From: Sebastien Buisson <sbuisson.ddn@gmail.com> To: linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, selinux@tycho.nsa.gov Cc: serge@hallyn.com, james.l.morris@oracle.com, eparis@parisplace.org, sds@tycho.nsa.gov, paul@paul-moore.com, danielj@mellanox.com, Sebastien Buisson <sbuisson@ddn.com> Subject: [PATCH 3/3] selinux: expose policy SHA256 checksum via selinuxfs Date: Thu, 27 Apr 2017 00:02:16 +0900 [thread overview] Message-ID: <1493218936-18522-3-git-send-email-sbuisson@ddn.com> (raw) In-Reply-To: <1493218936-18522-1-git-send-email-sbuisson@ddn.com> Expose policy SHA256 checksum via selinuxfs. Signed-off-by: Sebastien Buisson <sbuisson@ddn.com> --- security/selinux/selinuxfs.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index ce71718..b2d5deb 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -30,6 +30,7 @@ #include <linux/uaccess.h> #include <linux/kobject.h> #include <linux/ctype.h> +#include <crypto/sha.h> /* selinuxfs pseudo filesystem for exporting the security policy API. Based on the proc code and the fs/nfsd/nfsctl.c code. */ @@ -99,6 +100,7 @@ enum sel_inos { SEL_STATUS, /* export current status using mmap() */ SEL_POLICY, /* allow userspace to read the in kernel policy */ SEL_VALIDATE_TRANS, /* compute validatetrans decision */ + SEL_POLICYCKSUM,/* return policy SHA256 checkum */ SEL_INO_NEXT, /* The next inode number to use */ }; @@ -313,6 +315,22 @@ static ssize_t sel_read_policyvers(struct file *filp, char __user *buf, .llseek = generic_file_llseek, }; +static ssize_t sel_read_policycksum(struct file *filp, char __user *buf, + size_t count, loff_t *ppos) +{ + size_t tmpbuflen = SHA256_DIGEST_SIZE*2 + 1; + char tmpbuf[tmpbuflen]; + ssize_t length; + + length = security_policydb_cksum(tmpbuf, tmpbuflen); + return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); +} + +static const struct file_operations sel_policycksum_ops = { + .read = sel_read_policycksum, + .llseek = generic_file_llseek, +}; + /* declaration for sel_write_load */ static int sel_make_bools(void); static int sel_make_classes(void); @@ -1825,6 +1843,8 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent) [SEL_POLICY] = {"policy", &sel_policy_ops, S_IRUGO}, [SEL_VALIDATE_TRANS] = {"validatetrans", &sel_transition_ops, S_IWUGO}, + [SEL_POLICYCKSUM] = {"policycksum", &sel_policycksum_ops, + S_IRUGO}, /* last one */ {""} }; ret = simple_fill_super(sb, SELINUX_MAGIC, selinux_files); -- 1.8.3.1
WARNING: multiple messages have this Message-ID (diff)
From: sbuisson.ddn@gmail.com (Sebastien Buisson) To: linux-security-module@vger.kernel.org Subject: [PATCH 3/3] selinux: expose policy SHA256 checksum via selinuxfs Date: Thu, 27 Apr 2017 00:02:16 +0900 [thread overview] Message-ID: <1493218936-18522-3-git-send-email-sbuisson@ddn.com> (raw) In-Reply-To: <1493218936-18522-1-git-send-email-sbuisson@ddn.com> Expose policy SHA256 checksum via selinuxfs. Signed-off-by: Sebastien Buisson <sbuisson@ddn.com> --- security/selinux/selinuxfs.c | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c index ce71718..b2d5deb 100644 --- a/security/selinux/selinuxfs.c +++ b/security/selinux/selinuxfs.c @@ -30,6 +30,7 @@ #include <linux/uaccess.h> #include <linux/kobject.h> #include <linux/ctype.h> +#include <crypto/sha.h> /* selinuxfs pseudo filesystem for exporting the security policy API. Based on the proc code and the fs/nfsd/nfsctl.c code. */ @@ -99,6 +100,7 @@ enum sel_inos { SEL_STATUS, /* export current status using mmap() */ SEL_POLICY, /* allow userspace to read the in kernel policy */ SEL_VALIDATE_TRANS, /* compute validatetrans decision */ + SEL_POLICYCKSUM,/* return policy SHA256 checkum */ SEL_INO_NEXT, /* The next inode number to use */ }; @@ -313,6 +315,22 @@ static ssize_t sel_read_policyvers(struct file *filp, char __user *buf, .llseek = generic_file_llseek, }; +static ssize_t sel_read_policycksum(struct file *filp, char __user *buf, + size_t count, loff_t *ppos) +{ + size_t tmpbuflen = SHA256_DIGEST_SIZE*2 + 1; + char tmpbuf[tmpbuflen]; + ssize_t length; + + length = security_policydb_cksum(tmpbuf, tmpbuflen); + return simple_read_from_buffer(buf, count, ppos, tmpbuf, length); +} + +static const struct file_operations sel_policycksum_ops = { + .read = sel_read_policycksum, + .llseek = generic_file_llseek, +}; + /* declaration for sel_write_load */ static int sel_make_bools(void); static int sel_make_classes(void); @@ -1825,6 +1843,8 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent) [SEL_POLICY] = {"policy", &sel_policy_ops, S_IRUGO}, [SEL_VALIDATE_TRANS] = {"validatetrans", &sel_transition_ops, S_IWUGO}, + [SEL_POLICYCKSUM] = {"policycksum", &sel_policycksum_ops, + S_IRUGO}, /* last one */ {""} }; ret = simple_fill_super(sb, SELINUX_MAGIC, selinux_files); -- 1.8.3.1 -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2017-04-26 15:17 UTC|newest] Thread overview: 43+ messages / expand[flat|nested] mbox.gz Atom feed top 2017-04-26 15:02 [PATCH 1/3] selinux: Implement LSM notification system Sebastien Buisson 2017-04-26 15:02 ` Sebastien Buisson 2017-04-26 15:02 ` [PATCH 2/3] selinux: add checksum to policydb Sebastien Buisson 2017-04-26 15:02 ` Sebastien Buisson 2017-04-26 18:30 ` Stephen Smalley 2017-04-26 18:30 ` Stephen Smalley 2017-04-27 8:41 ` Sebastien Buisson 2017-04-27 8:41 ` Sebastien Buisson 2017-04-27 15:18 ` Stephen Smalley 2017-04-27 15:18 ` Stephen Smalley 2017-04-27 17:12 ` Sebastien Buisson 2017-04-27 17:12 ` Sebastien Buisson 2017-04-27 18:47 ` Stephen Smalley 2017-04-27 18:47 ` Stephen Smalley 2017-04-28 15:16 ` Sebastien Buisson 2017-04-28 15:16 ` Sebastien Buisson 2017-04-28 15:50 ` Stephen Smalley 2017-04-28 15:50 ` Stephen Smalley 2017-04-28 16:08 ` Sebastien Buisson 2017-04-28 16:08 ` Sebastien Buisson 2017-04-28 16:38 ` Stephen Smalley 2017-04-28 16:38 ` Stephen Smalley 2017-04-26 15:02 ` Sebastien Buisson [this message] 2017-04-26 15:02 ` [PATCH 3/3] selinux: expose policy SHA256 checksum via selinuxfs Sebastien Buisson 2017-04-26 18:31 ` Stephen Smalley 2017-04-26 18:31 ` Stephen Smalley 2017-04-27 1:08 ` James Morris 2017-04-27 1:08 ` James Morris 2017-04-26 15:38 ` [PATCH 1/3] selinux: Implement LSM notification system Casey Schaufler 2017-04-26 15:38 ` Casey Schaufler 2017-04-26 15:48 ` Daniel Jurgens 2017-04-26 15:48 ` Daniel Jurgens 2017-04-26 15:48 ` Daniel Jurgens 2017-04-26 15:57 ` Sebastien Buisson 2017-04-26 15:57 ` Sebastien Buisson 2017-04-26 15:57 ` Sebastien Buisson 2017-04-26 16:11 ` Casey Schaufler 2017-04-26 16:11 ` Casey Schaufler 2017-04-26 16:11 ` Casey Schaufler 2017-04-26 17:36 ` Stephen Smalley 2017-04-26 17:36 ` Stephen Smalley 2017-04-26 17:47 ` Casey Schaufler 2017-04-26 17:47 ` Casey Schaufler
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1493218936-18522-3-git-send-email-sbuisson@ddn.com \ --to=sbuisson.ddn@gmail.com \ --cc=danielj@mellanox.com \ --cc=eparis@parisplace.org \ --cc=james.l.morris@oracle.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=paul@paul-moore.com \ --cc=sbuisson@ddn.com \ --cc=sds@tycho.nsa.gov \ --cc=selinux@tycho.nsa.gov \ --cc=serge@hallyn.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.