From patchwork Tue Dec 19 22:38:13 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Casey Schaufler X-Patchwork-Id: 10124675 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 77C926019C for ; Tue, 19 Dec 2017 22:38:19 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 6F64629536 for ; Tue, 19 Dec 2017 22:38:19 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 644722957F; Tue, 19 Dec 2017 22:38:19 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00,DKIM_SIGNED, RCVD_IN_DNSWL_HI,T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 07C8829536 for ; Tue, 19 Dec 2017 22:38:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752377AbdLSWiS (ORCPT ); Tue, 19 Dec 2017 17:38:18 -0500 Received: from sonic315-20.consmr.mail.bf2.yahoo.com ([74.6.134.194]:44884 "EHLO sonic315-20.consmr.mail.bf2.yahoo.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752155AbdLSWiS (ORCPT ); Tue, 19 Dec 2017 17:38:18 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=yahoo.com; s=s2048; t=1513723097; bh=BklnksN2brFAE+xFrl6dnux3Q+YwVhTNQgaSMUMbaKs=; h=Subject:To:Cc:References:From:Date:In-Reply-To:From:Subject; b=BXSB2XRQwo5vfHYr9YnxDfhcY4fn+hTtX+dlr0TXcfLRMFbLNE6yTuyxnEw1RrrlUoA6+dGeqDMWfYHb+IkD9HV9iegFLhfp9eY5agN3O09ZItSZGiJDjjipKixlVjcO6m66lPgQvIjX5txnKNNp6AGSzYLEq6Pedweno0Igd2yyTSonwZK06rHBP9weQh+mAcLTltTpQ2AOPIoFpvUAGcLZzXLZRNx0QVeFx/hOy0Cj8DYB9miI3hkhtzLJ41CHLkBZBOuUJ3L42+93UuTwdvOkjOWVH+/Wt9fi31e76C/78Mkdip5GNt2M/8gmRQKxTcbWI7QUYaM8NgF++NZ5CA== X-YMail-OSG: P5XjR78VM1msiiedMisLRYNof3IbIrjmkVf3hQMCfpIXY7jH.QKnwnIeBV8TZC8 Pk025FBf9nc6xK4Ezsff8FmpntnEOL27JBBDpvq_s9ks1sLV.T1.7aQ5s4OyIeFaSRdvjEXl6Bmy .6hMzxd3VBhdQORgaz8KCz2wfZBtDJKG_H4Yh4Q.xmuQ07WmJuVyBIeW52IpvUn6QMai3GlBNNxQ CqfohZZwLgW6sRCk6UHd6CAq5N0khZaVZY4iqlWAYn0Yg9XAK3b.Fd8fOdE9NnhGjaoGlAa48Pkv Tpa8zDD3Qde40ylCF2.KKu6TMVJo1RbbnJgvd9ikctqYDQX.Lp7FBvn.XoSSNizQ3GxvpVN40M6c 1RxgFn1KC1xYVnnuFlYxrcwW297yPxmLJ4t18wcMvu6eO6McpJj3tP6nddve5UGiTqUKWFmh4CeD tzeFx0inN1DVX3fDSIRZESropkydZGjTP.4CchGpxKld44AqXRwHRu80IBc4zcxwcxNK8n44Aq.p vflsWO2pxnGAHJcqyrShitnvoh.hCRHHBLHO_tkZsRdOIXIvhCkc- Received: from sonic.gate.mail.ne1.yahoo.com by sonic315.consmr.mail.bf2.yahoo.com with HTTP; Tue, 19 Dec 2017 22:38:17 +0000 Received: from smtp108.rhel.mail.bf1.yahoo.com (EHLO [192.168.0.102]) ([98.139.231.46]) by smtp415.mail.bf1.yahoo.com (JAMES SMTP Server ) with ESMTPA ID 87c86cd327fe284d7bb7fc398ecb3e34; Tue, 19 Dec 2017 22:38:16 +0000 (UTC) Subject: [PATCH 4/6] LSM: Manage task security blobs To: LSM , James Morris Cc: John Johansen , Tetsuo Handa , Paul Moore , Kees Cook , Stephen Smalley References: <5219980c-b689-8bfe-1b77-38c76175fa56@schaufler-ca.com> From: Casey Schaufler Message-ID: Date: Tue, 19 Dec 2017 14:38:13 -0800 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:52.0) Gecko/20100101 Thunderbird/52.5.0 MIME-Version: 1.0 In-Reply-To: <5219980c-b689-8bfe-1b77-38c76175fa56@schaufler-ca.com> Content-Language: en-US Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP Subject: [PATCH 4/6] LSM: Manage task security blobs Move management of task security blobs into the security infrastructure. Modules are required to identify the space they require. At this time there are no modules that use task blobs. Signed-off-by: Casey Schaufler --- include/linux/lsm_hooks.h | 1 + security/security.c | 35 ++++++++++++++++++++++++++++++++++- 2 files changed, 35 insertions(+), 1 deletion(-) diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h index ab454445673a..9149f0022822 100644 --- a/include/linux/lsm_hooks.h +++ b/include/linux/lsm_hooks.h @@ -1974,6 +1974,7 @@ struct security_hook_list { struct lsm_blob_sizes { int lbs_cred; int lbs_file; + int lbs_task; }; /* diff --git a/security/security.c b/security/security.c index c468972fbc25..51f078a5d95c 100644 --- a/security/security.c +++ b/security/security.c @@ -102,6 +102,7 @@ int __init security_init(void) #ifdef CONFIG_SECURITY_LSM_DEBUG pr_info("LSM: cred blob size = %d\n", blob_sizes.lbs_cred); pr_info("LSM: file blob size = %d\n", blob_sizes.lbs_file); + pr_info("LSM: task blob size = %d\n", blob_sizes.lbs_task); #endif return 0; @@ -277,6 +278,7 @@ void __init security_add_blobs(struct lsm_blob_sizes *needed) { lsm_set_size(&needed->lbs_cred, &blob_sizes.lbs_cred); lsm_set_size(&needed->lbs_file, &blob_sizes.lbs_file); + lsm_set_size(&needed->lbs_task, &blob_sizes.lbs_task); } /** @@ -300,6 +302,27 @@ int lsm_file_alloc(struct file *file) return 0; } +/** + * lsm_task_alloc - allocate a composite task blob + * @task: the task that needs a blob + * + * Allocate the task blob for all the modules + * + * Returns 0, or -ENOMEM if memory can't be allocated. + */ +int lsm_task_alloc(struct task_struct *task) +{ + if (blob_sizes.lbs_task == 0) { + task->security = NULL; + return 0; + } + + task->security = kzalloc(blob_sizes.lbs_task, GFP_KERNEL); + if (task->security == NULL) + return -ENOMEM; + return 0; +} + /* * Hook list operation macros. * @@ -1106,12 +1129,22 @@ int security_file_open(struct file *file, const struct cred *cred) int security_task_alloc(struct task_struct *task, unsigned long clone_flags) { - return call_int_hook(task_alloc, 0, task, clone_flags); + int rc = lsm_task_alloc(task); + + if (rc) + return rc; + rc = call_int_hook(task_alloc, 0, task, clone_flags); + if (unlikely(rc)) + security_task_free(task); + return rc; } void security_task_free(struct task_struct *task) { call_void_hook(task_free, task); + + kfree(task->security); + task->security = NULL; } int security_cred_alloc_blank(struct cred *cred, gfp_t gfp)