lkml.org 
[lkml]   [2020]   [Mar]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Subject[PATCH 02/17] security: Add hooks to rule on setting a watch [ver #5]
    From
    Date
    Add security hooks that will allow an LSM to rule on whether or not a watch
    may be set. More than one hook is required as the watches watch different
    types of object.

    Signed-off-by: David Howells <dhowells@redhat.com>
    cc: Casey Schaufler <casey@schaufler-ca.com>
    cc: Stephen Smalley <sds@tycho.nsa.gov>
    cc: linux-security-module@vger.kernel.org
    ---

    include/linux/lsm_hooks.h | 24 ++++++++++++++++++++++++
    include/linux/security.h | 17 +++++++++++++++++
    security/security.c | 14 ++++++++++++++
    3 files changed, 55 insertions(+)

    diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
    index 20d8cf194fb7..79d7c73676d7 100644
    --- a/include/linux/lsm_hooks.h
    +++ b/include/linux/lsm_hooks.h
    @@ -1416,6 +1416,18 @@
    * @ctx is a pointer in which to place the allocated security context.
    * @ctxlen points to the place to put the length of @ctx.
    *
    + * Security hooks for the general notification queue:
    + *
    + * @watch_key:
    + * Check to see if a process is allowed to watch for event notifications
    + * from a key or keyring.
    + * @key: The key to watch.
    + *
    + * @watch_devices:
    + * Check to see if a process is allowed to watch for event notifications
    + * from devices (as a global set).
    + *
    + *
    * Security hooks for using the eBPF maps and programs functionalities through
    * eBPF syscalls.
    *
    @@ -1698,6 +1710,12 @@ union security_list_options {
    int (*inode_notifysecctx)(struct inode *inode, void *ctx, u32 ctxlen);
    int (*inode_setsecctx)(struct dentry *dentry, void *ctx, u32 ctxlen);
    int (*inode_getsecctx)(struct inode *inode, void **ctx, u32 *ctxlen);
    +#ifdef CONFIG_KEY_NOTIFICATIONS
    + int (*watch_key)(struct key *key);
    +#endif
    +#ifdef CONFIG_DEVICE_NOTIFICATIONS
    + int (*watch_devices)(void);
    +#endif

    #ifdef CONFIG_SECURITY_NETWORK
    int (*unix_stream_connect)(struct sock *sock, struct sock *other,
    @@ -1985,6 +2003,12 @@ struct security_hook_heads {
    struct hlist_head inode_notifysecctx;
    struct hlist_head inode_setsecctx;
    struct hlist_head inode_getsecctx;
    +#ifdef CONFIG_KEY_NOTIFICATIONS
    + struct hlist_head watch_key;
    +#endif
    +#ifdef CONFIG_DEVICE_NOTIFICATIONS
    + struct hlist_head watch_devices;
    +#endif
    #ifdef CONFIG_SECURITY_NETWORK
    struct hlist_head unix_stream_connect;
    struct hlist_head unix_may_send;
    diff --git a/include/linux/security.h b/include/linux/security.h
    index 64b19f050343..7a36064a64ea 100644
    --- a/include/linux/security.h
    +++ b/include/linux/security.h
    @@ -1276,6 +1276,23 @@ static inline int security_locked_down(enum lockdown_reason what)
    }
    #endif /* CONFIG_SECURITY */

    +#if defined(CONFIG_SECURITY) && defined(CONFIG_KEY_NOTIFICATIONS)
    +int security_watch_key(struct key *key);
    +#else
    +static inline int security_watch_key(struct key *key)
    +{
    + return 0;
    +}
    +#endif
    +#if defined(CONFIG_SECURITY) && defined(CONFIG_DEVICE_NOTIFICATIONS)
    +int security_watch_devices(void);
    +#else
    +static inline int security_watch_devices(void)
    +{
    + return 0;
    +}
    +#endif
    +
    #ifdef CONFIG_SECURITY_NETWORK

    int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
    diff --git a/security/security.c b/security/security.c
    index 565bc9b67276..22877f47cf62 100644
    --- a/security/security.c
    +++ b/security/security.c
    @@ -1988,6 +1988,20 @@ int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
    }
    EXPORT_SYMBOL(security_inode_getsecctx);

    +#ifdef CONFIG_KEY_NOTIFICATIONS
    +int security_watch_key(struct key *key)
    +{
    + return call_int_hook(watch_key, 0, key);
    +}
    +#endif
    +
    +#ifdef CONFIG_DEVICE_NOTIFICATIONS
    +int security_watch_devices(void)
    +{
    + return call_int_hook(watch_devices, 0);
    +}
    +#endif
    +
    #ifdef CONFIG_SECURITY_NETWORK

    int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)

    \
     
     \ /
      Last update: 2020-03-18 16:04    [W:3.758 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site