| Message ID | 20230831113803.910630-1-roberto.sassu@huaweicloud.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Paul Moore |
| Headers | show |
| Series | security: Move IMA and EVM to the LSM infrastructure | expand |
On 8/31/2023 4:37 AM, Roberto Sassu wrote: > From: Roberto Sassu <roberto.sassu@huawei.com> > > In preparation for moving IMA and EVM to the LSM infrastructure, introduce > the key_post_create_or_update hook. Repeat of new LSM hook general comment: Would you please include some explanation of how an LSM would use this hook? You might start with a description of how it is used in IMA/EVM, and why that could be generally useful. > > Signed-off-by: Roberto Sassu <roberto.sassu@huawei.com> > Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> > --- > include/linux/lsm_hook_defs.h | 3 +++ > include/linux/security.h | 11 +++++++++++ > security/keys/key.c | 7 ++++++- > security/security.c | 19 +++++++++++++++++++ > 4 files changed, 39 insertions(+), 1 deletion(-) > > diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h > index eedc26790a07..7512b4c46aa8 100644 > --- a/include/linux/lsm_hook_defs.h > +++ b/include/linux/lsm_hook_defs.h > @@ -399,6 +399,9 @@ LSM_HOOK(void, LSM_RET_VOID, key_free, struct key *key) > LSM_HOOK(int, 0, key_permission, key_ref_t key_ref, const struct cred *cred, > enum key_need_perm need_perm) > LSM_HOOK(int, 0, key_getsecurity, struct key *key, char **buffer) > +LSM_HOOK(void, LSM_RET_VOID, key_post_create_or_update, struct key *keyring, > + struct key *key, const void *payload, size_t payload_len, > + unsigned long flags, bool create) > #endif /* CONFIG_KEYS */ > > #ifdef CONFIG_AUDIT > diff --git a/include/linux/security.h b/include/linux/security.h > index e543ae80309b..f50b78481753 100644 > --- a/include/linux/security.h > +++ b/include/linux/security.h > @@ -1959,6 +1959,9 @@ void security_key_free(struct key *key); > int security_key_permission(key_ref_t key_ref, const struct cred *cred, > enum key_need_perm need_perm); > int security_key_getsecurity(struct key *key, char **_buffer); > +void security_key_post_create_or_update(struct key *keyring, struct key *key, > + const void *payload, size_t payload_len, > + unsigned long flags, bool create); > > #else > > @@ -1986,6 +1989,14 @@ static inline int security_key_getsecurity(struct key *key, char **_buffer) > return 0; > } > > +static inline void security_key_post_create_or_update(struct key *keyring, > + struct key *key, > + const void *payload, > + size_t payload_len, > + unsigned long flags, > + bool create) > +{ } > + > #endif > #endif /* CONFIG_KEYS */ > > diff --git a/security/keys/key.c b/security/keys/key.c > index 5c0c7df833f8..0f9c6faf3491 100644 > --- a/security/keys/key.c > +++ b/security/keys/key.c > @@ -934,6 +934,8 @@ static key_ref_t __key_create_or_update(key_ref_t keyring_ref, > goto error_link_end; > } > > + security_key_post_create_or_update(keyring, key, payload, plen, flags, > + true); > ima_post_key_create_or_update(keyring, key, payload, plen, > flags, true); > > @@ -967,10 +969,13 @@ static key_ref_t __key_create_or_update(key_ref_t keyring_ref, > > key_ref = __key_update(key_ref, &prep); > > - if (!IS_ERR(key_ref)) > + if (!IS_ERR(key_ref)) { > + security_key_post_create_or_update(keyring, key, payload, plen, > + flags, false); > ima_post_key_create_or_update(keyring, key, > payload, plen, > flags, false); > + } > > goto error_free_prep; > } > diff --git a/security/security.c b/security/security.c > index 32c3dc34432e..e6783c2f0c65 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -5169,6 +5169,25 @@ int security_key_getsecurity(struct key *key, char **buffer) > *buffer = NULL; > return call_int_hook(key_getsecurity, 0, key, buffer); > } > + > +/** > + * security_key_post_create_or_update() - Notification of key create or update > + * @keyring: keyring to which the key is linked to > + * @key: created or updated key > + * @payload: data used to instantiate or update the key > + * @payload_len: length of payload > + * @flags: key flags > + * @create: flag indicating whether the key was created or updated > + * > + * Notify the caller of a key creation or update. > + */ > +void security_key_post_create_or_update(struct key *keyring, struct key *key, > + const void *payload, size_t payload_len, > + unsigned long flags, bool create) > +{ > + call_void_hook(key_post_create_or_update, keyring, key, payload, > + payload_len, flags, create); > +} > #endif /* CONFIG_KEYS */ > > #ifdef CONFIG_AUDIT
diff --git a/include/linux/lsm_hook_defs.h b/include/linux/lsm_hook_defs.h index eedc26790a07..7512b4c46aa8 100644 --- a/include/linux/lsm_hook_defs.h +++ b/include/linux/lsm_hook_defs.h @@ -399,6 +399,9 @@ LSM_HOOK(void, LSM_RET_VOID, key_free, struct key *key) LSM_HOOK(int, 0, key_permission, key_ref_t key_ref, const struct cred *cred, enum key_need_perm need_perm) LSM_HOOK(int, 0, key_getsecurity, struct key *key, char **buffer) +LSM_HOOK(void, LSM_RET_VOID, key_post_create_or_update, struct key *keyring, + struct key *key, const void *payload, size_t payload_len, + unsigned long flags, bool create) #endif /* CONFIG_KEYS */ #ifdef CONFIG_AUDIT diff --git a/include/linux/security.h b/include/linux/security.h index e543ae80309b..f50b78481753 100644 --- a/include/linux/security.h +++ b/include/linux/security.h @@ -1959,6 +1959,9 @@ void security_key_free(struct key *key); int security_key_permission(key_ref_t key_ref, const struct cred *cred, enum key_need_perm need_perm); int security_key_getsecurity(struct key *key, char **_buffer); +void security_key_post_create_or_update(struct key *keyring, struct key *key, + const void *payload, size_t payload_len, + unsigned long flags, bool create); #else @@ -1986,6 +1989,14 @@ static inline int security_key_getsecurity(struct key *key, char **_buffer) return 0; } +static inline void security_key_post_create_or_update(struct key *keyring, + struct key *key, + const void *payload, + size_t payload_len, + unsigned long flags, + bool create) +{ } + #endif #endif /* CONFIG_KEYS */ diff --git a/security/keys/key.c b/security/keys/key.c index 5c0c7df833f8..0f9c6faf3491 100644 --- a/security/keys/key.c +++ b/security/keys/key.c @@ -934,6 +934,8 @@ static key_ref_t __key_create_or_update(key_ref_t keyring_ref, goto error_link_end; } + security_key_post_create_or_update(keyring, key, payload, plen, flags, + true); ima_post_key_create_or_update(keyring, key, payload, plen, flags, true); @@ -967,10 +969,13 @@ static key_ref_t __key_create_or_update(key_ref_t keyring_ref, key_ref = __key_update(key_ref, &prep); - if (!IS_ERR(key_ref)) + if (!IS_ERR(key_ref)) { + security_key_post_create_or_update(keyring, key, payload, plen, + flags, false); ima_post_key_create_or_update(keyring, key, payload, plen, flags, false); + } goto error_free_prep; } diff --git a/security/security.c b/security/security.c index 32c3dc34432e..e6783c2f0c65 100644 --- a/security/security.c +++ b/security/security.c @@ -5169,6 +5169,25 @@ int security_key_getsecurity(struct key *key, char **buffer) *buffer = NULL; return call_int_hook(key_getsecurity, 0, key, buffer); } + +/** + * security_key_post_create_or_update() - Notification of key create or update + * @keyring: keyring to which the key is linked to + * @key: created or updated key + * @payload: data used to instantiate or update the key + * @payload_len: length of payload + * @flags: key flags + * @create: flag indicating whether the key was created or updated + * + * Notify the caller of a key creation or update. + */ +void security_key_post_create_or_update(struct key *keyring, struct key *key, + const void *payload, size_t payload_len, + unsigned long flags, bool create) +{ + call_void_hook(key_post_create_or_update, keyring, key, payload, + payload_len, flags, create); +} #endif /* CONFIG_KEYS */ #ifdef CONFIG_AUDIT