LSM changes for 2.5.40

Hi,

Here are some patches against the latest 2.5 BK tree that add some further LSM hooks and documenation to the tree. There is also one minor change to fs/inode.c to allow security modules to know more information about newly created inodes.

Please pull from bk://lsm.bkbits.net/linus-2.5

thanks,

greg k-h

 Documentation/DocBook/Makefile        |    2 
 Documentation/DocBook/kernel-api.tmpl |    5 
 Documentation/DocBook/lsm.tmpl        |  285 ++++++++++++++++++++++++++++++++++
 fs/inode.c                            |   16 -
 include/linux/ipc.h                   |    1 
 include/linux/security.h              |   55 ++++++
 ipc/msg.c                             |   11 +
 ipc/sem.c                             |   11 +
 ipc/shm.c                             |   10 +
 ipc/util.c                            |    3 
 security/capability.c                 |   46 +++++
 security/dummy.c                      |   47 +++++
 12 files changed, 482 insertions(+), 10 deletions(-)

-----

[email protected], 2002-10-08 14:53:21-07:00, [email protected]
[PATCH] LSM: move the inode_alloc_security hook.

This moves the inode_alloc_security() hook so that we have all of the inode information at the moment of the hook.

 fs/inode.c |   16 ++++++++--------
 1 files changed, 8 insertions(+), 8 deletions(-)

------

[email protected], 2002-10-08 14:48:44-07:00, [email protected]
LSM: added lsm documentation to the tree.

 Documentation/DocBook/Makefile        |    2 
 Documentation/DocBook/kernel-api.tmpl |    5 
 Documentation/DocBook/lsm.tmpl        |  285 ++++++++++++++++++++++++++++++++++
 3 files changed, 291 insertions(+), 1 deletion(-)

------

[email protected], 2002-10-08 14:10:38-07:00, [email protected]
[PATCH] Base set of LSM hooks for SysV IPC

The patch below adds the base set of LSM hooks for System V IPC to the 2.5.41 kernel. These hooks permit a security module to label semaphore sets, message queues, and shared memory segments and to perform security checks on these objects that parallel the existing IPC access checks. Additional LSM hooks for labeling and controlling individual messages sent on a single message queue and for providing fine-grained distinctions among IPC operations will be submitted separately after this base set of LSM IPC hooks has been accepted.

 include/linux/ipc.h      |    1 
 include/linux/security.h |   55 +++++++++++++++++++++++++++++++++++++++++++++++
 ipc/msg.c                |   11 +++++++++
 ipc/sem.c                |   11 +++++++++
 ipc/shm.c                |   10 ++++++++
 ipc/util.c               |    3 +-
 security/capability.c    |   46 +++++++++++++++++++++++++++++++++++++++
 security/dummy.c         |   47 ++++++++++++++++++++++++++++++++++++++++
 8 files changed, 183 insertions(+), 1 deletion(-)

------

# This is a BitKeeper generated patch for the following project:
# Project Name: Linux kernel tree
# This patch format is intended for GNU patch command version 2.5 or higher. # This patch includes the following deltas:

#	           ChangeSet	1.704   -> 1.705  
#	 include/linux/ipc.h	1.1     -> 1.2    
#	           ipc/msg.c	1.6     -> 1.7    
#	include/linux/security.h	1.3     -> 1.4    
#	    security/dummy.c	1.6     -> 1.7    
#	security/capability.c	1.5     -> 1.6    
#	           ipc/sem.c	1.11    -> 1.12   
#	          ipc/util.c	1.5     -> 1.6    
#	           ipc/shm.c	1.17    -> 1.18   

#
# The following is the BitKeeper ChangeSet Log
# --------------------------------------------
# 02/10/08 [email protected] 1.705
# [PATCH] Base set of LSM hooks for SysV IPC
#
# The patch below adds the base set of LSM hooks for System V IPC to the # 2.5.41 kernel. These hooks permit a security module to label

# semaphore sets, message queues, and shared memory segments and to
# perform security checks on these objects that parallel the existing
# IPC access checks.  Additional LSM hooks for labeling and controlling
# individual messages sent on a single message queue and for providing
# fine-grained distinctions among IPC operations will be submitted
# separately after this base set of LSM IPC hooks has been accepted.
# --------------------------------------------
#
diff -Nru a/include/linux/ipc.h b/include/linux/ipc.h
--- a/include/linux/ipc.h	Tue Oct  8 15:51:15 2002
+++ b/include/linux/ipc.h	Tue Oct  8 15:51:15 2002
@@ -63,6 +63,7 @@
 	gid_t		cgid;
 	mode_t		mode; 
 	unsigned long	seq;
+	void		*security;
 };

#endif /* __KERNEL__ */

diff -Nru a/include/linux/security.h b/include/linux/security.h
@@ -572,6 +572,50 @@
  * 	is being reparented to the init task.
  *	@p contains the task_struct for the kernel thread.
  *
+ * Security hooks affecting all System V IPC operations.
+ *
+ * @ipc_permission:
+ *	Check permissions for access to IPC
+ *	@ipcp contains the kernel IPC permission structure
+ *	@flag contains the desired (requested) permission set
+ *	Return 0 if permission is granted.
+ *
+ * Security hooks for System V IPC Message Queues
+ *
+ * @msg_queue_alloc_security:
+ *	Allocate and attach a security structure to the
+ *	msq->q_perm.security field. The security field is initialized to
+ *	NULL when the structure is first created.
+ *	@msq contains the message queue structure to be modified.
+ *	Return 0 if operation was successful and permission is granted.
+ * @msg_queue_free_security:
+ *	Deallocate security structure for this message queue.
+ *	@msq contains the message queue structure to be modified.
+ *
+ * Security hooks for System V Shared Memory Segments
+ *
+ * @shm_alloc_security:
+ *	Allocate and attach a security structure to the shp->shm_perm.security
+ *	field.  The security field is initialized to NULL when the structure is
+ *	first created.
+ *	@shp contains the shared memory structure to be modified.
+ *	Return 0 if operation was successful and permission is granted.
+ * @shm_free_security:
+ *	Deallocate the security struct for this memory segment.
+ *	@shp contains the shared memory structure to be modified.
+ *
+ * Security hooks for System V Semaphores
+ *
+ * @sem_alloc_security:
+ *	Allocate and attach a security structure to the sma->sem_perm.security
+ *	field.  The security field is initialized to NULL when the structure is
+ *	first created.
+ *	@sma contains the semaphore structure
+ *	Return 0 if operation was successful and permission is granted.
+ * @sem_free_security:
+ *	deallocate security struct for this semaphore
+ *	@sma contains the semaphore structure.
+ *
  * @ptrace:
  *	Check permission before allowing the @parent process to trace the
  *	@child process.

@@ -785,6 +829,17 @@
 			   unsigned long arg5);
 	void (*task_kmod_set_label) (void);
 	void (*task_reparent_to_init) (struct task_struct * p);
+
+	int (*ipc_permission) (struct kern_ipc_perm * ipcp, short flag);
+
+	int (*msg_queue_alloc_security) (struct msg_queue * msq);
+	void (*msg_queue_free_security) (struct msg_queue * msq);
+
+	int (*shm_alloc_security) (struct shmid_kernel * shp);
+	void (*shm_free_security) (struct shmid_kernel * shp);
+
+	int (*sem_alloc_security) (struct sem_array * sma);
+	void (*sem_free_security) (struct sem_array * sma);
 
 	/* allow module stacking */
 	int (*register_security) (const char *name,

diff -Nru a/ipc/msg.c b/ipc/msg.c
@@ -22,6 +22,7 @@
 #include <linux/init.h>
 #include <linux/proc_fs.h>
 #include <linux/list.h>
+#include <linux/security.h>
 #include <asm/uaccess.h>
 #include "util.h"
 

@@ -89,6 +90,7 @@
 static int newque (key_t key, int msgflg)
 {
 	int id;
+	int retval;
 	struct msg_queue *msq;
 
 	msq  = (struct msg_queue *) kmalloc (sizeof (*msq), GFP_KERNEL);

@@ -98,8 +100,16 @@
 	msq->q_perm.mode = (msgflg & S_IRWXUGO);
 	msq->q_perm.key = key;
 
+	msq->q_perm.security = NULL;
+	retval = security_ops->msg_queue_alloc_security(msq);
+	if (retval) {
+		kfree(msq);
+		return retval;
+	}
+
 	id = ipc_addid(&msg_ids, &msq->q_perm, msg_ctlmni);
 	if(id == -1) {
+		security_ops->msg_queue_free_security(msq);
 		kfree(msq);
 		return -ENOSPC;
 	}

@@ -271,6 +281,7 @@
 		free_msg(msg);
 	}
 	atomic_sub(msq->q_cbytes, &msg_bytes);
+	security_ops->msg_queue_free_security(msq);
 	kfree(msq);
 }
 

diff -Nru a/ipc/sem.c b/ipc/sem.c
@@ -63,6 +63,7 @@
 #include <linux/init.h>
 #include <linux/proc_fs.h>
 #include <linux/smp_lock.h>
+#include <linux/security.h>
 #include <asm/uaccess.h>
 #include "util.h"
 

@@ -115,6 +116,7 @@
 static int newary (key_t key, int nsems, int semflg)
 {
 	int id;
+	int retval;
 	struct sem_array *sma;
 	int size;
 

@@ -133,8 +135,16 @@
 	sma->sem_perm.mode = (semflg & S_IRWXUGO);
 	sma->sem_perm.key = key;
 
+	sma->sem_perm.security = NULL;
+	retval = security_ops->sem_alloc_security(sma);
+	if (retval) {
+		ipc_free(sma, size);
+		return retval;
+	}
+
 	id = ipc_addid(&sem_ids, &sma->sem_perm, sc_semmni);
 	if(id == -1) {
+		security_ops->sem_free_security(sma);
 		ipc_free(sma, size);
 		return -ENOSPC;
 	}

@@ -417,6 +427,7 @@
 
 	used_sems -= sma->sem_nsems;
 	size = sizeof (*sma) + sma->sem_nsems * sizeof (struct sem);
+	security_ops->sem_free_security(sma);
 	ipc_free(sma, size);
 }
 

diff -Nru a/ipc/shm.c b/ipc/shm.c
@@ -24,6 +24,7 @@
 #include <linux/mman.h>
 #include <linux/proc_fs.h>
 #include <linux/shmem_fs.h>
+#include <linux/security.h>
 #include <asm/uaccess.h>
 
 #include "util.h"

@@ -115,6 +116,7 @@
 	shm_unlock(shp->id);
 	shmem_lock(shp->shm_file, 0);
 	fput (shp->shm_file);
+	security_ops->shm_free_security(shp);
 	kfree (shp);
 }
 

@@ -185,6 +187,13 @@
 	shp->shm_perm.key = key;
 	shp->shm_flags = (shmflg & S_IRWXUGO);
 
+	shp->shm_perm.security = NULL;
+	error = security_ops->shm_alloc_security(shp);
+	if (error) {
+		kfree(shp);
+		return error;
+	}
+
 	sprintf (name, "SYSV%08x", key);
 	file = shmem_file_setup(name, size, VM_ACCOUNT);
 	error = PTR_ERR(file);

@@ -213,6 +222,7 @@
 no_id:
 	fput(file);
 no_file:
+	security_ops->shm_free_security(shp);
 	kfree(shp);
 	return error;
 }

diff -Nru a/ipc/util.c b/ipc/util.c
@@ -19,6 +19,7 @@
 #include <linux/vmalloc.h>
 #include <linux/slab.h>
 #include <linux/highuid.h>
+#include <linux/security.h>
 
 #if defined(CONFIG_SYSVIPC)
 

@@ -263,7 +264,7 @@
 	    !capable(CAP_IPC_OWNER))
 		return -1;
 
-	return 0;
+	return security_ops->ipc_permission(ipcp, flag);
 }
 
 /*

# This is a BitKeeper generated patch for the following project:
# Project Name: Linux kernel tree
# This patch format is intended for GNU patch command version 2.5 or higher. # This patch includes the following deltas:
# ChangeSet 1.705 -> 1.706
# Documentation/DocBook/kernel-api.tmpl 1.19 -> 1.20
# Documentation/DocBook/Makefile 1.32 -> 1.33
# (new) -> 1.1 Documentation/DocBook/lsm.tmpl
#
# The following is the BitKeeper ChangeSet Log
# --------------------------------------------
# 02/10/08 [email protected] 1.706
# LSM: added lsm documentation to the tree.
# --------------------------------------------
#

diff -Nru a/Documentation/DocBook/Makefile b/Documentation/DocBook/Makefile
@@ -11,7 +11,7 @@
 	    kernel-locking.sgml via-audio.sgml mousedrivers.sgml \
 	    deviceiobook.sgml procfs-guide.sgml tulip-user.sgml \
 	    writing_usb_driver.sgml scsidrivers.sgml sis900.sgml \
-	    kernel-api.sgml journal-api.sgml
+	    kernel-api.sgml journal-api.sgml lsm.sgml
 
 JBDSOURCES :=  $(TOPDIR)/include/linux/jbd.h \
 	$(TOPDIR)/fs/jbd/journal.c \

diff -Nru a/Documentation/DocBook/kernel-api.tmpl b/Documentation/DocBook/kernel-api.tmpl
@@ -185,6 +185,11 @@
 !Efs/devfs/base.c
   </chapter>
 
+  <chapter id="security">
+     <title>Security Framework</title>
+!Esecurity/security.c
+  </chapter>
+
   <chapter id="pmfuncs">
      <title>Power Management</title>
 !Ekernel/pm.c

# This is a BitKeeper generated patch for the following project:
# Project Name: Linux kernel tree
# This patch format is intended for GNU patch command version 2.5 or higher. # This patch includes the following deltas:
# ChangeSet 1.706 -> 1.707
# fs/inode.c 1.70 -> 1.71
#
# The following is the BitKeeper ChangeSet Log
# --------------------------------------------
# 02/10/08 [email protected] 1.707
# [PATCH] LSM: move the inode_alloc_security hook.
#
# This moves the inode_alloc_security() hook so that we have all of the

# inode information at the moment of the hook.
# --------------------------------------------
#
diff -Nru a/fs/inode.c b/fs/inode.c
--- a/fs/inode.c	Tue Oct  8 15:51:04 2002
+++ b/fs/inode.c	Tue Oct  8 15:51:04 2002
@@ -101,14 +101,6 @@
 	if (inode) {
 		struct address_space * const mapping = &inode->i_data;

- inode->i_security = NULL;
- if (security_ops->inode_alloc_security(inode)) {
- if (inode->i_sb->s_op->destroy_inode)
- inode->i_sb->s_op->destroy_inode(inode);
- else
- kmem_cache_free(inode_cachep, (inode));
- return NULL;
- }
inode->i_sb = sb;
inode->i_dev = sb->s_dev; inode->i_blkbits = sb->s_blocksize_bits;
@@ -127,6 +119,14 @@
inode->i_pipe = NULL; inode->i_bdev = NULL; inode->i_cdev = NULL;
+ inode->i_security = NULL;
+ if (security_ops->inode_alloc_security(inode)) {
+ if (inode->i_sb->s_op->destroy_inode)
+ inode->i_sb->s_op->destroy_inode(inode);
+ else
+ kmem_cache_free(inode_cachep, (inode));
+ return NULL;
+ }

mapping->a_ops = &empty_aops;
mapping->host = inode;

Oops, wrong Subject: these are against 2.5.41 + latest bk tree.

Sorry for any confusion.

greg k-h