From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750912AbdDZQLn (ORCPT ); Wed, 26 Apr 2017 12:11:43 -0400 Received: from nm27-vm3.bullet.mail.ne1.yahoo.com ([98.138.91.157]:50170 "EHLO nm27-vm3.bullet.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750814AbdDZQLd (ORCPT ); Wed, 26 Apr 2017 12:11:33 -0400 X-Yahoo-Newman-Id: 742419.62853.bm@smtp210.mail.ne1.yahoo.com X-Yahoo-Newman-Property: ymail-3 X-YMail-OSG: 4p0X9yMVM1keedl7ZIeNWY_TRSelmb2AdVY0gB8joamo7bD 4VG7VpWqws4I199JrBBl4NdSqxZQ4vAauQU8ijWbkcB3hdnBt1njCrsPX5d3 C2EFRUqIYg_M7cF5bSRvvIza6o8T5.HCrDCLuP8TnU3sa_B0Eb5kd4Etx4eB DifYf1nVdhjmRcK.gv3B94kq1fJJHrJFV15d.jTwDalHm9PEpcZ1Irvfn57J Cea_Rny9BpZN1uMk_smjhqatIONMZVe3Dv8ub53C95R4d6IcsZIFUGZbaqyA KvwrIUzwSgvsHTSL1LvcdBcODavqU6y37B0OAOemdyk7uiQDlVOrHHEnp7yB NSoi9p.BR5nS19UzUBpl36nFFQylS4nxcAAyLlHKShtaeolinp3Oc.UKCDFJ SVIKYZGUQpzWPZ8ZnZSNBIvzNBfXoWbiNCoTbAgwX0PgUF88ccDlasx_4Hfa bTPtOuPsMKlNe2qsIuOckR1SZKb3dbxVPF9Es_A5ZZnZ5o5aiz7l7HT9SiWw ahYl05e6OohktertSq.dhJDhsA9xcAbgvHG.krgvi16YQYnV_PL_l7.qlAOa sCg-- X-Yahoo-SMTP: OIJXglSswBDfgLtXluJ6wiAYv6_cnw-- Subject: Re: [PATCH 1/3] selinux: Implement LSM notification system To: Daniel Jurgens , Sebastien Buisson , "linux-security-module@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "selinux@tycho.nsa.gov" References: <1493218936-18522-1-git-send-email-sbuisson@ddn.com> <8d4c5ab6-8c15-312a-398b-c3ee9d7e8cb6@schaufler-ca.com> Cc: "serge@hallyn.com" , "james.l.morris@oracle.com" , "eparis@parisplace.org" , "sds@tycho.nsa.gov" , "paul@paul-moore.com" , Sebastien Buisson From: Casey Schaufler Message-ID: <09a9df45-5c9b-aa7c-4b56-088278ac23f6@schaufler-ca.com> Date: Wed, 26 Apr 2017 09:11:26 -0700 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.8.0 MIME-Version: 1.0 In-Reply-To: Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 4/26/2017 8:48 AM, Daniel Jurgens wrote: > On 4/26/2017 10:38 AM, Casey Schaufler wrote: >> On 4/26/2017 8:02 AM, Sebastien Buisson wrote: >>> From: Daniel Jurgens >>> >>> Add a generic notification mechanism in the LSM. Interested consumers >>> can register a callback with the LSM and security modules can produce >>> events. >> Why is this a generic mechanism? Do you ever see anyone >> other than SELinux using it? > I had created an SELinux specific mechanism, Paul Moore requested I make it generic. >>> Add a call to the notification mechanism from SELinux when the AVC >>> cache changes. >> This seems like a whole lot of mechanism for >> something you could accomplish with a log message. >> What am I missing? > This was part of a larger patch set that hasn't been accepted yet. SELinux support for Inifiniband. Subsequent patches in that patch set will use it as well. You should include this information in a 0/3 message. Without the context the patch set is curious, but not compelling. >>> Signed-off-by: Daniel Jurgens >>> Signed-off-by: Sebastien Buisson >>> --- >>> include/linux/security.h | 23 +++++++++++++++++++++++ >>> security/security.c | 20 ++++++++++++++++++++ >>> security/selinux/hooks.c | 12 ++++++++++++ >>> 3 files changed, 55 insertions(+) >>> >>> diff --git a/include/linux/security.h b/include/linux/security.h >>> index af675b5..73a9c93 100644 >>> --- a/include/linux/security.h >>> +++ b/include/linux/security.h >>> @@ -68,6 +68,10 @@ >>> struct user_namespace; >>> struct timezone; >>> >>> +enum lsm_event { >>> + LSM_POLICY_CHANGE, >>> +}; >>> + >>> /* These functions are in security/commoncap.c */ >>> extern int cap_capable(const struct cred *cred, struct user_namespace *ns, >>> int cap, int audit); >>> @@ -163,6 +167,10 @@ struct security_mnt_opts { >>> int num_mnt_opts; >>> }; >>> >>> +int call_lsm_notifier(enum lsm_event event, void *data); >>> +int register_lsm_notifier(struct notifier_block *nb); >>> +int unregister_lsm_notifier(struct notifier_block *nb); >>> + >>> static inline void security_init_mnt_opts(struct security_mnt_opts *opts) >>> { >>> opts->mnt_opts = NULL; >>> @@ -381,6 +389,21 @@ int security_sem_semop(struct sem_array *sma, struct sembuf *sops, >>> struct security_mnt_opts { >>> }; >>> >>> +static inline int call_lsm_notifier(enum lsm_event event, void *data) >>> +{ >>> + return 0; >>> +} >>> + >>> +static inline int register_lsm_notifier(struct notifier_block *nb) >>> +{ >>> + return 0; >>> +} >>> + >>> +static inline int unregister_lsm_notifier(struct notifier_block *nb) >>> +{ >>> + return 0; >>> +} >>> + >>> static inline void security_init_mnt_opts(struct security_mnt_opts *opts) >>> { >>> } >>> diff --git a/security/security.c b/security/security.c >>> index b9fea39..ef9d9e1 100644 >>> --- a/security/security.c >>> +++ b/security/security.c >>> @@ -32,6 +32,8 @@ >>> /* Maximum number of letters for an LSM name string */ >>> #define SECURITY_NAME_MAX 10 >>> >>> +static ATOMIC_NOTIFIER_HEAD(lsm_notifier_chain); >>> + >>> struct security_hook_heads security_hook_heads __lsm_ro_after_init; >>> char *lsm_names; >>> /* Boot-time LSM user choice */ >>> @@ -146,6 +148,24 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, >>> panic("%s - Cannot get early memory.\n", __func__); >>> } >>> >>> +int call_lsm_notifier(enum lsm_event event, void *data) >>> +{ >>> + return atomic_notifier_call_chain(&lsm_notifier_chain, event, data); >>> +} >>> +EXPORT_SYMBOL(call_lsm_notifier); >>> + >>> +int register_lsm_notifier(struct notifier_block *nb) >>> +{ >>> + return atomic_notifier_chain_register(&lsm_notifier_chain, nb); >>> +} >>> +EXPORT_SYMBOL(register_lsm_notifier); >>> + >>> +int unregister_lsm_notifier(struct notifier_block *nb) >>> +{ >>> + return atomic_notifier_chain_unregister(&lsm_notifier_chain, nb); >>> +} >>> +EXPORT_SYMBOL(unregister_lsm_notifier); >>> + >>> /* >>> * Hook list operation macros. >>> * >>> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c >>> index e67a526..a4d36f8 100644 >>> --- a/security/selinux/hooks.c >>> +++ b/security/selinux/hooks.c >>> @@ -171,6 +171,14 @@ static int selinux_netcache_avc_callback(u32 event) >>> return 0; >>> } >>> >>> +static int selinux_lsm_notifier_avc_callback(u32 event) >>> +{ >>> + if (event == AVC_CALLBACK_RESET) >>> + call_lsm_notifier(LSM_POLICY_CHANGE, NULL); >>> + >>> + return 0; >>> +} >>> + >>> /* >>> * initialise the security for the init task >>> */ >>> @@ -6379,6 +6387,10 @@ static __init int selinux_init(void) >>> if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET)) >>> panic("SELinux: Unable to register AVC netcache callback\n"); >>> >>> + if (avc_add_callback(selinux_lsm_notifier_avc_callback, >>> + AVC_CALLBACK_RESET)) >>> + panic("SELinux: Unable to register AVC LSM notifier callback\n"); >>> + >>> if (selinux_enforcing) >>> printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n"); >>> else >