@@ -742,9 +737,8 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size,
func = read_idmap[read_id] ?: FILE_CHECK;
security_task_getsecid_subj(current, &blob);
- /* scaffolding until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0], buf,
- size, MAY_READ, func);
+ return process_measurement(file, current_cred(), &blob, buf, size,
+ MAY_READ, func);
}
/**
@@ -889,7 +883,7 @@ void process_buffer_measurement(struct user_namespace *mnt_userns,
security_task_getsecid_subj(current, &blob);
/* scaffolding */
action = ima_get_action(mnt_userns, inode, current_cred(),
- blob.secid[0], 0, func, &pcr, &template,
+ &blob, 0, func, &pcr, &template,
func_data);
if (!(action & IMA_MEASURE))
return;
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index 5ee7629fd782..caacd8bf0462 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -546,7 +546,7 @@ static bool ima_match_rule_data(struct ima_rule_entry *rule,
* @mnt_userns: user namespace of the mount the inode was found from
* @inode: a pointer to an inode
* @cred: a pointer to a credentials structure for user validation
- * @secid: the secid of the task to be validated
+ * @blob: the lsm data of the task to be validated
* @func: LIM hook identifier
* @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
* @func_data: func specific data, may be NULL
@@ -556,8 +556,8 @@ static bool ima_match_rule_data(struct ima_rule_entry *rule,
static bool ima_match_rules(struct ima_rule_entry *rule,
struct user_namespace *mnt_userns,
struct inode *inode, const struct cred *cred,
- u32 secid, enum ima_hooks func, int mask,
- const char *func_data)
+ struct lsmblob *blob, enum ima_hooks func,
+ int mask, const char *func_data)
{
int i;
@@ -626,8 +626,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
case LSM_SUBJ_USER:
case LSM_SUBJ_ROLE:
case LSM_SUBJ_TYPE:
- lsmblob_init(&lsmdata, secid);
- rc = ima_filter_rule_match(&lsmdata, rule->lsm[i].type,
+ rc = ima_filter_rule_match(blob, rule->lsm[i].type,
Audit_equal,
rule->lsm[i].rule);
break;
@@ -671,7 +670,7 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
* @inode: pointer to an inode for which the policy decision is being made
* @cred: pointer to a credentials structure for which the policy decision is
* being made
- * @secid: LSM secid of the task to be validated
+ * @blob: LSM data of the task to be validated
* @func: IMA hook identifier
* @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
* @pcr: set the pcr to extend
@@ -686,8 +685,8 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
* than writes so ima_match_policy() is classical RCU candidate.
*/
int ima_match_policy(struct user_namespace *mnt_userns, struct inode *inode,
- const struct cred *cred, u32 secid, enum ima_hooks func,
- int mask, int flags, int *pcr,
+ const struct cred *cred, struct lsmblob *blob,
+ enum ima_hooks func, int mask, int flags, int *pcr,
struct ima_template_desc **template_desc,
const char *func_data)
{
@@ -703,7 +702,7 @@ int ima_match_policy(struct user_namespace *mnt_userns, struct inode *inode,
if (!(entry->action & actmask))
continue;
- if (!ima_match_rules(entry, mnt_userns, inode, cred, secid,
+ if (!ima_match_rules(entry, mnt_userns, inode, cred, blob,
func, mask, func_data))
continue;
--
2.29.2
--
Linux-audit mailing list
Linux-audit@redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2021-05-13 20:22 UTC|newest]
Thread overview: 111+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20210513200807.15910-1-casey.ref@schaufler-ca.com>
2021-05-13 20:07 ` [PATCH v26 00/25] LSM: Module stacking for AppArmor Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-13 20:07 ` [PATCH v26 01/25] LSM: Infrastructure management of the sock security Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-13 20:07 ` [PATCH v26 02/25] LSM: Add the lsmblob data structure Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-22 8:39 ` Mickaël Salaün
2021-05-22 8:39 ` Mickaël Salaün
2021-05-25 23:52 ` Casey Schaufler
2021-05-25 23:52 ` Casey Schaufler
2021-05-26 9:53 ` Mickaël Salaün
2021-05-26 9:53 ` Mickaël Salaün
2021-05-13 20:07 ` [PATCH v26 03/25] LSM: provide lsm name and id slot mappings Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-14 19:00 ` Kees Cook
2021-05-14 19:00 ` Kees Cook
2021-05-21 20:18 ` Paul Moore
2021-05-21 20:18 ` Paul Moore
2021-05-13 20:07 ` [PATCH v26 04/25] IMA: avoid label collisions with stacked LSMs Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-14 19:00 ` Kees Cook
2021-05-14 19:00 ` Kees Cook
2021-05-13 20:07 ` [PATCH v26 05/25] LSM: Use lsmblob in security_audit_rule_match Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-13 20:07 ` [PATCH v26 06/25] LSM: Use lsmblob in security_kernel_act_as Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-13 20:07 ` [PATCH v26 07/25] LSM: Use lsmblob in security_secctx_to_secid Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-14 19:03 ` Kees Cook
2021-05-14 19:03 ` Kees Cook
2021-05-21 20:18 ` Paul Moore
2021-05-21 20:18 ` Paul Moore
2021-05-13 20:07 ` [PATCH v26 08/25] LSM: Use lsmblob in security_secid_to_secctx Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-14 19:05 ` Kees Cook
2021-05-14 19:05 ` Kees Cook
2021-05-21 20:18 ` Paul Moore
2021-05-21 20:18 ` Paul Moore
2021-05-13 20:07 ` [PATCH v26 09/25] LSM: Use lsmblob in security_ipc_getsecid Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-13 20:07 ` [PATCH v26 10/25] LSM: Use lsmblob in security_task_getsecid Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-13 20:07 ` [PATCH v26 11/25] LSM: Use lsmblob in security_inode_getsecid Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-13 20:07 ` [PATCH v26 12/25] LSM: Use lsmblob in security_cred_getsecid Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler [this message]
2021-05-13 20:07 ` [PATCH v26 13/25] IMA: Change internal interfaces to use lsmblobs Casey Schaufler
2021-05-13 20:07 ` [PATCH v26 14/25] LSM: Specify which LSM to display Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-14 19:23 ` Kees Cook
2021-05-14 19:23 ` Kees Cook
2021-05-17 19:52 ` Casey Schaufler
2021-05-17 19:52 ` Casey Schaufler
2021-05-21 20:19 ` Paul Moore
2021-05-21 20:19 ` Paul Moore
2021-05-13 20:07 ` [PATCH v26 15/25] LSM: Ensure the correct LSM context releaser Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-21 20:19 ` Paul Moore
2021-05-21 20:19 ` Paul Moore
2021-05-13 20:07 ` [PATCH v26 16/25] LSM: Use lsmcontext in security_secid_to_secctx Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-13 20:07 ` [PATCH v26 17/25] LSM: Use lsmcontext in security_inode_getsecctx Casey Schaufler
2021-05-13 20:07 ` Casey Schaufler
2021-05-14 19:24 ` Kees Cook
2021-05-14 19:24 ` Kees Cook
2021-05-13 20:08 ` [PATCH v26 18/25] LSM: security_secid_to_secctx in netlink netfilter Casey Schaufler
2021-05-13 20:08 ` Casey Schaufler
2021-05-21 20:19 ` Paul Moore
2021-05-21 20:19 ` Paul Moore
2021-05-13 20:08 ` [PATCH v26 19/25] NET: Store LSM netlabel data in a lsmblob Casey Schaufler
2021-05-13 20:08 ` Casey Schaufler
2021-05-13 20:08 ` [PATCH v26 20/25] LSM: Verify LSM display sanity in binder Casey Schaufler
2021-05-13 20:08 ` Casey Schaufler
2021-05-13 20:08 ` [PATCH v26 21/25] audit: add support for non-syscall auxiliary records Casey Schaufler
2021-05-13 20:08 ` Casey Schaufler
2021-05-21 20:19 ` Paul Moore
2021-05-21 20:19 ` Paul Moore
2021-05-13 20:08 ` [PATCH v26 22/25] Audit: Add new record for multiple process LSM attributes Casey Schaufler
2021-05-13 20:08 ` Casey Schaufler
2021-05-21 20:19 ` Paul Moore
2021-05-21 20:19 ` Paul Moore
2021-05-21 21:26 ` Richard Guy Briggs
2021-05-21 21:26 ` Richard Guy Briggs
2021-05-21 22:05 ` Casey Schaufler
2021-05-21 22:05 ` Casey Schaufler
2021-05-22 2:20 ` Paul Moore
2021-05-22 2:20 ` Paul Moore
2021-05-22 12:58 ` Richard Guy Briggs
2021-05-22 12:58 ` Richard Guy Briggs
2021-05-23 2:00 ` Steve Grubb
2021-05-24 15:53 ` Casey Schaufler
2021-05-24 16:06 ` Steve Grubb
2021-05-25 16:26 ` Casey Schaufler
2021-05-25 16:26 ` Casey Schaufler
2021-05-25 17:28 ` Casey Schaufler
2021-05-25 17:28 ` Casey Schaufler
2021-05-25 18:23 ` Richard Guy Briggs
2021-05-25 18:23 ` Richard Guy Briggs
2021-05-25 19:06 ` Casey Schaufler
2021-05-25 19:06 ` Casey Schaufler
2021-05-25 20:08 ` Richard Guy Briggs
2021-05-25 20:08 ` Richard Guy Briggs
2021-05-25 22:46 ` Casey Schaufler
2021-05-25 22:46 ` Casey Schaufler
2021-05-13 20:08 ` [PATCH v26 23/25] Audit: Add a new record for multiple object " Casey Schaufler
2021-05-13 20:08 ` Casey Schaufler
2021-05-13 20:08 ` [PATCH v26 24/25] LSM: Add /proc attr entry for full LSM context Casey Schaufler
2021-05-13 20:08 ` Casey Schaufler
2021-05-13 20:08 ` [PATCH v26 25/25] AppArmor: Remove the exclusive flag Casey Schaufler
2021-05-13 20:08 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210513200807.15910-14-casey@schaufler-ca.com \
--to=casey@schaufler-ca.com \
--cc=casey.schaufler@intel.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=keescook@chromium.org \
--cc=linux-audit@redhat.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.