On 10/14/2015 5:41 AM, Lukasz Pawelczyk wrote: > setprocattr hook for Smack's label_map attribute needs to know the > capabilities of file opener. Add those credentials to the hook's > arguments. > > While at it add documentation on get/setprocattr hooks. > > Signed-off-by: Lukasz Pawelczyk <l.pawelc...@samsung.com> > Acked-by: Serge Hallyn <serge.hal...@canonical.com>
Acked-by: Casey Schaufler <ca...@schaufler-ca.com> > --- > fs/proc/base.c | 2 +- > include/linux/lsm_hooks.h | 18 ++++++++++++++++-- > include/linux/security.h | 7 +++++-- > security/apparmor/lsm.c | 5 +++-- > security/security.c | 6 ++++-- > security/selinux/hooks.c | 2 +- > security/smack/smack_lsm.c | 4 ++-- > 7 files changed, 32 insertions(+), 12 deletions(-) > > diff --git a/fs/proc/base.c b/fs/proc/base.c > index 9ec88b8..2b38969 100644 > --- a/fs/proc/base.c > +++ b/fs/proc/base.c > @@ -2447,7 +2447,7 @@ static ssize_t proc_pid_attr_write(struct file * file, > const char __user * buf, > if (length < 0) > goto out_free; > > - length = security_setprocattr(task, > + length = security_setprocattr(task, file->f_cred, > (char*)file->f_path.dentry->d_name.name, > (void*)page, count); > mutex_unlock(&task->signal->cred_guard_mutex); > diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h > index 7049db0..4f16640 100644 > --- a/include/linux/lsm_hooks.h > +++ b/include/linux/lsm_hooks.h > @@ -1220,6 +1220,20 @@ > * Return 0 if @name is to be handled by seq, EOPNOTSUPP if getprocattr() > * should be used. Other errors will be passed to user-space. > * > + * @getprocattr: > + * Get a value of a proc security attribute in /proc/$PID/attr/. > + * @p a task associated with the proc file. > + * @name a name of the file in question. > + * @value a pointer where to return the attribute's value. > + * > + * @setprocattr: > + * Set a value of a proc security attribute in /proc/$PID/attr/. > + * @p a task associated with the proc file. > + * @f_cred credentials of a file's opener. > + * @name a name of the file in question. > + * @value a pointer where a value to set is kept. > + * @size a number of bytes to read from the @value pointer. > + * > * @secid_to_secctx: > * Convert secid to security context. If secdata is NULL the length of > * the result will be returned in seclen, but no secdata will be returned. > @@ -1540,8 +1554,8 @@ union security_list_options { > int (*getprocattr_seq)(struct task_struct *p, const char *name, > const struct seq_operations **ops); > int (*getprocattr)(struct task_struct *p, char *name, char **value); > - int (*setprocattr)(struct task_struct *p, char *name, void *value, > - size_t size); > + int (*setprocattr)(struct task_struct *p, const struct cred *f_cred, > + char *name, void *value, size_t size); > int (*ismaclabel)(const char *name); > int (*secid_to_secctx)(u32 secid, char **secdata, u32 *seclen); > int (*secctx_to_secid)(const char *secdata, u32 seclen, u32 *secid); > diff --git a/include/linux/security.h b/include/linux/security.h > index dddea2f..12bd011 100644 > --- a/include/linux/security.h > +++ b/include/linux/security.h > @@ -348,7 +348,8 @@ void security_d_instantiate(struct dentry *dentry, struct > inode *inode); > int security_getprocattr_seq(struct task_struct *p, const char *name, > const struct seq_operations **ops); > int security_getprocattr(struct task_struct *p, char *name, char **value); > -int security_setprocattr(struct task_struct *p, char *name, void *value, > size_t size); > +int security_setprocattr(struct task_struct *p, const struct cred *f_cred, > + char *name, void *value, size_t size); > int security_netlink_send(struct sock *sk, struct sk_buff *skb); > int security_ismaclabel(const char *name); > int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen); > @@ -1071,7 +1072,9 @@ static inline int security_getprocattr(struct > task_struct *p, char *name, char * > return -EINVAL; > } > > -static inline int security_setprocattr(struct task_struct *p, char *name, > void *value, size_t size) > +static inline int security_setprocattr(struct task_struct *p, > + const struct cred *f_cred, > + char *name, void *value, size_t size) > { > return -EINVAL; > } > diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c > index dec607c..1212927 100644 > --- a/security/apparmor/lsm.c > +++ b/security/apparmor/lsm.c > @@ -518,8 +518,9 @@ static int apparmor_getprocattr(struct task_struct *task, > char *name, > return error; > } > > -static int apparmor_setprocattr(struct task_struct *task, char *name, > - void *value, size_t size) > +static int apparmor_setprocattr(struct task_struct *task, > + const struct cred *f_cred, > + char *name, void *value, size_t size) > { > struct common_audit_data sa; > struct apparmor_audit_data aad = {0,}; > diff --git a/security/security.c b/security/security.c > index da2bcd4..abfc207 100644 > --- a/security/security.c > +++ b/security/security.c > @@ -1132,9 +1132,11 @@ int security_getprocattr(struct task_struct *p, char > *name, char **value) > return call_int_hook(getprocattr, -EINVAL, p, name, value); > } > > -int security_setprocattr(struct task_struct *p, char *name, void *value, > size_t size) > +int security_setprocattr(struct task_struct *p, const struct cred *f_cred, > + char *name, void *value, size_t size) > { > - return call_int_hook(setprocattr, -EINVAL, p, name, value, size); > + return call_int_hook(setprocattr, -EINVAL, p, f_cred, > + name, value, size); > } > > int security_netlink_send(struct sock *sk, struct sk_buff *skb) > diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c > index e4369d8..470eff8 100644 > --- a/security/selinux/hooks.c > +++ b/security/selinux/hooks.c > @@ -5603,7 +5603,7 @@ invalid: > return -EINVAL; > } > > -static int selinux_setprocattr(struct task_struct *p, > +static int selinux_setprocattr(struct task_struct *p, const struct cred > *f_cred, > char *name, void *value, size_t size) > { > struct task_security_struct *tsec; > diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c > index c2d66ca..c439370 100644 > --- a/security/smack/smack_lsm.c > +++ b/security/smack/smack_lsm.c > @@ -3549,8 +3549,8 @@ static int smack_getprocattr(struct task_struct *p, > char *name, char **value) > * > * Returns the length of the smack label or an error code > */ > -static int smack_setprocattr(struct task_struct *p, char *name, > - void *value, size_t size) > +static int smack_setprocattr(struct task_struct *p, const struct cred > *f_cred, > + char *name, void *value, size_t size) > { > struct task_smack *tsp; > struct cred *new; -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html