From patchwork Thu Feb 28 22:18:19 2019 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10833905 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id EA5E549E6 for ; Thu, 28 Feb 2019 22:20:15 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id D2F6A2F512 for ; Thu, 28 Feb 2019 22:20:13 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id C71E52A62A; Thu, 28 Feb 2019 22:20:13 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8C0EA2F3CC for ; Thu, 28 Feb 2019 22:20:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1729668AbfB1WUH (ORCPT ); Thu, 28 Feb 2019 17:20:07 -0500 Received: from sonic309-27.consmr.mail.gq1.yahoo.com ([98.137.65.153]:33105 "EHLO sonic309-27.consmr.mail.gq1.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1729615AbfB1WUB (ORCPT ); Thu, 28 Feb 2019 17:20:01 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1551392400; bh=e2Zr2FG9sfFjX/bU49iDB+XEpXaQ7bM5zLunLaV8ZcY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From:Subject; b=fw5e5JVVG8lQVbnyFxtfimZ5JEqsGLlwz3O0hMgggJzrhsndKCBUzQfu/WxDYG2hDlPHTs+4LB+k4cE7mkvk/kYrL1THIeyriCpnOfuHtxwcwcXbsU1xiMzcjct1udhryXqHlFszqEZr0M1qcaBjaqPodHwdjva+TabdiN4fEXq/XTIHC+5BFTLrO4GUWm5EMjAFtnHF7aPLi8EkJBHEd5JFh3lVgbX0f9hHWOI/cKb5MwLkZiG4QnOPh2gvNO/VQPOwVoXvLDd6deaBVKgXBgfu0Wkc3XAeTUhYKA2G4R707jgxONyo5f3okh/jQr7F4SF+znz14i1T0n85+9G8jw== X-YMail-OSG: ODgGva0VM1n.s4TqBLXoLQ74N5ChuYwTK_BSjwWkjqHmXW_vUb79wqOEgEaLycy OhcFHZKUDqEHjhUIYAFCYwK5mVMJZsqEpWY_iRaJMIrzxUT.LXbvf3YrZk6hwCftgOWboLQcKACb HFXrNDbJ8VCixnh9vrhagfKniwMiHKhJlSY3bXi5ubm0Ldy9iceB4vHK3xCedlQtPowlABHLWhtN 2XBrh4buUb3x2Em1CuKf5.swER9rXT0StoENbmjR7FUn43uzExzwJWJ_koj_IL_BEqzkUfS5ojZJ TZtSPacvZZcnKNd8xcWnDLpF0OgXuU8rP9GDL0rHDQAm8JDvvXa7SedI1rvtrVQ2Ntiokvkc6nAb KO50xtPFPfs4KqP73qKE8R9Pp2IwuTR5VSvhOHr5XBSe7ystWozcGgsdErg5n4HMYY88PRK7JdhK MiegmDMJPL60l9VUY4QNPxXaJUp09DWCxn6kdFvstV.Vq2vu6hNLgs5zkxvU2qFL4TboSsNAnwrW 9nQBTHKaRmbEeF.3vvFrs6R5EOSibrGqyhcrXlkM7wvRucZ.ImMHTXCpXgaMQkcUbC9GFDC_nUau dmaqVcl7ydxstiNZ3RGLcFVrYSi4.mKTPYoht6SpBdh_yl6nrZYS0Z2MIUreQxy8TXL_e_xq_qM7 a3XOczlutZfhoznMSzN7qFp_qc4EsrjQZArgpbpS0rcts05ZRWZ0N64zgEcnkKL9lLbopRUFSlaL 69mQa68BpyMCGny3pveRMNhEDV0vQ7AjY8ETwQCg1X.q6ZgtcE62ycZEuMD8baLppRKxT1gAGBYe SHBWr8HrsNPbqlj4MXgtKrtHEGN3qvmTIVoGAi_03D_Shr0spkvTx.kNqjhak2MmIEPq2IuJxxG_ piHG29T73E_oLsKjxDW7EVPaH_IHvL.zN9bIQHqOrbR3GLWBMKeOD7FAWyUfeKApauJLY7R_QUrh OQMl3IdT4bPbP81YHm9x.bkTaBXZVEk.7lEY6hPl7W5j3MBs8vYhnLL4hYUzrlXG5ovglFWRae4a 6Fl.skhYNHyvSAOEeAZ8Y9_PR8EnWUGZHf8VKMxm6c8Q_T_JUN5ALfaru5zMSB3goiEA.lAEYhVe Wc4WHb6zMwM9n651EFnkTm8iFMLSbzzduXYqPFeOyy_B81_0- Received: from sonic.gate.mail.ne1.yahoo.com by sonic309.consmr.mail.gq1.yahoo.com with HTTP; Thu, 28 Feb 2019 22:20:00 +0000 Received: from c-67-169-65-224.hsd1.ca.comcast.net (EHLO localhost.localdomain) ([67.169.65.224]) by smtp406.mail.gq1.yahoo.com (Oath Hermes SMTP Server) with ESMTPA ID 5c7d685bea94a92cc9d12c4cc22f1f0e; Thu, 28 Feb 2019 22:19:57 +0000 (UTC) From: Casey Schaufler To: jmorris@namei.org, linux-security-module@vger.kernel.org, selinux@vger.kernel.org Cc: keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, paul@paul-moore.com Subject: [PATCH 23/97] LSM: Use lsm_export in security_task_getsecid Date: Thu, 28 Feb 2019 14:18:19 -0800 Message-Id: <20190228221933.2551-24-casey@schaufler-ca.com> X-Mailer: git-send-email 2.17.0 In-Reply-To: <20190228221933.2551-1-casey@schaufler-ca.com> References: <20190228221933.2551-1-casey@schaufler-ca.com> Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Convert security_task_getsecid to use the lsm_export structure instead of a u32 secid. There is some scaffolding involved that will be removed when the related data is updated. Signed-off-by: Casey Schaufler --- include/linux/security.h | 7 ++++--- kernel/audit.c | 4 ++-- kernel/auditfilter.c | 4 +--- kernel/auditsc.c | 18 +++++++++++------- net/netlabel/netlabel_unlabeled.c | 4 +++- net/netlabel/netlabel_user.h | 5 ++++- security/integrity/ima/ima_appraise.c | 4 +++- security/integrity/ima/ima_main.c | 16 ++++++++++++---- security/security.c | 8 +++----- 9 files changed, 43 insertions(+), 27 deletions(-) diff --git a/include/linux/security.h b/include/linux/security.h index 48ad03f6631e..d6c56bbebc84 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -389,7 +389,7 @@ int security_task_fix_setuid(struct cred *new, const struct cred *old, int security_task_setpgid(struct task_struct *p, pid_t pgid); int security_task_getpgid(struct task_struct *p); int security_task_getsid(struct task_struct *p); -void security_task_getsecid(struct task_struct *p, u32 *secid); +void security_task_getsecid(struct task_struct *p, struct lsm_export *l); int security_task_setnice(struct task_struct *p, int nice); int security_task_setioprio(struct task_struct *p, int ioprio); int security_task_getioprio(struct task_struct *p); @@ -1007,9 +1007,10 @@ static inline int security_task_getsid(struct task_struct *p) return 0; } -static inline void security_task_getsecid(struct task_struct *p, u32 *secid) +static inline void security_task_getsecid(struct task_struct *p, + struct lsm_export *l) { - *secid = 0; + lsm_export_init(l); } static inline int security_task_setnice(struct task_struct *p, int nice) diff --git a/kernel/audit.c b/kernel/audit.c index aeed1368a166..32753b1e686a 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -2214,11 +2214,11 @@ int audit_log_task_context(struct audit_buffer *ab) u32 sid; struct lsm_export le; - security_task_getsecid(current, &sid); + security_task_getsecid(current, &le); + lsm_export_secid(&le, &sid); if (!sid) return 0; - lsm_export_to_all(&le, sid); error = security_secid_to_secctx(&le, &ctx, &len); if (error) { if (error != -EINVAL) diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c index c784dfa9fa23..223e5e949247 100644 --- a/kernel/auditfilter.c +++ b/kernel/auditfilter.c @@ -1323,7 +1323,6 @@ int audit_filter(int msgtype, unsigned int listtype) for (i = 0; i < e->rule.field_count; i++) { struct audit_field *f = &e->rule.fields[i]; pid_t pid; - u32 sid; struct lsm_export le; switch (f->type) { @@ -1354,8 +1353,7 @@ int audit_filter(int msgtype, unsigned int listtype) case AUDIT_SUBJ_SEN: case AUDIT_SUBJ_CLR: if (f->lsm_rule) { - security_task_getsecid(current, &sid); - lsm_export_to_all(&le, sid); + security_task_getsecid(current, &le); result = security_audit_rule_match(&le, f->type, f->op, f->lsm_rule, NULL); } diff --git a/kernel/auditsc.c b/kernel/auditsc.c index 6a991e4b1492..8f0748395ae7 100644 --- a/kernel/auditsc.c +++ b/kernel/auditsc.c @@ -444,7 +444,6 @@ static int audit_filter_rules(struct task_struct *tsk, { const struct cred *cred; int i, need_sid = 1; - u32 sid; struct lsm_export le; unsigned int sessionid; @@ -628,10 +627,9 @@ static int audit_filter_rules(struct task_struct *tsk, logged upon error */ if (f->lsm_rule) { if (need_sid) { - security_task_getsecid(tsk, &sid); + security_task_getsecid(tsk, &le); need_sid = 0; } - lsm_export_to_all(&le, sid); result = security_audit_rule_match(&le, f->type, f->op, f->lsm_rule, @@ -2262,12 +2260,14 @@ int __audit_sockaddr(int len, void *a) void __audit_ptrace(struct task_struct *t) { struct audit_context *context = audit_context(); + struct lsm_export le; context->target_pid = task_tgid_nr(t); context->target_auid = audit_get_loginuid(t); context->target_uid = task_uid(t); context->target_sessionid = audit_get_sessionid(t); - security_task_getsecid(t, &context->target_sid); + security_task_getsecid(t, &le); + lsm_export_secid(&le, &context->target_sid); memcpy(context->target_comm, t->comm, TASK_COMM_LEN); } @@ -2284,6 +2284,7 @@ int audit_signal_info(int sig, struct task_struct *t) struct audit_aux_data_pids *axp; struct audit_context *ctx = audit_context(); kuid_t uid = current_uid(), auid, t_uid = task_uid(t); + struct lsm_export le; if (auditd_test_task(t) && (sig == SIGTERM || sig == SIGHUP || @@ -2294,7 +2295,8 @@ int audit_signal_info(int sig, struct task_struct *t) audit_sig_uid = auid; else audit_sig_uid = uid; - security_task_getsecid(current, &audit_sig_sid); + security_task_getsecid(current, &le); + lsm_export_secid(&le, &audit_sig_sid); } if (!audit_signals || audit_dummy_context()) @@ -2307,7 +2309,8 @@ int audit_signal_info(int sig, struct task_struct *t) ctx->target_auid = audit_get_loginuid(t); ctx->target_uid = t_uid; ctx->target_sessionid = audit_get_sessionid(t); - security_task_getsecid(t, &ctx->target_sid); + security_task_getsecid(t, &le); + lsm_export_secid(&le, &ctx->target_sid); memcpy(ctx->target_comm, t->comm, TASK_COMM_LEN); return 0; } @@ -2328,7 +2331,8 @@ int audit_signal_info(int sig, struct task_struct *t) axp->target_auid[axp->pid_count] = audit_get_loginuid(t); axp->target_uid[axp->pid_count] = t_uid; axp->target_sessionid[axp->pid_count] = audit_get_sessionid(t); - security_task_getsecid(t, &axp->target_sid[axp->pid_count]); + security_task_getsecid(t, &le); + lsm_export_secid(&le, &axp->target_sid[axp->pid_count]); memcpy(axp->target_comm[axp->pid_count], t->comm, TASK_COMM_LEN); axp->pid_count++; diff --git a/net/netlabel/netlabel_unlabeled.c b/net/netlabel/netlabel_unlabeled.c index 00922f55dd9e..7f245d593c8f 100644 --- a/net/netlabel/netlabel_unlabeled.c +++ b/net/netlabel/netlabel_unlabeled.c @@ -1554,11 +1554,13 @@ int __init netlbl_unlabel_defconf(void) int ret_val; struct netlbl_dom_map *entry; struct netlbl_audit audit_info; + struct lsm_export le; /* Only the kernel is allowed to call this function and the only time * it is called is at bootup before the audit subsystem is reporting * messages so don't worry to much about these values. */ - security_task_getsecid(current, &audit_info.secid); + security_task_getsecid(current, &le); + lsm_export_secid(&le, &audit_info.secid); audit_info.loginuid = GLOBAL_ROOT_UID; audit_info.sessionid = 0; diff --git a/net/netlabel/netlabel_user.h b/net/netlabel/netlabel_user.h index 4a397cde1a48..2dbc4276bdcc 100644 --- a/net/netlabel/netlabel_user.h +++ b/net/netlabel/netlabel_user.h @@ -48,7 +48,10 @@ static inline void netlbl_netlink_auditinfo(struct sk_buff *skb, struct netlbl_audit *audit_info) { - security_task_getsecid(current, &audit_info->secid); + struct lsm_export le; + + security_task_getsecid(current, &le); + lsm_export_secid(&le, &audit_info->secid); audit_info->loginuid = audit_get_loginuid(current); audit_info->sessionid = audit_get_sessionid(current); } diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c index a2baa85ea2f5..d0580a1f157e 100644 --- a/security/integrity/ima/ima_appraise.c +++ b/security/integrity/ima/ima_appraise.c @@ -51,11 +51,13 @@ bool is_ima_appraise_enabled(void) int ima_must_appraise(struct inode *inode, int mask, enum ima_hooks func) { u32 secid; + struct lsm_export le; if (!ima_appraise) return 0; - security_task_getsecid(current, &secid); + security_task_getsecid(current, &le); + lsm_export_secid(&le, &secid); return ima_match_policy(inode, current_cred(), secid, func, mask, IMA_APPRAISE | IMA_HASH, NULL); } diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c index 4ffac4f5c647..e78658b26a74 100644 --- a/security/integrity/ima/ima_main.c +++ b/security/integrity/ima/ima_main.c @@ -336,9 +336,11 @@ static int process_measurement(struct file *file, const struct cred *cred, int ima_file_mmap(struct file *file, unsigned long prot) { u32 secid; + struct lsm_export le; if (file && (prot & PROT_EXEC)) { - security_task_getsecid(current, &secid); + security_task_getsecid(current, &le); + lsm_export_secid(&le, &secid); return process_measurement(file, current_cred(), secid, NULL, 0, MAY_EXEC, MMAP_CHECK); } @@ -363,8 +365,10 @@ int ima_bprm_check(struct linux_binprm *bprm) { int ret; u32 secid; + struct lsm_export le; - security_task_getsecid(current, &secid); + security_task_getsecid(current, &le); + lsm_export_secid(&le, &secid); ret = process_measurement(bprm->file, current_cred(), secid, NULL, 0, MAY_EXEC, BPRM_CHECK); if (ret) @@ -388,8 +392,10 @@ int ima_bprm_check(struct linux_binprm *bprm) int ima_file_check(struct file *file, int mask) { u32 secid; + struct lsm_export le; - security_task_getsecid(current, &secid); + security_task_getsecid(current, &le); + lsm_export_secid(&le, &secid); return process_measurement(file, current_cred(), secid, NULL, 0, mask & (MAY_READ | MAY_WRITE | MAY_EXEC | MAY_APPEND), FILE_CHECK); @@ -469,6 +475,7 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size, { enum ima_hooks func; u32 secid; + struct lsm_export le; if (!file && read_id == READING_FIRMWARE) { if ((ima_appraise & IMA_APPRAISE_FIRMWARE) && @@ -490,7 +497,8 @@ int ima_post_read_file(struct file *file, void *buf, loff_t size, } func = read_idmap[read_id] ?: FILE_CHECK; - security_task_getsecid(current, &secid); + security_task_getsecid(current, &le); + lsm_export_secid(&le, &secid); return process_measurement(file, current_cred(), secid, buf, size, MAY_READ, func); } diff --git a/security/security.c b/security/security.c index 8e4cdc88acce..a0767f8d7822 100644 --- a/security/security.c +++ b/security/security.c @@ -1676,12 +1676,10 @@ int security_task_getsid(struct task_struct *p) return call_int_hook(task_getsid, 0, p); } -void security_task_getsecid(struct task_struct *p, u32 *secid) +void security_task_getsecid(struct task_struct *p, struct lsm_export *l) { - struct lsm_export data = { .flags = LSM_EXPORT_NONE }; - - call_void_hook(task_getsecid, p, &data); - lsm_export_secid(&data, secid); + lsm_export_init(l); + call_void_hook(task_getsecid, p, l); } EXPORT_SYMBOL(security_task_getsecid);