From patchwork Thu Jul 14 22:56:48 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Daniel Jurgens X-Patchwork-Id: 9231887 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 3828B60574 for ; Fri, 15 Jul 2016 12:38:15 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 26F2227F86 for ; Fri, 15 Jul 2016 12:38:15 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 1B72227FA9; Fri, 15 Jul 2016 12:38:15 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-1.9 required=2.0 tests=BAYES_00, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 Received: from emsm-gh1-uea10.nsa.gov (smtp.nsa.gov [8.44.101.8]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 4380827F86 for ; Fri, 15 Jul 2016 12:38:14 +0000 (UTC) X-IronPort-AV: E=Sophos;i="5.28,368,1464652800"; d="scan'208";a="15610375" IronPort-PHdr: =?us-ascii?q?9a23=3A6unVpB/kCoQfY/9uRHKM819IXTAuvvDOBiVQ1KB6?= =?us-ascii?q?0ugcTK2v8tzYMVDF4r011RmSDN2dt64P1rKempujcFRI2YyGvnEGfc4EfD4+ou?= =?us-ascii?q?JSoTYdBtWYA1bwNv/gYn9yNs1DUFh44yPzahANS47AblHf6ke/8SQVUk2mc1Ek?= =?us-ascii?q?fqKpRsWP14ye7KObw9XreQJGhT6wM/tZDS6dikHvjPQQmpZoMa0ryxHE8TNicu?= =?us-ascii?q?VSwn50dxrIx06vrvqq+NZf1wgY+7d4r48TGZj8ZLkyGLxEECx0dCct/sruuAXD?= =?us-ascii?q?QBaUoHoaXGINnxEOHxnO7Ba8WJzquW3/t+463SCbOcj/S/czQSij6KFwDwTljC?= =?us-ascii?q?YBKi5qzWfMl8YliatapA6m9Qdyx4/SfZHQLvdnY67GYfsGVGFBWYBXTCUHDYSi?= =?us-ascii?q?OJASBegMNvoNso/mulEVpgG/DwT/OOS6wT9Sh2Tp9bY9zv9kCgbCmgs6EJZGqH?= =?us-ascii?q?3JqP3tPboWFOWyy7PFiz7EarcewjvmwJTZeRAm5/eXVPR/dtSVgUQ3HhnElX2I?= =?us-ascii?q?oJbkJCuR3+8A9W+B4K4oWeaih2AgsQ1ZuDWjxs4wzILOg8Zd0V3N82N5zYgpNP?= =?us-ascii?q?W5TlJ2ZZivF54U/yGTM81sRdgvRXp0vy054rIDsJ+/OiMNzccJ3RnaPtCOdcCq?= =?us-ascii?q?/wjsWeCKaWN0jXRkdba9rxO/9UypzOrsEMKz1QAZ/WJ+jtDQuyVVhFTo4c+dR6?= =?us-ascii?q?44px+s?= X-IPAS-Result: =?us-ascii?q?A2ErBQCm2IhX/wHyM5BcHAEBgyCBUrplH4JMhGVMAQEBAQE?= =?us-ascii?q?BAgJiJ4IyBAMQghQCBAECJBMMCAIeCwMDAQIGAQEXCCEICAMBLRURBwcLBRgEi?= =?us-ascii?q?A8Ev3IBAQEBBgIBJI8JEQGFdwWOeYoojl2JZYVOkG+CCxyBT2uFHoE1AQEB?= Received: from unknown (HELO tarius.tycho.ncsc.mil) ([144.51.242.1]) by emsm-gh1-uea10.nsa.gov with ESMTP; 15 Jul 2016 12:37:33 +0000 Received: from prometheus.infosec.tycho.ncsc.mil (prometheus [192.168.25.40]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u6FCbEGP024713; Fri, 15 Jul 2016 08:37:21 -0400 Received: from tarius.tycho.ncsc.mil (tarius.infosec.tycho.ncsc.mil [144.51.242.1]) by prometheus.infosec.tycho.ncsc.mil (8.15.2/8.15.2) with ESMTP id u6EMw17i072629 for ; Thu, 14 Jul 2016 18:58:01 -0400 Received: from goalie.tycho.ncsc.mil (goalie [144.51.242.250]) by tarius.tycho.ncsc.mil (8.14.4/8.14.4) with ESMTP id u6EMvuwi030383 for ; Thu, 14 Jul 2016 18:58:01 -0400 X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: A1CfBACpF4hX/4GlL8FcHQGEcrZhhAqCYoM3AoF7AQEBAQEBZieEXQIEJ1IQGAgxVwcSiDTAYgEBCCeVEgWOeIonjluPL5AZVIIJHIFPOTKHbgEBAQ X-IPAS-Result: A1CfBACpF4hX/4GlL8FcHQGEcrZhhAqCYoM3AoF7AQEBAQEBZieEXQIEJ1IQGAgxVwcSiDTAYgEBCCeVEgWOeIonjluPL5AZVIIJHIFPOTKHbgEBAQ X-IronPort-AV: E=Sophos;i="5.28,365,1464667200"; d="scan'208";a="5582148" Received: from emsm-gh1-uea11.corp.nsa.gov (HELO emsm-gh1-uea11.nsa.gov) ([10.208.41.37]) by goalie.tycho.ncsc.mil with ESMTP; 14 Jul 2016 18:58:00 -0400 IronPort-PHdr: =?us-ascii?q?9a23=3Aiq7dpRYilOn3Ol2sl/M37u3/LSx+4OfEezUN459i?= =?us-ascii?q?sYplN5qZpMS/bnLW6fgltlLVR4KTs6sC0LuO9fy7EjZYqb+681k6OKRWUBEEjc?= =?us-ascii?q?hE1ycBO+WiTXPBEfjxciYhF95DXlI2t1uyMExSBdqsLwaK+i760zceF13FOBZv?= =?us-ascii?q?IaytQ8iJ3pzxi7v5ocWbSj4LrQL1Wal1IhSyoFeZnegtqqwmFJwMzADUqGBDYe?= =?us-ascii?q?VcyDAgD1uSmxHh+pX4p8Y7oGx48sgs/M9YUKj8Y79wDfkBVGxnYCgJ45jgtQPC?= =?us-ascii?q?VhSn/XwBSSANlR4OBBLKqFniV4r1mjPzq+443S6dJ8CwRrcxHXy547xDVA7jiC?= =?us-ascii?q?BBMSUwtm7QlIg4gbpSuhO6jwR22Y/PeIWcP/c4ebnSOZsWQWdNUMFLWwRbD4+8?= =?us-ascii?q?ZpdJBO0Eea5DooD74VsDowevLQiqGO7rjDRPgzu+3aQ+lf4mCgzAxxAnFNEmv3?= =?us-ascii?q?HdrdGzP6AXAs6vy6yd4TzFJ9FLwzjw7pOAJhwop/CBWbBYdMfVzUApEBODhVKV?= =?us-ascii?q?/9+2dwiJ3/gA5jDIp9FrUvii3it+81l8?= X-IronPort-Anti-Spam-Filtered: true X-IronPort-Anti-Spam-Result: =?us-ascii?q?A0GqBADVF4hX/4GlL8FcHoRytmGECoJig?= =?us-ascii?q?zcCgXsBAQEBAQECAmIngjIEARIBghMCBCdSEBgIMVcHEog0wGIBAQgnlRIFjni?= =?us-ascii?q?KJ45bjy+QGVSCCRyBTzkyh24BAQE?= X-IPAS-Result: =?us-ascii?q?A0GqBADVF4hX/4GlL8FcHoRytmGECoJigzcCgXsBAQEBAQE?= =?us-ascii?q?CAmIngjIEARIBghMCBCdSEBgIMVcHEog0wGIBAQgnlRIFjniKJ45bjy+QGVSCC?= =?us-ascii?q?RyBTzkyh24BAQE?= X-IronPort-AV: E=Sophos;i="5.28,365,1464652800"; d="scan'208";a="17666573" Received: from mail-il-dmz.mellanox.com (HELO mellanox.co.il) ([193.47.165.129]) by emsm-gh1-uea11.nsa.gov with ESMTP; 14 Jul 2016 22:57:57 +0000 Received: from Internal Mail-Server by MTLPINE1 (envelope-from danielj@mellanox.com) with ESMTPS (AES256-SHA encrypted); 15 Jul 2016 01:57:53 +0300 Received: from x-vnc01.mtx.labs.mlnx (x-vnc01.mtx.labs.mlnx [10.12.150.16]) by labmailer.mlnx (8.13.8/8.13.8) with ESMTP id u6EMv9u7030854; Fri, 15 Jul 2016 01:57:49 +0300 From: Dan Jurgens To: chrisw@sous-sol.org, paul@paul-moore.com, sds@tycho.nsa.gov, eparis@parisplace.org, dledford@redhat.com, sean.hefty@intel.com, hal.rosenstock@gmail.com Subject: [PATCH v2 6/9] selinux: Allocate and free infiniband security hooks Date: Fri, 15 Jul 2016 01:56:48 +0300 Message-Id: <1468537011-20407-7-git-send-email-danielj@mellanox.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1468537011-20407-1-git-send-email-danielj@mellanox.com> References: <1468537011-20407-1-git-send-email-danielj@mellanox.com> X-Mailman-Approved-At: Fri, 15 Jul 2016 08:13:30 -0400 X-BeenThere: selinux@tycho.nsa.gov X-Mailman-Version: 2.1.20 Precedence: list List-Id: "Security-Enhanced Linux \(SELinux\) mailing list" List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-rdma@vger.kernel.org, linux-security-module@vger.kernel.org, selinux@tycho.nsa.gov MIME-Version: 1.0 Errors-To: selinux-bounces@tycho.nsa.gov Sender: "Selinux" X-Virus-Scanned: ClamAV using ClamSMTP From: Daniel Jurgens Implement and attach hooks to allocate and free Infiniband object security structures. Signed-off-by: Daniel Jurgens --- v2: - Use void * blobs for security structs. Paul Moore - Shorten ib_end_port to ib_port. Paul Moore - Allocate memory for security struct with GFP_KERNEL. Yuval Shaia --- security/selinux/hooks.c | 25 ++++++++++++++++++++++++- security/selinux/include/objsec.h | 5 +++++ 2 files changed, 29 insertions(+), 1 deletions(-) diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index a363202..fe3d20d 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -17,6 +17,7 @@ * Paul Moore * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd. * Yuichi Nakamura + * Copyright (C) 2016 Mellanox Technologies * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2, @@ -5991,7 +5992,26 @@ static int selinux_key_getsecurity(struct key *key, char **_buffer) *_buffer = context; return rc; } +#endif + +#ifdef CONFIG_SECURITY_INFINIBAND +static int selinux_ib_alloc_security(void **ib_sec) +{ + struct ib_security_struct *sec; + + sec = kzalloc(sizeof(*sec), GFP_KERNEL); + if (!sec) + return -ENOMEM; + sec->sid = current_sid(); + + *ib_sec = sec; + return 0; +} +static void selinux_ib_free_security(void *ib_sec) +{ + kfree(ib_sec); +} #endif static struct security_hook_list selinux_hooks[] = { @@ -6175,7 +6195,10 @@ static struct security_hook_list selinux_hooks[] = { LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue), LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach), LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open), - +#ifdef CONFIG_SECURITY_INFINIBAND + LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security), + LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security), +#endif #ifdef CONFIG_SECURITY_NETWORK_XFRM LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc), LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone), diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h index c21e135..8e7db43 100644 --- a/security/selinux/include/objsec.h +++ b/security/selinux/include/objsec.h @@ -10,6 +10,7 @@ * * Copyright (C) 2001,2002 Networks Associates Technology, Inc. * Copyright (C) 2003 Red Hat, Inc., James Morris + * Copyright (C) 2016 Mellanox Technologies * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2, @@ -128,6 +129,10 @@ struct key_security_struct { u32 sid; /* SID of key */ }; +struct ib_security_struct { + u32 sid; /* SID of the queue pair or MAD agent */ +}; + extern unsigned int selinux_checkreqprot; #endif /* _SELINUX_OBJSEC_H_ */