Security: hooks for seccomp as extended attribute

PATCH New Michael Cassaniti 1 participant 1 message Dec 19, 2012

Subsystems (4)

VFS Security (LSM) exec and binfmt Secure computing

lore

Share & tools

lore

Michael Cassaniti

author

2012-12-19 21:30 UTC #0 lore raw

PATCH 1/2 Security: hooks for seccomp as extended attribute

From Michael Cassaniti <[email protected]>

Superficial patch showing hooks for seccomp extended attribute filter code Written against Linux 3.5

Signed-off-by Michael Cassaniti <[email protected]>

---

fs/exec.c 2012-09-13 12:27:14.966076904 +1000 renamed from fs/exec.c 2012-07-22 06:58:29.000000000 +1000 +4 -0

diff -uprN -X linux-3.5-rp1/Documentation/dontdiff linux-3.5/fs/exec.c linux-3.5-rp1/fs/exec.c
@@ -1537,6 +1537,10 @@ static int do_execve_common(const char *
     if (retval < 0)
         goto out;
 
+    retval = security_seccomp_from_vfs(bprm);
+    if (retval < 0)
+        goto out;
+
     retval = copy_strings_kernel(1, &bprm->filename, bprm);
     if (retval < 0)
         goto out;

include/linux/seccomp.h 2012-09-21 12:43:28.215772113 +1000 renamed from include/linux/seccomp.h 2012-07-22 06:58:29.000000000 +1000 +8 -0

diff -uprN -X linux-3.5-rp1/Documentation/dontdiff linux-3.5/include/linux/seccomp.h linux-3.5-rp1/include/linux/seccomp.h
@@ -119,6 +119,14 @@ static inline int seccomp_mode(struct se
 extern void put_seccomp_filter(struct task_struct *tsk);
 extern void get_seccomp_filter(struct task_struct *tsk);
 extern u32 seccomp_bpf_load(int off);
+
+#define SECCOMP_XATTR_NAME "security.seccomp"
+#define SECCOMP_XATTR_LEN        128
+#define SECCOMP_XATTR_BIT_EN        0
+#define SECCOMP_XATTR_BIT_DEF_ACTION    1
+#define SECCOMP_XATTR_BIT_DEF_RETURN    2
+#define SECCOMP_XATTR_BITMAP_START    3
+
 #else  /* CONFIG_SECCOMP_FILTER */
 static inline void put_seccomp_filter(struct task_struct *tsk)
 {

include/linux/security.h 2012-09-21 12:00:24.026007169 +1000 renamed from include/linux/security.h 2012-07-22 06:58:29.000000000 +1000 +18 -0

diff -uprN -X linux-3.5-rp1/Documentation/dontdiff linux-3.5/include/linux/security.h linux-3.5-rp1/include/linux/security.h
@@ -3023,5 +3023,23 @@ static inline void free_secdata(void *se
 { }
 #endif /* CONFIG_SECURITY */
 
+#ifdef CONFIG_SECCOMP_FILTER
+
+extern int append_seccomp_from_vfs(struct linux_binprm *bprm);
+
+static inline int security_seccomp_from_vfs(struct linux_binprm *bprm)
+{
+    return append_seccomp_from_vfs(bprm);
+}
+
+#else
+
+static inline int security_seccomp_from_vfs(struct linux_binprm *bprm)
+{
+    return 0;
+}
+
+#endif /* CONFIG_SECCOMP_FILTER */
+
 #endif /* ! __LINUX_SECURITY_H */

kernel/seccomp.c 2012-09-21 13:23:52.254969072 +1000 renamed from kernel/seccomp.c 2012-07-22 06:58:29.000000000 +1000 +6 -0

diff -uprN -X linux-3.5-rp1/Documentation/dontdiff linux-3.5/kernel/seccomp.c linux-3.5-rp1/kernel/seccomp.c
@@ -502,3 +502,9 @@ long prctl_set_seccomp(unsigned long sec
 out:
     return ret;
 }
+
+int append_seccomp_from_vfs(struct linux_binprm *bprm)
+{
+    pr_debug("Entered stub %s\n", __func__);
+    return 0;
+}