[PATCH v11 0/9] LSM: Multiple concurrent LSMs

* [PATCH v11 0/9] LSM: Multiple concurrent LSMs
@ 2012-12-19 18:22 Casey Schaufler
  2012-12-19 18:36 ` [PATCH v11 1/9] " Casey Schaufler
                   ` (9 more replies)
  0 siblings, 10 replies; 15+ messages in thread
From: Casey Schaufler @ 2012-12-19 18:22 UTC (permalink / raw)
  To: LSM, James Morris
  Cc: John Johansen, Eric Paris, Tetsuo Handa, Kees Cook,
	Casey Schaufler, SE Linux

Subject: [PATCH v11 0/9] LSM: Multiple concurrent LSMs

Change the infrastructure for Linux Security Modules (LSM)s
from a single vector of hook handlers to a list based method
for handling multiple concurrent modules. 

A level of indirection has been introduced in the handling of
security blobs. LSMs no longer access ->security fields directly,
instead they use an abstraction provided by lsm_[gs]et field
functions. 

The XFRM hooks are only used by SELinux and it is not clear
that they can be shared. The First LSM that registers using
those hooks gets to use them. Any subsequent LSM that uses
those hooks is denied registration. 

Secids have not been made shareable. Only one LSM that uses
secids (SELinux and Smack) can be used at a time. The first
to register wins.

The "security=" boot option takes a comma separated list of
LSMs, registering them in the order presented. The LSM hooks
will be executed in the order registered. Hooks that return
errors are not short circuited. All hooks are called even
if one of the LSM hooks fails. The result returned will be
that of the last LSM hook that failed.

Some hooks don't fit that model. setprocattr, getprocattr,
and a few others are special cased. All behavior from
security/capability.c has been moved into the hook handling.
The security/commoncap functions used to get called from
the LSM specific code. The handling of the capability
functions has been moved out of the LSMs and into the
hook handling.

The /proc/*/attr interfaces are given to one LSM. This
can be done by setting CONFIG_SECURITY_PRESENT. Additional
interfaces have been created in /proc/*/attr so that
each LSM has its own named interfaces.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>

---
 fs/proc/base.c                      |   28 +-
 include/linux/lsm.h                 |  174 ++++
 include/linux/security.h            |  254 +++++-
 security/Kconfig                    |   79 +-
 security/Makefile                   |    3 +-
 security/apparmor/context.c         |   10 +-
 security/apparmor/domain.c          |   19 +-
 security/apparmor/include/context.h |   13 +-
 security/apparmor/lsm.c             |   66 +-
 security/capability.c               | 1075 -------------------------
 security/commoncap.c                |    6 -
 security/inode.c                    |   78 +-
 security/security.c                 | 1481 ++++++++++++++++++++++++++++-------
 security/selinux/hooks.c            |  410 +++++-----
 security/selinux/include/objsec.h   |    2 +
 security/selinux/include/xfrm.h     |    2 +-
 security/selinux/netlabel.c         |   13 +-
 security/selinux/selinuxfs.c        |    6 +-
 security/selinux/xfrm.c             |    9 +-
 security/smack/smack.h              |   14 +-
 security/smack/smack_access.c       |    2 +-
 security/smack/smack_lsm.c          |  367 ++++-----
 security/smack/smackfs.c            |   16 +-
 security/tomoyo/common.h            |    6 +-
 security/tomoyo/domain.c            |    2 +-
 security/tomoyo/securityfs_if.c     |    9 +-
 security/tomoyo/tomoyo.c            |   47 +-
 security/yama/Kconfig               |    7 -
 security/yama/yama_lsm.c            |   33 +-
 29 files changed, 2213 insertions(+), 2018 deletions(-)

--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to majordomo@tycho.nsa.gov with
the words "unsubscribe selinux" without quotes as the message.

^ permalink raw reply	[flat|nested] 15+ messages in thread