LSM: SELinux changes to allow LSM stacking

PATCH Superseded Casey Schaufler 2 participants 5 messages Sep 5, 2012 – Sep 6, 2012

Subsystems (2)

SELinux security module Security (LSM)

lore

Share & tools

lore

Casey Schaufler

author

2012-09-05 02:09 UTC #0 lore raw

PATCH 5/5 LSM: SELinux changes to allow LSM stacking

Subject: LSM: SELinux changes to allow LSM stacking

Change security blob accesses to use the lsm_get/lsm_set interfaces. This requires removal of the cred pointer poisoning in selinux_cred_free.

Signed-off-by Casey Schaufler <[email protected]>

---

 security/Kconfig                  |    7 +-
 security/selinux/hooks.c          |  264 +++++++++++++++++++++----------------
 security/selinux/include/objsec.h |    2 +
 security/selinux/include/xfrm.h   |    2 +-
 security/selinux/selinuxfs.c      |    6 +-
 security/selinux/xfrm.c           |    9 +-
 6 files changed, 167 insertions(+), 123 deletions(-)

security/Kconfig +5 -2

index cf83c27..fccab76 100644
@@ -126,12 +126,15 @@ source security/yama/Kconfig
 config SECURITY_COMPOSER
 	bool "Allow multiple concurrent LSMs"
 	depends on SECURITY && \
-		!SECURITY_SELINUX
+		!(SECURITY_SELINUX && SECURITY_SMACK)
 	default n
 	help
 	  Allows multiple security modules to be used concurrently.
 	  Only LSMs that have been made composer friendly may be used
-	  when set. Smack, TOMOYO, AppArmor and Yama are composer friendly.
+	  when set. Smack, TOMOYO, AppArmor, SELinux and Yama are
+	  composer friendly. Smack and SELinux have conflicting uses
+	  of the CIPSO IP option. Until a resolution is found they
+	  may not be used together.
 
 	  If you are unsure how to answer this question, answer N.

security/selinux/hooks.c +150 ~~-114~~

801 lines not on this page · raw message

security/selinux/include/objsec.h +2 -0

index 26c7eee..1d1dd10 100644
@@ -24,6 +24,7 @@
 #include <linux/binfmts.h>
 #include <linux/in.h>
 #include <linux/spinlock.h>
+#include <linux/lsm.h>
 #include "flask.h"
 #include "avc.h"

@@ -115,5 +116,6 @@ struct key_security_struct {
 };
 
 extern unsigned int selinux_checkreqprot;
+extern struct security_operations selinux_ops;
 
 #endif /* _SELINUX_OBJSEC_H_ */

security/selinux/include/xfrm.h +1 -1

index c220f31..1e4b4f2 100644
@@ -31,7 +31,7 @@ static inline struct inode_security_struct *get_sock_isec(struct sock *sk)
 	if (!sk->sk_socket)
 		return NULL;
 
-	return SOCK_INODE(sk->sk_socket)->i_security;
+	return lsm_get_inode(SOCK_INODE(sk->sk_socket), &selinux_ops);
 }
 
 #ifdef CONFIG_SECURITY_NETWORK_XFRM

security/selinux/selinuxfs.c +3 -3

index 298e695..7f42abe 100644
@@ -83,7 +83,7 @@ static int task_has_security(struct task_struct *tsk,
 	u32 sid = 0;
 
 	rcu_read_lock();
-	tsec = __task_cred(tsk)->security;
+	tsec = lsm_get_cred(__task_cred(tsk), &selinux_ops);
 	if (tsec)
 		sid = tsec->sid;
 	rcu_read_unlock();

@@ -1264,7 +1264,7 @@ static int sel_make_bools(void)
 		if (len >= PAGE_SIZE)
 			goto out;
 
-		isec = (struct inode_security_struct *)inode->i_security;
+		isec = lsm_get_inode(inode, &selinux_ops);
 		ret = security_genfs_sid("selinuxfs", page, SECCLASS_FILE, &sid);
 		if (ret)
 			goto out;

@@ -1831,7 +1831,7 @@ static int sel_fill_super(struct super_block *sb, void *data, int silent)
 		goto err;
 
 	inode->i_ino = ++sel_last_ino;
-	isec = (struct inode_security_struct *)inode->i_security;
+	isec = lsm_get_inode(inode, &selinux_ops);
 	isec->sid = SECINITSID_DEVNULL;
 	isec->sclass = SECCLASS_CHR_FILE;
 	isec->initialized = 1;

security/selinux/xfrm.c +6 -3

index 48665ec..02979a3 100644
@@ -198,7 +198,8 @@ static int selinux_xfrm_sec_ctx_alloc(struct xfrm_sec_ctx **ctxp,
 	struct xfrm_user_sec_ctx *uctx, u32 sid)
 {
 	int rc = 0;
-	const struct task_security_struct *tsec = current_security();
+	const struct task_security_struct *tsec =
+				lsm_get_cred(current_cred(), &selinux_ops);
 	struct xfrm_sec_ctx *ctx = NULL;
 	char *ctx_str = NULL;
 	u32 str_len;

@@ -334,7 +335,8 @@ void selinux_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
  */
 int selinux_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
 {
-	const struct task_security_struct *tsec = current_security();
+	const struct task_security_struct *tsec =
+				lsm_get_cred(current_cred(), &selinux_ops);
 	int rc = 0;
 
 	if (ctx) {

@@ -379,7 +381,8 @@ void selinux_xfrm_state_free(struct xfrm_state *x)
   */
 int selinux_xfrm_state_delete(struct xfrm_state *x)
 {
-	const struct task_security_struct *tsec = current_security();
+	const struct task_security_struct *tsec =
+				lsm_get_cred(current_cred(), &selinux_ops);
 	struct xfrm_sec_ctx *ctx = x->security;
 	int rc = 0;

--
This message was distributed to subscribers of the selinux mailing list. If you no longer wish to subscribe, send mail to [email protected] with the words "unsubscribe selinux" without quotes as the message.

Stephen Smalley

2012-09-05 14:38 UTC #1 lore raw

Quoted 7 lines · Casey Schaufler

Subject: LSM: SELinux changes to allow LSM stacking
Change security blob accesses to use the lsm_get/lsm_set interfaces. This requires removal of the cred pointer poisoning in selinux_cred_free.
Signed-off-by Casey Schaufler <[email protected]>

FWIW, passes the selinux-testsuite with SELinux and Yama enabled.

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Casey Schaufler

author

2012-09-05 15:35 UTC #2 lore raw

Quoted 10 lines · Stephen Smalley

Quoted 7 lines · Casey Schaufler
Subject: LSM: SELinux changes to allow LSM stacking
Change security blob accesses to use the lsm_get/lsm_set interfaces. This requires removal of the cred pointer poisoning in selinux_cred_free.
Signed-off-by Casey Schaufler <[email protected]>
FWIW, passes the selinux-testsuite with SELinux and Yama enabled.

Thank you. I'm not at all surprised given the intent of Yama. I would be much
more interested in the results with AppArmor and TOMOYO.

Stephen Smalley

2012-09-06 13:08 UTC #3 lore raw

In reply to Stephen Smalley

Quoted 10 lines · Stephen Smalley

Quoted 7 lines · Casey Schaufler
Subject: LSM: SELinux changes to allow LSM stacking
Change security blob accesses to use the lsm_get/lsm_set interfaces. This requires removal of the cred pointer poisoning in selinux_cred_free.
Signed-off-by Casey Schaufler <[email protected]>
FWIW, passes the selinux-testsuite with SELinux and Yama enabled.

However, setting SELINUX=disabled in /etc/selinux/config and rebooting with this kernel yields a kernel panic during reset_security_ops(), called by selinux_disable().

Signature · 8 lines

Stephen Smalley
National Security Agency


--
This message was distributed to subscribers of the selinux mailing list.
If you no longer wish to subscribe, send mail to [email protected] with
the words "unsubscribe selinux" without quotes as the message.

Casey Schaufler

author

2012-09-06 15:17 UTC #4 lore raw

Quoted 8 lines · Stephen Smalley

Quoted 7 lines · Stephen Smalley
Quoted 6 lines · Casey Schaufler
Subject: LSM: SELinux changes to allow LSM stacking
Change security blob accesses to use the lsm_get/lsm_set interfaces. This requires removal of the cred pointer poisoning in selinux_cred_free.

Quoted 6 lines

Quoted 2 lines
Quoted 1 line
Signed-off-by Casey Schaufler <[email protected]>
FWIW, passes the selinux-testsuite with SELinux and Yama enabled.
However, setting SELINUX=disabled in /etc/selinux/config and rebooting with this kernel yields a kernel panic during reset_security_ops(), called by selinux_disable().

reset_security_ops is only used by SELinux. There are a number of ways to repair this. The important question is whether a general solution is required or if it can be left SELinux specific. If it is a general interface, does it clear all the LSMs or just the LSM calling it? I would suggest that leaving it to SELinux is the best choice, and clearing the calling LSM only the next best choice.