From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1437822AbdDZPR3 (ORCPT ); Wed, 26 Apr 2017 11:17:29 -0400 Received: from mail-pf0-f195.google.com ([209.85.192.195]:35756 "EHLO mail-pf0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1437729AbdDZPIf (ORCPT ); Wed, 26 Apr 2017 11:08:35 -0400 From: Sebastien Buisson X-Google-Original-From: Sebastien Buisson To: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, selinux@tycho.nsa.gov Cc: serge@hallyn.com, james.l.morris@oracle.com, eparis@parisplace.org, sds@tycho.nsa.gov, paul@paul-moore.com, danielj@mellanox.com, Sebastien Buisson Subject: [PATCH 1/3] selinux: Implement LSM notification system Date: Thu, 27 Apr 2017 00:02:14 +0900 Message-Id: <1493218936-18522-1-git-send-email-sbuisson@ddn.com> X-Mailer: git-send-email 1.8.3.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Daniel Jurgens Add a generic notification mechanism in the LSM. Interested consumers can register a callback with the LSM and security modules can produce events. Add a call to the notification mechanism from SELinux when the AVC cache changes. Signed-off-by: Daniel Jurgens Signed-off-by: Sebastien Buisson --- include/linux/security.h | 23 +++++++++++++++++++++++ security/security.c | 20 ++++++++++++++++++++ security/selinux/hooks.c | 12 ++++++++++++ 3 files changed, 55 insertions(+) diff --git a/include/linux/security.h b/include/linux/security.h index af675b5..73a9c93 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -68,6 +68,10 @@ struct user_namespace; struct timezone; +enum lsm_event { + LSM_POLICY_CHANGE, +}; + /* These functions are in security/commoncap.c */ extern int cap_capable(const struct cred *cred, struct user_namespace *ns, int cap, int audit); @@ -163,6 +167,10 @@ struct security_mnt_opts { int num_mnt_opts; }; +int call_lsm_notifier(enum lsm_event event, void *data); +int register_lsm_notifier(struct notifier_block *nb); +int unregister_lsm_notifier(struct notifier_block *nb); + static inline void security_init_mnt_opts(struct security_mnt_opts *opts) { opts->mnt_opts = NULL; @@ -381,6 +389,21 @@ int security_sem_semop(struct sem_array *sma, struct sembuf *sops, struct security_mnt_opts { }; +static inline int call_lsm_notifier(enum lsm_event event, void *data) +{ + return 0; +} + +static inline int register_lsm_notifier(struct notifier_block *nb) +{ + return 0; +} + +static inline int unregister_lsm_notifier(struct notifier_block *nb) +{ + return 0; +} + static inline void security_init_mnt_opts(struct security_mnt_opts *opts) { } diff --git a/security/security.c b/security/security.c index b9fea39..ef9d9e1 100644 --- a/security/security.c +++ b/security/security.c @@ -32,6 +32,8 @@ /* Maximum number of letters for an LSM name string */ #define SECURITY_NAME_MAX 10 +static ATOMIC_NOTIFIER_HEAD(lsm_notifier_chain); + struct security_hook_heads security_hook_heads __lsm_ro_after_init; char *lsm_names; /* Boot-time LSM user choice */ @@ -146,6 +148,24 @@ void __init security_add_hooks(struct security_hook_list *hooks, int count, panic("%s - Cannot get early memory.\n", __func__); } +int call_lsm_notifier(enum lsm_event event, void *data) +{ + return atomic_notifier_call_chain(&lsm_notifier_chain, event, data); +} +EXPORT_SYMBOL(call_lsm_notifier); + +int register_lsm_notifier(struct notifier_block *nb) +{ + return atomic_notifier_chain_register(&lsm_notifier_chain, nb); +} +EXPORT_SYMBOL(register_lsm_notifier); + +int unregister_lsm_notifier(struct notifier_block *nb) +{ + return atomic_notifier_chain_unregister(&lsm_notifier_chain, nb); +} +EXPORT_SYMBOL(unregister_lsm_notifier); + /* * Hook list operation macros. * diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index e67a526..a4d36f8 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -171,6 +171,14 @@ static int selinux_netcache_avc_callback(u32 event) return 0; } +static int selinux_lsm_notifier_avc_callback(u32 event) +{ + if (event == AVC_CALLBACK_RESET) + call_lsm_notifier(LSM_POLICY_CHANGE, NULL); + + return 0; +} + /* * initialise the security for the init task */ @@ -6379,6 +6387,10 @@ static __init int selinux_init(void) if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET)) panic("SELinux: Unable to register AVC netcache callback\n"); + if (avc_add_callback(selinux_lsm_notifier_avc_callback, + AVC_CALLBACK_RESET)) + panic("SELinux: Unable to register AVC LSM notifier callback\n"); + if (selinux_enforcing) printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n"); else -- 1.8.3.1