[v38,34/39] audit: multiple subject lsm values for netlabel

Message ID	20220927195421.14713-35-casey@schaufler-ca.com (mailing list archive)
State	Handled Elsewhere
Delegated to:	Paul Moore
Headers	show Return-Path: <selinux-owner@kernel.org> From: Casey Schaufler <casey@schaufler-ca.com> To: casey.schaufler@intel.com, paul@paul-moore.com, linux-security-module@vger.kernel.org Cc: casey@schaufler-ca.com, linux-audit@redhat.com, jmorris@namei.org, selinux@vger.kernel.org, keescook@chromium.org, john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp, stephen.smalley.work@gmail.com, linux-kernel@vger.kernel.org Subject: [PATCH v38 34/39] audit: multiple subject lsm values for netlabel Date: Tue, 27 Sep 2022 12:54:16 -0700 Message-Id: <20220927195421.14713-35-casey@schaufler-ca.com> In-Reply-To: <20220927195421.14713-1-casey@schaufler-ca.com> References: <20220927195421.14713-1-casey@schaufler-ca.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	[v38,01/39] LSM: Identify modules by more than name \| expand [v38,01/39] LSM: Identify modules by more than name [v38,02/39] LSM: Add an LSM identifier for external use [v38,03/39] LSM: Identify the process attributes for each module [v38,04/39] LSM: Maintain a table of LSM attribute data [v38,05/39] proc: Use lsmids instead of lsm names for attrs [v38,06/39] LSM: lsm_self_attr syscall for LSM self attributes [v38,07/39] integrity: disassociate ima_filter_rule from security_audit_rule [v38,08/39] LSM: Infrastructure management of the sock security [v38,09/39] LSM: Add the lsmblob data structure. [v38,10/39] LSM: provide lsm name and id slot mappings [v38,11/39] IMA: avoid label collisions with stacked LSMs [v38,12/39] LSM: Use lsmblob in security_audit_rule_match [v38,13/39] LSM: Use lsmblob in security_kernel_act_as [v38,14/39] LSM: Use lsmblob in security_secctx_to_secid [v38,15/39] LSM: Use lsmblob in security_secid_to_secctx [v38,16/39] LSM: Use lsmblob in security_ipc_getsecid [v38,17/39] LSM: Use lsmblob in security_current_getsecid [v38,18/39] LSM: Use lsmblob in security_inode_getsecid [v38,19/39] LSM: Use lsmblob in security_cred_getsecid [v38,20/39] LSM: Specify which LSM to display [v38,21/39] LSM: Ensure the correct LSM context releaser [v38,22/39] LSM: Use lsmcontext in security_secid_to_secctx [v38,23/39] LSM: Use lsmcontext in security_inode_getsecctx [v38,24/39] Use lsmcontext in security_dentry_init_security [v38,25/39] LSM: security_secid_to_secctx in netlink netfilter [v38,26/39] NET: Store LSM netlabel data in a lsmblob [v38,27/39] binder: Pass LSM identifier for confirmation [v38,28/39] LSM: security_secid_to_secctx module selection [v38,29/39] Audit: Keep multiple LSM data in audit_names [v38,30/39] Audit: Create audit_stamp structure [v38,31/39] LSM: Add a function to report multiple LSMs [v38,32/39] Audit: Allow multiple records in an audit_buffer [v38,33/39] Audit: Add record for multiple task security contexts [v38,34/39] audit: multiple subject lsm values for netlabel [v38,35/39] Audit: Add record for multiple object contexts [v38,36/39] netlabel: Use a struct lsmblob in audit data [v38,37/39] LSM: Removed scaffolding function lsmcontext_init [v38,38/39] AppArmor: Remove the exclusive flag [v38,39/39] LSM: Create lsm_module_list system call

Message ID

20220927195421.14713-35-casey@schaufler-ca.com (mailing list archive)

State

Handled Elsewhere

Delegated to:

Paul Moore

Headers

From: Casey Schaufler <casey@schaufler-ca.com>
To: casey.schaufler@intel.com, paul@paul-moore.com,
        linux-security-module@vger.kernel.org
Cc: casey@schaufler-ca.com, linux-audit@redhat.com, jmorris@namei.org,
        selinux@vger.kernel.org, keescook@chromium.org,
        john.johansen@canonical.com, penguin-kernel@i-love.sakura.ne.jp,
        stephen.smalley.work@gmail.com, linux-kernel@vger.kernel.org
Subject: [PATCH v38 34/39] audit: multiple subject lsm values for netlabel
Date: Tue, 27 Sep 2022 12:54:16 -0700
Message-Id: <20220927195421.14713-35-casey@schaufler-ca.com>
In-Reply-To: <20220927195421.14713-1-casey@schaufler-ca.com>
References: <20220927195421.14713-1-casey@schaufler-ca.com>
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit
Precedence: bulk

Series

[v38,01/39] LSM: Identify modules by more than name | expand

Commit Message

Casey Schaufler Sept. 27, 2022, 7:54 p.m. UTC

Refactor audit_log_task_context(), creating a new
audit_log_subject_context(). This is used in netlabel auditing
to provide multiple subject security contexts as necessary.

Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
---
 include/linux/audit.h        |  7 +++++++
 kernel/audit.c               | 26 ++++++++++++++++----------
 net/netlabel/netlabel_user.c |  7 +------
 3 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/include/linux/audit.h b/include/linux/audit.h
index edb919722448..87ba6fe7f1a2 100644
--- a/include/linux/audit.h
+++ b/include/linux/audit.h
@@ -188,6 +188,8 @@  extern void		    audit_log_path_denied(int type,
 						  const char *operation);
 extern void		    audit_log_lost(const char *message);
 
+extern int audit_log_subject_context(struct audit_buffer *ab,
+				     struct lsmblob *blob);
 extern int audit_log_task_context(struct audit_buffer *ab);
 extern void audit_log_task_info(struct audit_buffer *ab);
 
@@ -248,6 +250,11 @@  static inline void audit_log_key(struct audit_buffer *ab, char *key)
 { }
 static inline void audit_log_path_denied(int type, const char *operation)
 { }
+static inline int audit_log_subject_context(struct audit_buffer *ab,
+					    struct lsmblob *blob)
+{
+	return 0;
+}
 static inline int audit_log_task_context(struct audit_buffer *ab)
 {
 	return 0;
diff --git a/kernel/audit.c b/kernel/audit.c
index fb182f7e9d18..a611130f83cb 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -2226,20 +2226,17 @@  static void audit_buffer_aux_end(struct audit_buffer *ab)
 	ab->skb = skb_peek(&ab->skb_list);
 }
 
-int audit_log_task_context(struct audit_buffer *ab)
+int audit_log_subject_context(struct audit_buffer *ab, struct lsmblob *blob)
 {
 	int i;
 	int error;
-	struct lsmblob blob;
 	struct lsmcontext context;
 
-	security_current_getsecid_subj(&blob);
-	if (!lsmblob_is_set(&blob))
+	if (!lsmblob_is_set(blob))
 		return 0;
 
 	if (!lsm_multiple_contexts()) {
-		error = security_secid_to_secctx(&blob, &context,
-						 LSMBLOB_FIRST);
+		error = security_secid_to_secctx(blob, &context, LSMBLOB_FIRST);
 		if (error) {
 			if (error != -EINVAL)
 				goto error_path;
@@ -2254,15 +2251,15 @@  int audit_log_task_context(struct audit_buffer *ab)
 		if (error)
 			goto error_path;
 		for (i = 0; i < LSMBLOB_ENTRIES; i++) {
-			if (blob.secid[i] == 0)
+			if (blob->secid[i] == 0)
 				continue;
-			error = security_secid_to_secctx(&blob, &context, i);
+			error = security_secid_to_secctx(blob, &context, i);
 			if (error) {
 				audit_log_format(ab, "%ssubj_%s=?",
 						 i ? " " : "",
 						 lsm_slot_to_name(i));
 				if (error != -EINVAL)
-					audit_panic("error in audit_log_task_context");
+					audit_panic("error in audit_log_subject_context");
 			} else {
 				audit_log_format(ab, "%ssubj_%s=%s",
 						 i ? " " : "",
@@ -2277,9 +2274,18 @@  int audit_log_task_context(struct audit_buffer *ab)
 	return 0;
 
 error_path:
-	audit_panic("error in audit_log_task_context");
+	audit_panic("error in audit_log_subject_context");
 	return error;
 }
+EXPORT_SYMBOL(audit_log_subject_context);
+
+int audit_log_task_context(struct audit_buffer *ab)
+{
+	struct lsmblob blob;
+
+	security_current_getsecid_subj(&blob);
+	return audit_log_subject_context(ab, &blob);
+}
 EXPORT_SYMBOL(audit_log_task_context);
 
 void audit_log_d_path_exe(struct audit_buffer *ab,
diff --git a/net/netlabel/netlabel_user.c b/net/netlabel/netlabel_user.c
index 1941877fd16f..42812bdfc31a 100644
--- a/net/netlabel/netlabel_user.c
+++ b/net/netlabel/netlabel_user.c
@@ -84,7 +84,6 @@  struct audit_buffer *netlbl_audit_start_common(int type,
 					       struct netlbl_audit *audit_info)
 {
 	struct audit_buffer *audit_buf;
-	struct lsmcontext context;
 	struct lsmblob blob;
 
 	if (audit_enabled == AUDIT_OFF)
@@ -99,11 +98,7 @@  struct audit_buffer *netlbl_audit_start_common(int type,
 			 audit_info->sessionid);
 
 	lsmblob_init(&blob, audit_info->secid);
-	if (audit_info->secid != 0 &&
-	    security_secid_to_secctx(&blob, &context, LSMBLOB_FIRST) == 0) {
-		audit_log_format(audit_buf, " subj=%s", context.context);
-		security_release_secctx(&context);
-	}
+	audit_log_subject_context(audit_buf, &blob);
 
 	return audit_buf;
 }

[v38,34/39] audit: multiple subject lsm values for netlabel

Commit Message

Patch