From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, jmorris@namei.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: casey@schaufler-ca.com, linux-audit@redhat.com,
keescook@chromium.org, john.johansen@canonical.com,
penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com,
sds@tycho.nsa.gov, linux-kernel@vger.kernel.org,
linux-integrity@vger.kernel.org
Subject: [PATCH v23 11/23] IMA: Change internal interfaces to use lsmblobs
Date: Fri, 20 Nov 2020 12:14:55 -0800 [thread overview]
Message-ID: <20201120201507.11993-12-casey@schaufler-ca.com> (raw)
In-Reply-To: <20201120201507.11993-1-casey@schaufler-ca.com>
The IMA interfaces ima_get_action() and ima_match_policy()
call LSM functions that use lsmblobs. Change the IMA functions
to pass the lsmblob to be compatible with the LSM functions.
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Cc: linux-integrity@vger.kernel.org
To: Mimi Zohar <zohar@linux.ibm.com>
---
security/integrity/ima/ima.h | 11 ++++----
security/integrity/ima/ima_api.c | 10 +++----
security/integrity/ima/ima_appraise.c | 6 ++---
security/integrity/ima/ima_main.c | 38 +++++++++++----------------
security/integrity/ima/ima_policy.c | 16 +++++------
5 files changed, 36 insertions(+), 45 deletions(-)
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 6bae2ee9b251..8812e9b9fc1d 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -252,9 +252,9 @@ static inline void ima_process_queued_keys(void) {}
#endif /* CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS */
/* LIM API function definitions */
-int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid,
- int mask, enum ima_hooks func, int *pcr,
- struct ima_template_desc **template_desc,
+int ima_get_action(struct inode *inode, const struct cred *cred,
+ struct lsmblob *blob, int mask, enum ima_hooks func,
+ int *pcr, struct ima_template_desc **template_desc,
const char *keyring);
int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);
int ima_collect_measurement(struct integrity_iint_cache *iint,
@@ -280,8 +280,9 @@ void ima_free_template_entry(struct ima_template_entry *entry);
const char *ima_d_path(const struct path *path, char **pathbuf, char *filename);
/* IMA policy related functions */
-int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
- enum ima_hooks func, int mask, int flags, int *pcr,
+int ima_match_policy(struct inode *inode, const struct cred *cred,
+ struct lsmblob *blob, enum ima_hooks func, int mask,
+ int flags, int *pcr,
struct ima_template_desc **template_desc,
const char *keyring);
void ima_init_policy(void);
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 4f39fb93f278..e83fa1c32843 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -164,7 +164,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
* ima_get_action - appraise & measure decision based on policy.
* @inode: pointer to the inode associated with the object being validated
* @cred: pointer to credentials structure to validate
- * @secid: secid of the task being validated
+ * @blob: LSM data of the task being validated
* @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC,
* MAY_APPEND)
* @func: caller identifier
@@ -183,16 +183,16 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
* Returns IMA_MEASURE, IMA_APPRAISE mask.
*
*/
-int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid,
- int mask, enum ima_hooks func, int *pcr,
- struct ima_template_desc **template_desc,
+int ima_get_action(struct inode *inode, const struct cred *cred,
+ struct lsmblob *blob, int mask, enum ima_hooks func,
+ int *pcr, struct ima_template_desc **template_desc,
const char *keyring)
{
int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE | IMA_HASH;
flags &= ima_policy_flag;
- return ima_match_policy(inode, cred, secid, func, mask, flags, pcr,
+ return ima_match_policy(inode, cred, blob, func, mask, flags, pcr,
template_desc, keyring);
}
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 2a18124af429..7c4e43399269 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -71,10 +71,8 @@ int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func)
return 0;
security_task_getsecid(current, &blob);
- /* scaffolding the .secid[0] */
- return ima_match_policy(inode, current_cred(), blob.secid[0], func,
- mask, IMA_APPRAISE | IMA_HASH, NULL, NULL,
- NULL);
+ return ima_match_policy(inode, current_cred(), &blob, func, mask,
+ IMA_APPRAISE | IMA_HASH, NULL, NULL, NULL);
}
static int ima_fix_xattr(struct dentry *dentry,
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index e2fd092a1023..39ca17586c6c 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -194,8 +194,8 @@ void ima_file_free(struct file *file)
}
static int process_measurement(struct file *file, const struct cred *cred,
- u32 secid, char *buf, loff_t size, int mask,
- enum ima_hooks func)
+ struct lsmblob *blob, char *buf, loff_t size,
+ int mask, enum ima_hooks func)
{
struct inode *inode = file_inode(file);
struct integrity_iint_cache *iint = NULL;
@@ -218,7 +218,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
* bitmask based on the appraise/audit/measurement policy.
* Included is the appraise submask.
*/
- action = ima_get_action(inode, cred, secid, mask, func, &pcr,
+ action = ima_get_action(inode, cred, blob, mask, func, &pcr,
&template_desc, NULL);
violation_check = ((func == FILE_CHECK || func == MMAP_CHECK) &&
(ima_policy_flag & IMA_MEASURE));
@@ -392,8 +392,7 @@ int ima_file_mmap(struct file *file, unsigned long prot)
if (file && (prot & PROT_EXEC)) {
security_task_getsecid(current, &blob);
- /* scaffolding - until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0],
+ return process_measurement(file, current_cred(), &blob,
NULL, 0, MAY_EXEC, MMAP_CHECK);
}
@@ -432,8 +431,7 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
security_task_getsecid(current, &blob);
inode = file_inode(vma->vm_file);
- /* scaffolding */
- action = ima_get_action(NULL, current_cred(), blob.secid[0], 0,
+ action = ima_get_action(NULL, current_cred(), &blob, 0,
MMAP_CHECK, &pcr, &template, 0);
/* Is the mmap'ed file in policy? */
@@ -472,16 +470,14 @@ int ima_bprm_check(struct linux_binprm *bprm)
struct lsmblob blob;
security_task_getsecid(current, &blob);
- /* scaffolding until process_measurement changes */
- ret = process_measurement(bprm->file, current_cred(), blob.secid[0],
- NULL, 0, MAY_EXEC, BPRM_CHECK);
+ ret = process_measurement(bprm->file, current_cred(), &blob, NULL, 0,
+ MAY_EXEC, BPRM_CHECK);
if (ret)
return ret;
security_cred_getsecid(bprm->cred, &blob);
- /* scaffolding until process_measurement changes */
- return process_measurement(bprm->file, bprm->cred, blob.secid[0],
- NULL, 0, MAY_EXEC, CREDS_CHECK);
+ return process_measurement(bprm->file, bprm->cred, &blob, NULL, 0,
+ MAY_EXEC, CREDS_CHECK);
}
/**
@@ -499,8 +495,7 @@ int ima_file_check(struct file *file, int mask)
struct lsmblob blob;
security_task_getsecid(current, &blob);
- /* scaffolding until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0], NULL, 0,
+ return process_measurement(file, current_cred(), &blob, NULL, 0,
mask & (MAY_READ | MAY_WRITE | MAY_EXEC |
MAY_APPEND), FILE_CHECK);
}
@@ -655,8 +650,7 @@ int ima_read_file(struct file *file, enum kernel_read_file_id read_id,
/* Read entire file for all partial reads. */
func = read_idmap[read_id] ?: FILE_CHECK;
security_task_getsecid(current, &blob);
- /* scaffolding - until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0], NULL,
+ return process_measurement(file, current_cred(), &blob, NULL,
0, MAY_READ, func);
}
@@ -699,9 +693,8 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size,
func = read_idmap[read_id] ?: FILE_CHECK;
security_task_getsecid(current, &blob);
- /* scaffolding until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0], buf,
- size, MAY_READ, func);
+ return process_measurement(file, current_cred(), &blob, buf, size,
+ MAY_READ, func);
}
/**
@@ -830,9 +823,8 @@ void process_buffer_measurement(struct inode *inode, const void *buf, int size,
*/
if (func) {
security_task_getsecid(current, &blob);
- /* scaffolding */
- action = ima_get_action(inode, current_cred(), blob.secid[0],
- 0, func, &pcr, &template, keyring);
+ action = ima_get_action(inode, current_cred(), &blob, 0, func,
+ &pcr, &template, keyring);
if (!(action & IMA_MEASURE))
return;
}
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index bbf9fa79740a..a95eb37937dd 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -508,7 +508,7 @@ static bool ima_match_keyring(struct ima_rule_entry *rule,
* @rule: a pointer to a rule
* @inode: a pointer to an inode
* @cred: a pointer to a credentials structure for user validation
- * @secid: the secid of the task to be validated
+ * @blob: the lsm data of the task to be validated
* @func: LIM hook identifier
* @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
* @keyring: keyring name to check in policy for KEY_CHECK func
@@ -516,7 +516,7 @@ static bool ima_match_keyring(struct ima_rule_entry *rule,
* Returns true on rule match, false on failure.
*/
static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
- const struct cred *cred, u32 secid,
+ const struct cred *cred, struct lsmblob *blob,
enum ima_hooks func, int mask,
const char *keyring)
{
@@ -581,8 +581,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
case LSM_SUBJ_USER:
case LSM_SUBJ_ROLE:
case LSM_SUBJ_TYPE:
- lsmblob_init(&lsmdata, secid);
- rc = ima_filter_rule_match(&lsmdata, rule->lsm[i].type,
+ rc = ima_filter_rule_match(blob, rule->lsm[i].type,
Audit_equal,
rule->lsm[i].rules);
default:
@@ -624,7 +623,7 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
* @inode: pointer to an inode for which the policy decision is being made
* @cred: pointer to a credentials structure for which the policy decision is
* being made
- * @secid: LSM secid of the task to be validated
+ * @blob: LSM data of the task to be validated
* @func: IMA hook identifier
* @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
* @pcr: set the pcr to extend
@@ -639,8 +638,9 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
* list when walking it. Reads are many orders of magnitude more numerous
* than writes so ima_match_policy() is classical RCU candidate.
*/
-int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
- enum ima_hooks func, int mask, int flags, int *pcr,
+int ima_match_policy(struct inode *inode, const struct cred *cred,
+ struct lsmblob *blob, enum ima_hooks func, int mask,
+ int flags, int *pcr,
struct ima_template_desc **template_desc,
const char *keyring)
{
@@ -656,7 +656,7 @@ int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
if (!(entry->action & actmask))
continue;
- if (!ima_match_rules(entry, inode, cred, secid, func, mask,
+ if (!ima_match_rules(entry, inode, cred, blob, func, mask,
keyring))
continue;
--
2.24.1
WARNING: multiple messages have this Message-ID (diff)
From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, jmorris@namei.org,
linux-security-module@vger.kernel.org, selinux@vger.kernel.org
Cc: john.johansen@canonical.com, linux-kernel@vger.kernel.org,
linux-audit@redhat.com, linux-integrity@vger.kernel.org,
sds@tycho.nsa.gov
Subject: [PATCH v23 11/23] IMA: Change internal interfaces to use lsmblobs
Date: Fri, 20 Nov 2020 12:14:55 -0800 [thread overview]
Message-ID: <20201120201507.11993-12-casey@schaufler-ca.com> (raw)
In-Reply-To: <20201120201507.11993-1-casey@schaufler-ca.com>
The IMA interfaces ima_get_action() and ima_match_policy()
call LSM functions that use lsmblobs. Change the IMA functions
to pass the lsmblob to be compatible with the LSM functions.
Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Cc: linux-integrity@vger.kernel.org
To: Mimi Zohar <zohar@linux.ibm.com>
---
security/integrity/ima/ima.h | 11 ++++----
security/integrity/ima/ima_api.c | 10 +++----
security/integrity/ima/ima_appraise.c | 6 ++---
security/integrity/ima/ima_main.c | 38 +++++++++++----------------
security/integrity/ima/ima_policy.c | 16 +++++------
5 files changed, 36 insertions(+), 45 deletions(-)
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index 6bae2ee9b251..8812e9b9fc1d 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -252,9 +252,9 @@ static inline void ima_process_queued_keys(void) {}
#endif /* CONFIG_IMA_QUEUE_EARLY_BOOT_KEYS */
/* LIM API function definitions */
-int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid,
- int mask, enum ima_hooks func, int *pcr,
- struct ima_template_desc **template_desc,
+int ima_get_action(struct inode *inode, const struct cred *cred,
+ struct lsmblob *blob, int mask, enum ima_hooks func,
+ int *pcr, struct ima_template_desc **template_desc,
const char *keyring);
int ima_must_measure(struct inode *inode, int mask, enum ima_hooks func);
int ima_collect_measurement(struct integrity_iint_cache *iint,
@@ -280,8 +280,9 @@ void ima_free_template_entry(struct ima_template_entry *entry);
const char *ima_d_path(const struct path *path, char **pathbuf, char *filename);
/* IMA policy related functions */
-int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
- enum ima_hooks func, int mask, int flags, int *pcr,
+int ima_match_policy(struct inode *inode, const struct cred *cred,
+ struct lsmblob *blob, enum ima_hooks func, int mask,
+ int flags, int *pcr,
struct ima_template_desc **template_desc,
const char *keyring);
void ima_init_policy(void);
diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
index 4f39fb93f278..e83fa1c32843 100644
--- a/security/integrity/ima/ima_api.c
+++ b/security/integrity/ima/ima_api.c
@@ -164,7 +164,7 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
* ima_get_action - appraise & measure decision based on policy.
* @inode: pointer to the inode associated with the object being validated
* @cred: pointer to credentials structure to validate
- * @secid: secid of the task being validated
+ * @blob: LSM data of the task being validated
* @mask: contains the permission mask (MAY_READ, MAY_WRITE, MAY_EXEC,
* MAY_APPEND)
* @func: caller identifier
@@ -183,16 +183,16 @@ void ima_add_violation(struct file *file, const unsigned char *filename,
* Returns IMA_MEASURE, IMA_APPRAISE mask.
*
*/
-int ima_get_action(struct inode *inode, const struct cred *cred, u32 secid,
- int mask, enum ima_hooks func, int *pcr,
- struct ima_template_desc **template_desc,
+int ima_get_action(struct inode *inode, const struct cred *cred,
+ struct lsmblob *blob, int mask, enum ima_hooks func,
+ int *pcr, struct ima_template_desc **template_desc,
const char *keyring)
{
int flags = IMA_MEASURE | IMA_AUDIT | IMA_APPRAISE | IMA_HASH;
flags &= ima_policy_flag;
- return ima_match_policy(inode, cred, secid, func, mask, flags, pcr,
+ return ima_match_policy(inode, cred, blob, func, mask, flags, pcr,
template_desc, keyring);
}
diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
index 2a18124af429..7c4e43399269 100644
--- a/security/integrity/ima/ima_appraise.c
+++ b/security/integrity/ima/ima_appraise.c
@@ -71,10 +71,8 @@ int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func)
return 0;
security_task_getsecid(current, &blob);
- /* scaffolding the .secid[0] */
- return ima_match_policy(inode, current_cred(), blob.secid[0], func,
- mask, IMA_APPRAISE | IMA_HASH, NULL, NULL,
- NULL);
+ return ima_match_policy(inode, current_cred(), &blob, func, mask,
+ IMA_APPRAISE | IMA_HASH, NULL, NULL, NULL);
}
static int ima_fix_xattr(struct dentry *dentry,
diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
index e2fd092a1023..39ca17586c6c 100644
--- a/security/integrity/ima/ima_main.c
+++ b/security/integrity/ima/ima_main.c
@@ -194,8 +194,8 @@ void ima_file_free(struct file *file)
}
static int process_measurement(struct file *file, const struct cred *cred,
- u32 secid, char *buf, loff_t size, int mask,
- enum ima_hooks func)
+ struct lsmblob *blob, char *buf, loff_t size,
+ int mask, enum ima_hooks func)
{
struct inode *inode = file_inode(file);
struct integrity_iint_cache *iint = NULL;
@@ -218,7 +218,7 @@ static int process_measurement(struct file *file, const struct cred *cred,
* bitmask based on the appraise/audit/measurement policy.
* Included is the appraise submask.
*/
- action = ima_get_action(inode, cred, secid, mask, func, &pcr,
+ action = ima_get_action(inode, cred, blob, mask, func, &pcr,
&template_desc, NULL);
violation_check = ((func == FILE_CHECK || func == MMAP_CHECK) &&
(ima_policy_flag & IMA_MEASURE));
@@ -392,8 +392,7 @@ int ima_file_mmap(struct file *file, unsigned long prot)
if (file && (prot & PROT_EXEC)) {
security_task_getsecid(current, &blob);
- /* scaffolding - until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0],
+ return process_measurement(file, current_cred(), &blob,
NULL, 0, MAY_EXEC, MMAP_CHECK);
}
@@ -432,8 +431,7 @@ int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot)
security_task_getsecid(current, &blob);
inode = file_inode(vma->vm_file);
- /* scaffolding */
- action = ima_get_action(NULL, current_cred(), blob.secid[0], 0,
+ action = ima_get_action(NULL, current_cred(), &blob, 0,
MMAP_CHECK, &pcr, &template, 0);
/* Is the mmap'ed file in policy? */
@@ -472,16 +470,14 @@ int ima_bprm_check(struct linux_binprm *bprm)
struct lsmblob blob;
security_task_getsecid(current, &blob);
- /* scaffolding until process_measurement changes */
- ret = process_measurement(bprm->file, current_cred(), blob.secid[0],
- NULL, 0, MAY_EXEC, BPRM_CHECK);
+ ret = process_measurement(bprm->file, current_cred(), &blob, NULL, 0,
+ MAY_EXEC, BPRM_CHECK);
if (ret)
return ret;
security_cred_getsecid(bprm->cred, &blob);
- /* scaffolding until process_measurement changes */
- return process_measurement(bprm->file, bprm->cred, blob.secid[0],
- NULL, 0, MAY_EXEC, CREDS_CHECK);
+ return process_measurement(bprm->file, bprm->cred, &blob, NULL, 0,
+ MAY_EXEC, CREDS_CHECK);
}
/**
@@ -499,8 +495,7 @@ int ima_file_check(struct file *file, int mask)
struct lsmblob blob;
security_task_getsecid(current, &blob);
- /* scaffolding until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0], NULL, 0,
+ return process_measurement(file, current_cred(), &blob, NULL, 0,
mask & (MAY_READ | MAY_WRITE | MAY_EXEC |
MAY_APPEND), FILE_CHECK);
}
@@ -655,8 +650,7 @@ int ima_read_file(struct file *file, enum kernel_read_file_id read_id,
/* Read entire file for all partial reads. */
func = read_idmap[read_id] ?: FILE_CHECK;
security_task_getsecid(current, &blob);
- /* scaffolding - until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0], NULL,
+ return process_measurement(file, current_cred(), &blob, NULL,
0, MAY_READ, func);
}
@@ -699,9 +693,8 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size,
func = read_idmap[read_id] ?: FILE_CHECK;
security_task_getsecid(current, &blob);
- /* scaffolding until process_measurement changes */
- return process_measurement(file, current_cred(), blob.secid[0], buf,
- size, MAY_READ, func);
+ return process_measurement(file, current_cred(), &blob, buf, size,
+ MAY_READ, func);
}
/**
@@ -830,9 +823,8 @@ void process_buffer_measurement(struct inode *inode, const void *buf, int size,
*/
if (func) {
security_task_getsecid(current, &blob);
- /* scaffolding */
- action = ima_get_action(inode, current_cred(), blob.secid[0],
- 0, func, &pcr, &template, keyring);
+ action = ima_get_action(inode, current_cred(), &blob, 0, func,
+ &pcr, &template, keyring);
if (!(action & IMA_MEASURE))
return;
}
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index bbf9fa79740a..a95eb37937dd 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -508,7 +508,7 @@ static bool ima_match_keyring(struct ima_rule_entry *rule,
* @rule: a pointer to a rule
* @inode: a pointer to an inode
* @cred: a pointer to a credentials structure for user validation
- * @secid: the secid of the task to be validated
+ * @blob: the lsm data of the task to be validated
* @func: LIM hook identifier
* @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
* @keyring: keyring name to check in policy for KEY_CHECK func
@@ -516,7 +516,7 @@ static bool ima_match_keyring(struct ima_rule_entry *rule,
* Returns true on rule match, false on failure.
*/
static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
- const struct cred *cred, u32 secid,
+ const struct cred *cred, struct lsmblob *blob,
enum ima_hooks func, int mask,
const char *keyring)
{
@@ -581,8 +581,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule, struct inode *inode,
case LSM_SUBJ_USER:
case LSM_SUBJ_ROLE:
case LSM_SUBJ_TYPE:
- lsmblob_init(&lsmdata, secid);
- rc = ima_filter_rule_match(&lsmdata, rule->lsm[i].type,
+ rc = ima_filter_rule_match(blob, rule->lsm[i].type,
Audit_equal,
rule->lsm[i].rules);
default:
@@ -624,7 +623,7 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
* @inode: pointer to an inode for which the policy decision is being made
* @cred: pointer to a credentials structure for which the policy decision is
* being made
- * @secid: LSM secid of the task to be validated
+ * @blob: LSM data of the task to be validated
* @func: IMA hook identifier
* @mask: requested action (MAY_READ | MAY_WRITE | MAY_APPEND | MAY_EXEC)
* @pcr: set the pcr to extend
@@ -639,8 +638,9 @@ static int get_subaction(struct ima_rule_entry *rule, enum ima_hooks func)
* list when walking it. Reads are many orders of magnitude more numerous
* than writes so ima_match_policy() is classical RCU candidate.
*/
-int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
- enum ima_hooks func, int mask, int flags, int *pcr,
+int ima_match_policy(struct inode *inode, const struct cred *cred,
+ struct lsmblob *blob, enum ima_hooks func, int mask,
+ int flags, int *pcr,
struct ima_template_desc **template_desc,
const char *keyring)
{
@@ -656,7 +656,7 @@ int ima_match_policy(struct inode *inode, const struct cred *cred, u32 secid,
if (!(entry->action & actmask))
continue;
- if (!ima_match_rules(entry, inode, cred, secid, func, mask,
+ if (!ima_match_rules(entry, inode, cred, blob, func, mask,
keyring))
continue;
--
2.24.1
--
Linux-audit mailing list
Linux-audit@redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
next prev parent reply other threads:[~2020-11-20 20:27 UTC|newest]
Thread overview: 84+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20201120201507.11993-1-casey.ref@schaufler-ca.com>
2020-11-20 20:14 ` [PATCH v22 00/23] LSM: Module stacking for AppArmor Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 01/23] LSM: Infrastructure management of the sock security Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 02/23] LSM: Create and manage the lsmblob data structure Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-12-28 17:54 ` Mimi Zohar
2020-12-28 17:54 ` Mimi Zohar
2020-12-28 19:22 ` Casey Schaufler
2020-12-28 19:22 ` Casey Schaufler
2020-12-28 19:43 ` Mimi Zohar
2020-12-28 19:43 ` Mimi Zohar
2020-12-28 19:24 ` Mimi Zohar
2020-12-28 19:24 ` Mimi Zohar
2020-12-28 20:06 ` Casey Schaufler
2020-12-28 20:06 ` Casey Schaufler
2020-12-28 22:14 ` Mimi Zohar
2020-12-28 22:14 ` Mimi Zohar
2020-12-28 23:20 ` Casey Schaufler
2020-12-28 23:20 ` Casey Schaufler
2020-12-29 1:53 ` Mimi Zohar
2020-12-29 1:53 ` Mimi Zohar
2020-12-29 13:53 ` Mimi Zohar
2020-12-29 13:53 ` Mimi Zohar
2020-12-29 18:46 ` Casey Schaufler
2020-12-29 18:46 ` Casey Schaufler
2020-12-29 19:16 ` Mimi Zohar
2020-12-29 19:16 ` Mimi Zohar
2020-11-20 20:14 ` [PATCH v23 03/23] LSM: Use lsmblob in security_audit_rule_match Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 04/23] LSM: Use lsmblob in security_kernel_act_as Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 05/23] LSM: Use lsmblob in security_secctx_to_secid Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 06/23] LSM: Use lsmblob in security_secid_to_secctx Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 07/23] LSM: Use lsmblob in security_ipc_getsecid Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 08/23] LSM: Use lsmblob in security_task_getsecid Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 09/23] LSM: Use lsmblob in security_inode_getsecid Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 10/23] LSM: Use lsmblob in security_cred_getsecid Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler [this message]
2020-11-20 20:14 ` [PATCH v23 11/23] IMA: Change internal interfaces to use lsmblobs Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 12/23] LSM: Specify which LSM to display Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 13/23] LSM: Ensure the correct LSM context releaser Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 14/23] LSM: Use lsmcontext in security_secid_to_secctx Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:14 ` [PATCH v23 15/23] LSM: Use lsmcontext in security_inode_getsecctx Casey Schaufler
2020-11-20 20:14 ` Casey Schaufler
2020-11-20 20:15 ` [PATCH v23 16/23] LSM: security_secid_to_secctx in netlink netfilter Casey Schaufler
2020-11-20 20:15 ` Casey Schaufler
2020-11-20 20:15 ` [PATCH v23 17/23] NET: Store LSM netlabel data in a lsmblob Casey Schaufler
2020-11-20 20:15 ` Casey Schaufler
2020-11-20 20:15 ` [PATCH v23 18/23] LSM: Verify LSM display sanity in binder Casey Schaufler
2020-11-20 20:15 ` Casey Schaufler
2020-11-20 20:15 ` [PATCH v23 19/23] audit: add support for non-syscall auxiliary records Casey Schaufler
2020-11-20 20:15 ` Casey Schaufler
2020-11-20 23:06 ` kernel test robot
2020-11-20 23:06 ` kernel test robot
2020-11-20 23:06 ` kernel test robot
2020-11-21 0:36 ` kernel test robot
2020-11-21 0:36 ` kernel test robot
2020-11-21 7:36 ` kernel test robot
2020-11-21 7:36 ` kernel test robot
2020-11-21 7:36 ` kernel test robot
2020-11-20 20:15 ` [PATCH v23 20/23] Audit: Add new record for multiple process LSM attributes Casey Schaufler
2020-11-20 20:15 ` Casey Schaufler
2020-11-20 22:51 ` kernel test robot
2020-11-20 22:51 ` kernel test robot
2020-11-20 22:51 ` kernel test robot
2020-11-21 0:02 ` kernel test robot
2020-11-21 0:02 ` kernel test robot
2020-11-21 0:02 ` kernel test robot
2020-11-20 20:15 ` [PATCH v23 21/23] Audit: Add a new record for multiple object " Casey Schaufler
2020-11-20 20:15 ` Casey Schaufler
2020-11-20 20:15 ` [PATCH v23 22/23] LSM: Add /proc attr entry for full LSM context Casey Schaufler
2020-11-20 20:15 ` Casey Schaufler
2020-11-20 20:15 ` [PATCH v23 23/23] AppArmor: Remove the exclusive flag Casey Schaufler
2020-11-20 20:15 ` Casey Schaufler
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201120201507.11993-12-casey@schaufler-ca.com \
--to=casey@schaufler-ca.com \
--cc=casey.schaufler@intel.com \
--cc=jmorris@namei.org \
--cc=john.johansen@canonical.com \
--cc=keescook@chromium.org \
--cc=linux-audit@redhat.com \
--cc=linux-integrity@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=paul@paul-moore.com \
--cc=penguin-kernel@i-love.sakura.ne.jp \
--cc=sds@tycho.nsa.gov \
--cc=selinux@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.