| Message ID | 1364478845-29796-3-git-send-email-SteveD@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Thu, 2013-03-28 at 09:53 -0400, Steve Dickson wrote: > From: David Quigley <dpquigl@davequigley.com> > > The interface to request security labels from user space is the xattr > interface. When requesting the security label from an NFS server it is > important to make sure the requested xattr actually is a MAC label. This allows > us to make sure that we get the desired semantics from the attribute instead of > something else such as capabilities or a time based LSM. > > Signed-off-by: Matthew N. Dodd <Matthew.Dodd@sparta.com> > Signed-off-by: Miguel Rodel Felipe <Rodel_FM@dsi.a-star.edu.sg> > Signed-off-by: Phua Eu Gene <PHUA_Eu_Gene@dsi.a-star.edu.sg> > Signed-off-by: Khin Mi Mi Aung <Mi_Mi_AUNG@dsi.a-star.edu.sg> > --- > include/linux/security.h | 14 ++++++++++++++ > security/capability.c | 6 ++++++ > security/security.c | 6 ++++++ > security/selinux/hooks.c | 6 ++++++ > security/smack/smack_lsm.c | 11 +++++++++++ > 5 files changed, 43 insertions(+) > > diff --git a/include/linux/security.h b/include/linux/security.h > index a957e7a..8a6faff 100644 > --- a/include/linux/security.h > +++ b/include/linux/security.h > @@ -1319,6 +1319,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) > * @pages contains the number of pages. > * Return 0 if permission is granted. > * > + * @ismaclabel: > + * Check if the extended attribute specified by @name > + * represents a MAC label. Returns 0 if name is a MAC > + * attribute otherwise returns non-zero. Sorry, the comment doesn't match the code. Mimi > + * @name full extended attribute name to check against > + * LSM as a MAC label. > + * > * @secid_to_secctx: > * Convert secid to security context. If secdata is NULL the length of > * the result will be returned in seclen, but no secdata will be returned. > @@ -1600,6 +1607,7 @@ struct security_operations { > > int (*getprocattr) (struct task_struct *p, char *name, char **value); > int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t size); > + int (*ismaclabel) (const char *name); > int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen); > int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid); > void (*release_secctx) (char *secdata, u32 seclen); > @@ -1852,6 +1860,7 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode); > int security_getprocattr(struct task_struct *p, char *name, char **value); > int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size); > int security_netlink_send(struct sock *sk, struct sk_buff *skb); > +int security_ismaclabel(const char *name); > int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen); > int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); > void security_release_secctx(char *secdata, u32 seclen); > @@ -2540,6 +2549,11 @@ static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb) > return cap_netlink_send(sk, skb); > } > > +static inline int security_ismaclabel(const char *name) > +{ > + return 0; > +} > + > static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) > { > return -EOPNOTSUPP; > diff --git a/security/capability.c b/security/capability.c > index 456bd9d..07a6484 100644 > --- a/security/capability.c > +++ b/security/capability.c > @@ -817,6 +817,11 @@ static int cap_setprocattr(struct task_struct *p, char *name, void *value, > return -EINVAL; > } > > +static int cap_ismaclabel(const char *name) > +{ > + return 0; > +} > + > static int cap_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) > { > return -EOPNOTSUPP; > @@ -1036,6 +1041,7 @@ void __init security_fixup_ops(struct security_operations *ops) > set_to_cap_if_null(ops, d_instantiate); > set_to_cap_if_null(ops, getprocattr); > set_to_cap_if_null(ops, setprocattr); > + set_to_cap_if_null(ops, ismaclabel); > set_to_cap_if_null(ops, secid_to_secctx); > set_to_cap_if_null(ops, secctx_to_secid); > set_to_cap_if_null(ops, release_secctx); > diff --git a/security/security.c b/security/security.c > index 723a10c..6d7389c 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -1057,6 +1057,12 @@ int security_netlink_send(struct sock *sk, struct sk_buff *skb) > return security_ops->netlink_send(sk, skb); > } > > +int security_ismaclabel(const char *name) > +{ > + return security_ops->ismaclabel(name); > +} > +EXPORT_SYMBOL(security_ismaclabel); > + > int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) > { > return security_ops->secid_to_secctx(secid, secdata, seclen); > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index c7f1905..97231a0 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -5417,6 +5417,11 @@ abort_change: > return error; > } > > +static int selinux_ismaclabel(const char *name) > +{ > + return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0); > +} > + > static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) > { > return security_sid_to_context(secid, secdata, seclen); > @@ -5655,6 +5660,7 @@ static struct security_operations selinux_ops = { > .getprocattr = selinux_getprocattr, > .setprocattr = selinux_setprocattr, > > + .ismaclabel = selinux_ismaclabel, > .secid_to_secctx = selinux_secid_to_secctx, > .secctx_to_secid = selinux_secctx_to_secid, > .release_secctx = selinux_release_secctx, > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > index fa64740..ca01d71 100644 > --- a/security/smack/smack_lsm.c > +++ b/security/smack/smack_lsm.c > @@ -3329,6 +3329,16 @@ static void smack_audit_rule_free(void *vrule) > #endif /* CONFIG_AUDIT */ > > /** > + * smack_ismaclabel - check if xattr @name references a smack MAC label > + * @name: Full xattr name to check. > + */ > +static int smack_ismaclabel(const char *name) > +{ > + return (strcmp(name, XATTR_SMACK_SUFFIX) == 0); > +} > + > + > +/** > * smack_secid_to_secctx - return the smack label for a secid > * @secid: incoming integer > * @secdata: destination > @@ -3524,6 +3534,7 @@ struct security_operations smack_ops = { > .audit_rule_free = smack_audit_rule_free, > #endif /* CONFIG_AUDIT */ > > + .ismaclabel = smack_ismaclabel, > .secid_to_secctx = smack_secid_to_secctx, > .secctx_to_secid = smack_secctx_to_secid, > .release_secctx = smack_release_secctx, -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Fri, Mar 29, 2013 at 07:43:00AM -0400, Mimi Zohar wrote: > On Thu, 2013-03-28 at 09:53 -0400, Steve Dickson wrote: > > From: David Quigley <dpquigl@davequigley.com> > > > > The interface to request security labels from user space is the xattr > > interface. When requesting the security label from an NFS server it is > > important to make sure the requested xattr actually is a MAC label. This allows > > us to make sure that we get the desired semantics from the attribute instead of > > something else such as capabilities or a time based LSM. > > > > Signed-off-by: Matthew N. Dodd <Matthew.Dodd@sparta.com> > > Signed-off-by: Miguel Rodel Felipe <Rodel_FM@dsi.a-star.edu.sg> > > Signed-off-by: Phua Eu Gene <PHUA_Eu_Gene@dsi.a-star.edu.sg> > > Signed-off-by: Khin Mi Mi Aung <Mi_Mi_AUNG@dsi.a-star.edu.sg> > > --- > > include/linux/security.h | 14 ++++++++++++++ > > security/capability.c | 6 ++++++ > > security/security.c | 6 ++++++ > > security/selinux/hooks.c | 6 ++++++ > > security/smack/smack_lsm.c | 11 +++++++++++ > > 5 files changed, 43 insertions(+) > > > > diff --git a/include/linux/security.h b/include/linux/security.h > > index a957e7a..8a6faff 100644 > > --- a/include/linux/security.h > > +++ b/include/linux/security.h > > @@ -1319,6 +1319,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) > > * @pages contains the number of pages. > > * Return 0 if permission is granted. > > * > > + * @ismaclabel: > > + * Check if the extended attribute specified by @name > > + * represents a MAC label. Returns 0 if name is a MAC > > + * attribute otherwise returns non-zero. > > Sorry, the comment doesn't match the code. Yeah, that looks backwards. Confirmed by looking at an implementation: > > +static int selinux_ismaclabel(const char *name) > > +{ > > + return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0); > > +} > > + Could we also make the return value bool to make it even less ambiguous? --b. -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 29/03/13 07:43, Mimi Zohar wrote: > On Thu, 2013-03-28 at 09:53 -0400, Steve Dickson wrote: >> From: David Quigley <dpquigl@davequigley.com> >> >> The interface to request security labels from user space is the xattr >> interface. When requesting the security label from an NFS server it is >> important to make sure the requested xattr actually is a MAC label. This allows >> us to make sure that we get the desired semantics from the attribute instead of >> something else such as capabilities or a time based LSM. >> >> Signed-off-by: Matthew N. Dodd <Matthew.Dodd@sparta.com> >> Signed-off-by: Miguel Rodel Felipe <Rodel_FM@dsi.a-star.edu.sg> >> Signed-off-by: Phua Eu Gene <PHUA_Eu_Gene@dsi.a-star.edu.sg> >> Signed-off-by: Khin Mi Mi Aung <Mi_Mi_AUNG@dsi.a-star.edu.sg> >> --- >> include/linux/security.h | 14 ++++++++++++++ >> security/capability.c | 6 ++++++ >> security/security.c | 6 ++++++ >> security/selinux/hooks.c | 6 ++++++ >> security/smack/smack_lsm.c | 11 +++++++++++ >> 5 files changed, 43 insertions(+) >> >> diff --git a/include/linux/security.h b/include/linux/security.h >> index a957e7a..8a6faff 100644 >> --- a/include/linux/security.h >> +++ b/include/linux/security.h >> @@ -1319,6 +1319,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) >> * @pages contains the number of pages. >> * Return 0 if permission is granted. >> * >> + * @ismaclabel: >> + * Check if the extended attribute specified by @name >> + * represents a MAC label. Returns 0 if name is a MAC >> + * attribute otherwise returns non-zero. > > Sorry, the comment doesn't match the code. Nice catch! thanks! steved. > > Mimi > >> + * @name full extended attribute name to check against >> + * LSM as a MAC label. >> + * > > >> * @secid_to_secctx: >> * Convert secid to security context. If secdata is NULL the length of >> * the result will be returned in seclen, but no secdata will be returned. >> @@ -1600,6 +1607,7 @@ struct security_operations { >> >> int (*getprocattr) (struct task_struct *p, char *name, char **value); >> int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t size); >> + int (*ismaclabel) (const char *name); >> int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen); >> int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid); >> void (*release_secctx) (char *secdata, u32 seclen); >> @@ -1852,6 +1860,7 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode); >> int security_getprocattr(struct task_struct *p, char *name, char **value); >> int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size); >> int security_netlink_send(struct sock *sk, struct sk_buff *skb); >> +int security_ismaclabel(const char *name); >> int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen); >> int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); >> void security_release_secctx(char *secdata, u32 seclen); >> @@ -2540,6 +2549,11 @@ static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb) >> return cap_netlink_send(sk, skb); >> } >> >> +static inline int security_ismaclabel(const char *name) >> +{ >> + return 0; >> +} >> + >> static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) >> { >> return -EOPNOTSUPP; >> diff --git a/security/capability.c b/security/capability.c >> index 456bd9d..07a6484 100644 >> --- a/security/capability.c >> +++ b/security/capability.c >> @@ -817,6 +817,11 @@ static int cap_setprocattr(struct task_struct *p, char *name, void *value, >> return -EINVAL; >> } >> >> +static int cap_ismaclabel(const char *name) >> +{ >> + return 0; >> +} >> + >> static int cap_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) >> { >> return -EOPNOTSUPP; >> @@ -1036,6 +1041,7 @@ void __init security_fixup_ops(struct security_operations *ops) >> set_to_cap_if_null(ops, d_instantiate); >> set_to_cap_if_null(ops, getprocattr); >> set_to_cap_if_null(ops, setprocattr); >> + set_to_cap_if_null(ops, ismaclabel); >> set_to_cap_if_null(ops, secid_to_secctx); >> set_to_cap_if_null(ops, secctx_to_secid); >> set_to_cap_if_null(ops, release_secctx); >> diff --git a/security/security.c b/security/security.c >> index 723a10c..6d7389c 100644 >> --- a/security/security.c >> +++ b/security/security.c >> @@ -1057,6 +1057,12 @@ int security_netlink_send(struct sock *sk, struct sk_buff *skb) >> return security_ops->netlink_send(sk, skb); >> } >> >> +int security_ismaclabel(const char *name) >> +{ >> + return security_ops->ismaclabel(name); >> +} >> +EXPORT_SYMBOL(security_ismaclabel); >> + >> int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) >> { >> return security_ops->secid_to_secctx(secid, secdata, seclen); >> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c >> index c7f1905..97231a0 100644 >> --- a/security/selinux/hooks.c >> +++ b/security/selinux/hooks.c >> @@ -5417,6 +5417,11 @@ abort_change: >> return error; >> } >> >> +static int selinux_ismaclabel(const char *name) >> +{ >> + return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0); >> +} >> + >> static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) >> { >> return security_sid_to_context(secid, secdata, seclen); >> @@ -5655,6 +5660,7 @@ static struct security_operations selinux_ops = { >> .getprocattr = selinux_getprocattr, >> .setprocattr = selinux_setprocattr, >> >> + .ismaclabel = selinux_ismaclabel, >> .secid_to_secctx = selinux_secid_to_secctx, >> .secctx_to_secid = selinux_secctx_to_secid, >> .release_secctx = selinux_release_secctx, >> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c >> index fa64740..ca01d71 100644 >> --- a/security/smack/smack_lsm.c >> +++ b/security/smack/smack_lsm.c >> @@ -3329,6 +3329,16 @@ static void smack_audit_rule_free(void *vrule) >> #endif /* CONFIG_AUDIT */ >> >> /** >> + * smack_ismaclabel - check if xattr @name references a smack MAC label >> + * @name: Full xattr name to check. >> + */ >> +static int smack_ismaclabel(const char *name) >> +{ >> + return (strcmp(name, XATTR_SMACK_SUFFIX) == 0); >> +} >> + >> + >> +/** >> * smack_secid_to_secctx - return the smack label for a secid >> * @secid: incoming integer >> * @secdata: destination >> @@ -3524,6 +3534,7 @@ struct security_operations smack_ops = { >> .audit_rule_free = smack_audit_rule_free, >> #endif /* CONFIG_AUDIT */ >> >> + .ismaclabel = smack_ismaclabel, >> .secid_to_secctx = smack_secid_to_secctx, >> .secctx_to_secid = smack_secctx_to_secid, >> .release_secctx = smack_release_secctx, > > > -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/include/linux/security.h b/include/linux/security.h index a957e7a..8a6faff 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1319,6 +1319,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) * @pages contains the number of pages. * Return 0 if permission is granted. * + * @ismaclabel: + * Check if the extended attribute specified by @name + * represents a MAC label. Returns 0 if name is a MAC + * attribute otherwise returns non-zero. + * @name full extended attribute name to check against + * LSM as a MAC label. + * * @secid_to_secctx: * Convert secid to security context. If secdata is NULL the length of * the result will be returned in seclen, but no secdata will be returned. @@ -1600,6 +1607,7 @@ struct security_operations { int (*getprocattr) (struct task_struct *p, char *name, char **value); int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t size); + int (*ismaclabel) (const char *name); int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen); int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid); void (*release_secctx) (char *secdata, u32 seclen); @@ -1852,6 +1860,7 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode); int security_getprocattr(struct task_struct *p, char *name, char **value); int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size); int security_netlink_send(struct sock *sk, struct sk_buff *skb); +int security_ismaclabel(const char *name); int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen); int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); void security_release_secctx(char *secdata, u32 seclen); @@ -2540,6 +2549,11 @@ static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb) return cap_netlink_send(sk, skb); } +static inline int security_ismaclabel(const char *name) +{ + return 0; +} + static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) { return -EOPNOTSUPP; diff --git a/security/capability.c b/security/capability.c index 456bd9d..07a6484 100644 --- a/security/capability.c +++ b/security/capability.c @@ -817,6 +817,11 @@ static int cap_setprocattr(struct task_struct *p, char *name, void *value, return -EINVAL; } +static int cap_ismaclabel(const char *name) +{ + return 0; +} + static int cap_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) { return -EOPNOTSUPP; @@ -1036,6 +1041,7 @@ void __init security_fixup_ops(struct security_operations *ops) set_to_cap_if_null(ops, d_instantiate); set_to_cap_if_null(ops, getprocattr); set_to_cap_if_null(ops, setprocattr); + set_to_cap_if_null(ops, ismaclabel); set_to_cap_if_null(ops, secid_to_secctx); set_to_cap_if_null(ops, secctx_to_secid); set_to_cap_if_null(ops, release_secctx); diff --git a/security/security.c b/security/security.c index 723a10c..6d7389c 100644 --- a/security/security.c +++ b/security/security.c @@ -1057,6 +1057,12 @@ int security_netlink_send(struct sock *sk, struct sk_buff *skb) return security_ops->netlink_send(sk, skb); } +int security_ismaclabel(const char *name) +{ + return security_ops->ismaclabel(name); +} +EXPORT_SYMBOL(security_ismaclabel); + int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) { return security_ops->secid_to_secctx(secid, secdata, seclen); diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index c7f1905..97231a0 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -5417,6 +5417,11 @@ abort_change: return error; } +static int selinux_ismaclabel(const char *name) +{ + return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0); +} + static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) { return security_sid_to_context(secid, secdata, seclen); @@ -5655,6 +5660,7 @@ static struct security_operations selinux_ops = { .getprocattr = selinux_getprocattr, .setprocattr = selinux_setprocattr, + .ismaclabel = selinux_ismaclabel, .secid_to_secctx = selinux_secid_to_secctx, .secctx_to_secid = selinux_secctx_to_secid, .release_secctx = selinux_release_secctx, diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index fa64740..ca01d71 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -3329,6 +3329,16 @@ static void smack_audit_rule_free(void *vrule) #endif /* CONFIG_AUDIT */ /** + * smack_ismaclabel - check if xattr @name references a smack MAC label + * @name: Full xattr name to check. + */ +static int smack_ismaclabel(const char *name) +{ + return (strcmp(name, XATTR_SMACK_SUFFIX) == 0); +} + + +/** * smack_secid_to_secctx - return the smack label for a secid * @secid: incoming integer * @secdata: destination @@ -3524,6 +3534,7 @@ struct security_operations smack_ops = { .audit_rule_free = smack_audit_rule_free, #endif /* CONFIG_AUDIT */ + .ismaclabel = smack_ismaclabel, .secid_to_secctx = smack_secid_to_secctx, .secctx_to_secid = smack_secctx_to_secid, .release_secctx = smack_release_secctx,