From patchwork Thu Jan 5 22:03:43 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: David Graziano X-Patchwork-Id: 9499737 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 72E2460413 for ; Thu, 5 Jan 2017 22:04:59 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6163827F0B for ; Thu, 5 Jan 2017 22:04:59 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 539A52847C; Thu, 5 Jan 2017 22:04:59 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 793C128472 for ; Thu, 5 Jan 2017 22:04:58 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1161925AbdAEWEz (ORCPT ); Thu, 5 Jan 2017 17:04:55 -0500 Received: from secvs02.rockwellcollins.com ([205.175.225.241]:2029 "EHLO secvs02.rockwellcollins.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1161924AbdAEWEv (ORCPT ); Thu, 5 Jan 2017 17:04:51 -0500 Received: from ofwgwc03.rockwellcollins.com (HELO dtulimr01.rockwellcollins.com) ([205.175.225.12]) by secvs02.rockwellcollins.com with ESMTP; 05 Jan 2017 16:04:04 -0600 X-Received: from thehammer.rockwellcollins.com (unknown [192.168.141.197]) by dtulimr01.rockwellcollins.com (Postfix) with ESMTP id 0DCBA62675; Thu, 5 Jan 2017 16:04:04 -0600 (CST) From: David Graziano To: linux-security-module@vger.kernel.org, paul@paul-moore.com Cc: agruenba@redhat.com, hch@infradead.org, linux-mm@kvack.org, sds@tycho.nsa.gov, linux-kernel@vger.kernel.org, David Graziano Subject: [PATCH v4 3/3] mqueue: Implement generic xattr support Date: Thu, 5 Jan 2017 16:03:43 -0600 Message-Id: <1483653823-22018-4-git-send-email-david.graziano@rockwellcollins.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1483653823-22018-1-git-send-email-david.graziano@rockwellcollins.com> References: <1483653823-22018-1-git-send-email-david.graziano@rockwellcollins.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Adds support for generic extended attributes within the POSIX message queues filesystem and setting them by consulting the LSM. This is needed so that the security.selinux extended attribute can be set via a SELinux named type transition on file inodes created within the filesystem. It allows a selinux policy to be created for a set of custom applications that use POSIX message queues for their IPC and uniquely labeling them based on the application that creates the mqueue eliminating the need for relabeling after the mqueue file is created. The implementation is based on tmpfs/shmem and uses the newly created simple_xattr_initxattrs() LSM callback function. Signed-off-by: David Graziano --- ipc/mqueue.c | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/ipc/mqueue.c b/ipc/mqueue.c index 0b13ace..32271a0 100644 --- a/ipc/mqueue.c +++ b/ipc/mqueue.c @@ -35,6 +35,7 @@ #include #include #include +#include #include #include "util.h" @@ -70,6 +71,7 @@ struct mqueue_inode_info { struct rb_root msg_tree; struct posix_msg_tree_node *node_cache; struct mq_attr attr; + struct simple_xattrs xattrs; /* list of xattrs */ struct sigevent notify; struct pid *notify_owner; @@ -254,6 +256,7 @@ static struct inode *mqueue_get_inode(struct super_block *sb, info->attr.mq_maxmsg = attr->mq_maxmsg; info->attr.mq_msgsize = attr->mq_msgsize; } + simple_xattrs_init(&info->xattrs); /* * We used to allocate a static array of pointers and account * the size of that array as well as one msg_msg struct per @@ -418,7 +421,8 @@ static int mqueue_create(struct inode *dir, struct dentry *dentry, { struct inode *inode; struct mq_attr *attr = dentry->d_fsdata; - int error; + struct mqueue_inode_info *info; + int error = 0; struct ipc_namespace *ipc_ns; spin_lock(&mq_lock); @@ -443,6 +447,18 @@ static int mqueue_create(struct inode *dir, struct dentry *dentry, ipc_ns->mq_queues_count--; goto out_unlock; } + info = MQUEUE_I(inode); + if (info){ + error = security_inode_init_security(inode, dir, + &dentry->d_name, + simple_xattr_initxattrs, + &info->xattrs); + } + if (error && error != -EOPNOTSUPP) { + spin_lock(&mq_lock); + ipc_ns->mq_queues_count--; + goto out_unlock; + } put_ipc_ns(ipc_ns); dir->i_size += DIRENT_SIZE;