From patchwork Thu Mar 8 01:53:03 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10265807 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 91D16602C8 for ; Thu, 8 Mar 2018 01:53:12 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 830052941F for ; Thu, 8 Mar 2018 01:53:12 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 7799929562; Thu, 8 Mar 2018 01:53:12 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id E716429557 for ; Thu, 8 Mar 2018 01:53:11 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934059AbeCHBxL (ORCPT ); Wed, 7 Mar 2018 20:53:11 -0500 Received: from sonic317-41.consmr.mail.ne1.yahoo.com ([66.163.184.52]:44737 "EHLO sonic317-41.consmr.mail.ne1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S933351AbeCHBxK (ORCPT ); Wed, 7 Mar 2018 20:53:10 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1520473990; bh=Q+mTlj2ANj0UCf4y67bEBg2QM8kvlCq6CvjOSv3u2vs=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From:Subject; b=RMCqymZuDAfZly8DfIouaGpMv9Z7P3e0pGkB/bRqhiXQOt14wUjcMKfqbsuTWPuiIuh1VuN3cAHARRk8OMfVVf+hOYbIWppUZ4toJwTQPW9tGidDxsJcuVY99FG62IhM+Kns8woRvwQ4IHYqbvBrmqhYu6qqb22a8bmxFKk/ccvCIAzkN7Go7i7rHfvAs9BXkhmhLJ4G25rX2G5fWSeEHhkhDpOY1Cz75WkT7xDcCF+sEi9Hn3j5homi6xNoKZXHVZ2AHwIR4cEVI3/mRVvYKmayCqaGbZk6wE7Y/drE2F+Ign2qX5IeNF1j4QOJjSwfdaCU+FbBR1MVCs/W9p/IvQ== X-YMail-OSG: _pdnCKUVM1lbe2adwJT758NJ5g4pOsiemIhPJO1LQG0N8dUwpxrRtaYi8XYtC8j SvTshcoY85h7UK.mwycHGS4Er4TnVEoB6yeQfWxP74kpg94RbGnKL72eflgRqHLxl3kfm6IB5Env mikXPYZP0eiOuY_00330.VD8JNm.hL54fOEDs4wLzpLaX5M1TSj94WMYNvybcEbhVKwoR.cT1T6E 1Pkrn5GjKmGKoAqd5QlRLUB8HqZflX.8UE4FbjP02dm54EkbEzbYD2qJIc8bMA5wQRVxVgRK4HQu Ea.tZVsxMatAfD0ilHwPzB.W1dvSqhRhRxkVZn1panIrszdY5a53DU0ETX_Tz9Sm9DfvgZUOVytp Vn0RrDqMfY5p4cTYtY8hD9NuUrrGXOE4BgSE9rge0lKjGEySUZpbY.5poSKg2uXMluZyVP9J4YV2 ZmmUjsJ0igc4UyMXiUQoxbUAtdIspBdpIXgNZGffsZf52ra_P88Ne6iuMd7j39MDv6lTiJeXXp0s TRnVOn18FZbn18EYTOnJoQl0x7M0fQp5_2pVqoujSLCaFzbwy_fePQxembObOjb_l Received: from sonic.gate.mail.ne1.yahoo.com by sonic317.consmr.mail.ne1.yahoo.com with HTTP; Thu, 8 Mar 2018 01:53:10 +0000 Received: from smtp228.mail.ne1.yahoo.com (EHLO [192.168.0.104]) ([10.218.253.213]) by smtp404.mail.ne1.yahoo.com (JAMES SMTP Server ) with ESMTPA ID 01884aac77efefa9c18a3e84f908a318; Thu, 08 Mar 2018 01:53:06 +0000 (UTC) Subject: [PATCH 4/8] LSM: Manage task security blobs To: LSM , James Morris Cc: John Johansen , Tetsuo Handa , Paul Moore , Kees Cook , Stephen Smalley , SE Linux , SMACK-announce@lists.01.org, Casey Schaufler References: From: Casey Schaufler Message-ID: <14eeb676-17cf-dd58-4c01-01a4a5a4e651@schaufler-ca.com> Date: Wed, 7 Mar 2018 17:53:03 -0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.6.0 MIME-Version: 1.0 In-Reply-To: Content-Language: en-US Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Subject: [PATCH 4/8] LSM: Manage task security blobs Move management of task security blobs into the security infrastructure. Modules are required to identify the space they require. At this time there are no modules that use task blobs. Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 1 + security/security.c | 35 ++++++++++++++++++++++++++++++++++- 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index 417a8946201a..da09168e4daa 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -1975,6 +1975,7 @@ struct security_hook_list { struct lsm_blob_sizes { int lbs_cred; int lbs_file; + int lbs_task; }; /* diff --git a/security/security.c b/security/security.c index 90d09d8542d4..8d6738f384fa 100644 --- a/security/security.c +++ b/security/security.c @@ -102,6 +102,7 @@ int __init security_init(void) #ifdef CONFIG_SECURITY_LSM_DEBUG pr_info("LSM: cred blob size = %d\n", blob_sizes.lbs_cred); pr_info("LSM: file blob size = %d\n", blob_sizes.lbs_file); + pr_info("LSM: task blob size = %d\n", blob_sizes.lbs_task); #endif return 0; @@ -277,6 +278,7 @@ void __init security_add_blobs(struct lsm_blob_sizes *needed) { lsm_set_size(&needed->lbs_cred, &blob_sizes.lbs_cred); lsm_set_size(&needed->lbs_file, &blob_sizes.lbs_file); + lsm_set_size(&needed->lbs_task, &blob_sizes.lbs_task); } /** @@ -300,6 +302,27 @@ int lsm_file_alloc(struct file *file) return 0; } +/** + * lsm_task_alloc - allocate a composite task blob + * @task: the task that needs a blob + * + * Allocate the task blob for all the modules + * + * Returns 0, or -ENOMEM if memory can't be allocated. + */ +int lsm_task_alloc(struct task_struct *task) +{ + if (blob_sizes.lbs_task == 0) { + task->security = NULL; + return 0; + } + + task->security = kzalloc(blob_sizes.lbs_task, GFP_KERNEL); + if (task->security == NULL) + return -ENOMEM; + return 0; +} + /* * Hook list operation macros. * @@ -1106,12 +1129,22 @@ int security_file_open(struct file *file, const struct cred *cred) int security_task_alloc(struct task_struct *task, unsigned long clone_flags) { - return call_int_hook(task_alloc, 0, task, clone_flags); + int rc = lsm_task_alloc(task); + + if (rc) + return rc; + rc = call_int_hook(task_alloc, 0, task, clone_flags); + if (unlikely(rc)) + security_task_free(task); + return rc; } void security_task_free(struct task_struct *task) { call_void_hook(task_free, task); + + kfree(task->security); + task->security = NULL; } int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)