LSM: SELinux changes to allow LSM stacking
Subsystems (2)
PATCH v2 1/1 LSM: SELinux changes to allow LSM stacking
Subject: LSM: SELinux changes to allow LSM stacking
Change security blob accesses to use the lsm_get/lsm_set interfaces. This requires removal of the cred pointer poisoning in selinux_cred_free.
Signed-off-by Casey Schaufler <[email protected]>
---
security/Kconfig | 6 +- security/selinux/hooks.c | 331 +++++++++++++++++++++---------------- security/selinux/include/objsec.h | 2 + security/selinux/include/xfrm.h | 2 +- security/selinux/netlabel.c | 13 +- security/selinux/selinuxfs.c | 6 +- security/selinux/xfrm.c | 9 +- 7 files changed, 212 insertions(+), 157 deletions(-)
security/Kconfig +4 -2
@@ -126,12 +126,14 @@ source security/yama/Kconfig config SECURITY_COMPOSER bool "Allow multiple concurrent LSMs" depends on SECURITY && \ - !SECURITY_SELINUX + !(SECURITY_SMACK && SECURITY_SELINUX) default n help Allows multiple security modules to be used concurrently. Only LSMs that have been made composer friendly may be used - when set. Yama, Smack, TOMOYO and AppArmor are composer friendly. + when set. Yama, Smack, TOMOYO, AppArmor and SELinux are + composer friendly. Smack and SELinux are presently unable + to run at the same time. If you are unsure how to answer this question, answer N.
security/selinux/hooks.c +189 -142
1,001 lines not on this page · raw message
security/selinux/include/objsec.h +2 -0
@@ -24,6 +24,7 @@#include <linux/binfmts.h> #include <linux/in.h> #include <linux/spinlock.h> +#include <linux/lsm.h> #include "flask.h" #include "avc.h"
@@ -115,5 +116,6 @@ struct key_security_struct { };extern unsigned int selinux_checkreqprot; +extern struct security_operations selinux_ops;#endif /* _SELINUX_OBJSEC_H_ */
security/selinux/include/xfrm.h +1 -1
@@ -31,7 +31,7 @@ static inline struct inode_security_struct *get_sock_isec(struct sock *sk)if (!sk->sk_socket)return NULL ; -return SOCK_INODE (sk->sk_socket)->i_security; +return lsm_get_inode (SOCK_INODE (sk->sk_socket), &selinux_ops); }#ifdef CONFIG_SECURITY_NETWORK_XFRM
security/selinux/netlabel.c +7 -6
@@ -81,7 +81,7 @@ static int selinux_netlbl_sidlookup_cached(struct sk_buff *skb,static struct netlbl_lsm_secattr *selinux_netlbl_sock_genattr (struct sock *sk) {int rc; -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =lsm_get_sock (sk, &selinux_ops);struct netlbl_lsm_secattr *secattr;if (sksec->nlbl_secattr !=NULL )
@@ -221,7 +221,8 @@ int selinux_netlbl_skbuff_setsid(struct sk_buff *skb,* being labeled by it's parent socket, if it is just exit */ sk = skb->sk;if (sk !=NULL ) { -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec = +lsm_get_sock (sk, &selinux_ops);if (sksec->nlbl_state !=NLBL_REQSKB )return 0 ; secattr = sksec->nlbl_secattr;
@@ -283,7 +284,7 @@ inet_conn_request_return:*/ void selinux_netlbl_inet_csk_clone (struct sock *sk,u16 family) { -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =lsm_get_sock (sk, &selinux_ops);if (family ==PF_INET ) sksec->nlbl_state =NLBL_LABELED ;
@@ -304,7 +305,7 @@ void selinux_netlbl_inet_csk_clone(struct sock *sk, u16 family)int selinux_netlbl_socket_post_create (struct sock *sk,u16 family) {int rc; -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =lsm_get_sock (sk, &selinux_ops);struct netlbl_lsm_secattr *secattr;if (family !=PF_INET )
@@ -402,7 +403,7 @@ int selinux_netlbl_socket_setsockopt(struct socket *sock, {int rc =0 ;struct sock *sk = sock->sk; -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =lsm_get_sock (sk, &selinux_ops);struct netlbl_lsm_secattr secattr; if (level == IPPROTO_IP && optname == IP_OPTIONS &&
@@ -435,7 +436,7 @@ int selinux_netlbl_socket_setsockopt(struct socket *sock,int selinux_netlbl_socket_connect (struct sock *sk,struct sockaddr *addr) {int rc; -struct sk_security_struct *sksec = sk->sk_security; +struct sk_security_struct *sksec =lsm_get_sock (sk, &selinux_ops);struct netlbl_lsm_secattr *secattr; if (sksec->nlbl_state != NLBL_REQSKB &&
security/selinux/selinuxfs.c +3 -3
@@ -83,7 +83,7 @@ static int task_has_security(struct task_struct *tsk,u32 sid =0 ;rcu_read_lock (); - tsec =__task_cred (tsk)->security; + tsec =lsm_get_cred (__task_cred (tsk), &selinux_ops);if (tsec) sid = tsec->sid;rcu_read_unlock ();
@@ -1264,7 +1264,7 @@ static int sel_make_bools(void)if (len >=PAGE_SIZE ) goto out; - isec = (struct inode_security_struct *)inode->i_security; + isec =lsm_get_inode (inode, &selinux_ops); ret =security_genfs_sid ("selinuxfs" , page,SECCLASS_FILE , &sid);if (ret) goto out;
@@ -1831,7 +1831,7 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent) goto err; inode->i_ino = ++sel_last_ino; - isec = (struct inode_security_struct *)inode->i_security; + isec =lsm_get_inode (inode, &selinux_ops); isec->sid =SECINITSID_DEVNULL ; isec->sclass =SECCLASS_CHR_FILE ; isec->initialized =1 ;
security/selinux/xfrm.c +6 -3
@@ -198,7 +198,8 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *uctx, u32 sid) { int rc = 0; -const struct task_security_struct *tsec =current_security (); +const struct task_security_struct *tsec = +lsm_get_cred (current_cred (), &selinux_ops);struct xfrm_sec_ctx *ctx =NULL ;char *ctx_str =NULL ;u32 str_len;
@@ -334,7 +335,8 @@ void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx)*/ int selinux_xfrm_policy_delete (struct xfrm_sec_ctx *ctx) { -const struct task_security_struct *tsec =current_security (); +const struct task_security_struct *tsec = +lsm_get_cred (current_cred (), &selinux_ops);int rc =0 ;if (ctx) {
@@ -379,7 +381,8 @@ void selinux_xfrm_state_free(struct xfrm_state *x)*/ int selinux_xfrm_state_delete (struct xfrm_state *x) { -const struct task_security_struct *tsec =current_security (); +const struct task_security_struct *tsec = +lsm_get_cred (current_cred (), &selinux_ops);struct xfrm_sec_ctx *ctx = x->security;int rc =0 ;
--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.