2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
* Linux Security plug
|
|
|
|
*
|
|
|
|
* Copyright (C) 2001 WireX Communications, Inc <chris@wirex.com>
|
|
|
|
* Copyright (C) 2001 Greg Kroah-Hartman <greg@kroah.com>
|
|
|
|
* Copyright (C) 2001 Networks Associates Technology, Inc <ssmalley@nai.com>
|
|
|
|
* Copyright (C) 2001 James Morris <jmorris@intercode.com.au>
|
|
|
|
* Copyright (C) 2001 Silicon Graphics, Inc. (Trust Technology Group)
|
|
|
|
*
|
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License as published by
|
|
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
|
|
* (at your option) any later version.
|
|
|
|
*
|
|
|
|
* Due to this file being licensed under the GPL there is controversy over
|
|
|
|
* whether this permits you to write a module that #includes this file
|
|
|
|
* without placing your module under the GPL. Please consult a lawyer for
|
|
|
|
* advice before doing this.
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
|
|
|
|
#ifndef __LINUX_SECURITY_H
|
|
|
|
#define __LINUX_SECURITY_H
|
|
|
|
|
|
|
|
#include <linux/fs.h>
|
|
|
|
#include <linux/binfmts.h>
|
|
|
|
#include <linux/signal.h>
|
|
|
|
#include <linux/resource.h>
|
|
|
|
#include <linux/sem.h>
|
|
|
|
#include <linux/shm.h>
|
|
|
|
#include <linux/msg.h>
|
|
|
|
#include <linux/sched.h>
|
2005-10-30 16:02:44 -07:00
|
|
|
#include <linux/key.h>
|
2006-07-25 00:29:07 -06:00
|
|
|
#include <linux/xfrm.h>
|
2006-08-05 00:12:42 -06:00
|
|
|
#include <net/flow.h>
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-03-06 09:09:10 -07:00
|
|
|
/* Maximum number of letters for an LSM name string */
|
|
|
|
#define SECURITY_NAME_MAX 10
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
struct ctl_table;
|
2008-03-01 13:00:05 -07:00
|
|
|
struct audit_krule;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* These functions are in security/capability.c and are used
|
|
|
|
* as the default capabilities functions
|
|
|
|
*/
|
2008-04-23 12:10:25 -06:00
|
|
|
extern int cap_capable(struct task_struct *tsk, int cap);
|
|
|
|
extern int cap_settime(struct timespec *ts, struct timezone *tz);
|
security: Fix setting of PF_SUPERPRIV by __capable()
Fix the setting of PF_SUPERPRIV by __capable() as it could corrupt the flags
the target process if that is not the current process and it is trying to
change its own flags in a different way at the same time.
__capable() is using neither atomic ops nor locking to protect t->flags. This
patch removes __capable() and introduces has_capability() that doesn't set
PF_SUPERPRIV on the process being queried.
This patch further splits security_ptrace() in two:
(1) security_ptrace_may_access(). This passes judgement on whether one
process may access another only (PTRACE_MODE_ATTACH for ptrace() and
PTRACE_MODE_READ for /proc), and takes a pointer to the child process.
current is the parent.
(2) security_ptrace_traceme(). This passes judgement on PTRACE_TRACEME only,
and takes only a pointer to the parent process. current is the child.
In Smack and commoncap, this uses has_capability() to determine whether
the parent will be permitted to use PTRACE_ATTACH if normal checks fail.
This does not set PF_SUPERPRIV.
Two of the instances of __capable() actually only act on current, and so have
been changed to calls to capable().
Of the places that were using __capable():
(1) The OOM killer calls __capable() thrice when weighing the killability of a
process. All of these now use has_capability().
(2) cap_ptrace() and smack_ptrace() were using __capable() to check to see
whether the parent was allowed to trace any process. As mentioned above,
these have been split. For PTRACE_ATTACH and /proc, capable() is now
used, and for PTRACE_TRACEME, has_capability() is used.
(3) cap_safe_nice() only ever saw current, so now uses capable().
(4) smack_setprocattr() rejected accesses to tasks other than current just
after calling __capable(), so the order of these two tests have been
switched and capable() is used instead.
(5) In smack_file_send_sigiotask(), we need to allow privileged processes to
receive SIGIO on files they're manipulating.
(6) In smack_task_wait(), we let a process wait for a privileged process,
whether or not the process doing the waiting is privileged.
I've tested this with the LTP SELinux and syscalls testscripts.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Morris <jmorris@namei.org>
2008-08-14 04:37:28 -06:00
|
|
|
extern int cap_ptrace_may_access(struct task_struct *child, unsigned int mode);
|
|
|
|
extern int cap_ptrace_traceme(struct task_struct *parent);
|
2008-04-23 12:10:25 -06:00
|
|
|
extern int cap_capget(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
|
|
|
|
extern int cap_capset_check(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
|
|
|
|
extern void cap_capset_set(struct task_struct *target, kernel_cap_t *effective, kernel_cap_t *inheritable, kernel_cap_t *permitted);
|
|
|
|
extern int cap_bprm_set_security(struct linux_binprm *bprm);
|
|
|
|
extern void cap_bprm_apply_creds(struct linux_binprm *bprm, int unsafe);
|
2005-04-16 16:20:36 -06:00
|
|
|
extern int cap_bprm_secureexec(struct linux_binprm *bprm);
|
2008-04-29 01:59:41 -06:00
|
|
|
extern int cap_inode_setxattr(struct dentry *dentry, const char *name,
|
|
|
|
const void *value, size_t size, int flags);
|
|
|
|
extern int cap_inode_removexattr(struct dentry *dentry, const char *name);
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 00:31:36 -06:00
|
|
|
extern int cap_inode_need_killpriv(struct dentry *dentry);
|
|
|
|
extern int cap_inode_killpriv(struct dentry *dentry);
|
2008-04-23 12:10:25 -06:00
|
|
|
extern int cap_task_post_setuid(uid_t old_ruid, uid_t old_euid, uid_t old_suid, int flags);
|
|
|
|
extern void cap_task_reparent_to_init(struct task_struct *p);
|
capabilities: implement per-process securebits
Filesystem capability support makes it possible to do away with (set)uid-0
based privilege and use capabilities instead. That is, with filesystem
support for capabilities but without this present patch, it is (conceptually)
possible to manage a system with capabilities alone and never need to obtain
privilege via (set)uid-0.
Of course, conceptually isn't quite the same as currently possible since few
user applications, certainly not enough to run a viable system, are currently
prepared to leverage capabilities to exercise privilege. Further, many
applications exist that may never get upgraded in this way, and the kernel
will continue to want to support their setuid-0 base privilege needs.
Where pure-capability applications evolve and replace setuid-0 binaries, it is
desirable that there be a mechanisms by which they can contain their
privilege. In addition to leveraging the per-process bounding and inheritable
sets, this should include suppressing the privilege of the uid-0 superuser
from the process' tree of children.
The feature added by this patch can be leveraged to suppress the privilege
associated with (set)uid-0. This suppression requires CAP_SETPCAP to
initiate, and only immediately affects the 'current' process (it is inherited
through fork()/exec()). This reimplementation differs significantly from the
historical support for securebits which was system-wide, unwieldy and which
has ultimately withered to a dead relic in the source of the modern kernel.
With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
all legacy privilege (through uid=0) for itself and all subsequently
fork()'d/exec()'d children with:
prctl(PR_SET_SECUREBITS, 0x2f);
This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
enabled at configure time.
[akpm@linux-foundation.org: fix uninitialised var warning]
[serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Reviewed-by: James Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 03:13:40 -06:00
|
|
|
extern int cap_task_prctl(int option, unsigned long arg2, unsigned long arg3,
|
|
|
|
unsigned long arg4, unsigned long arg5, long *rc_p);
|
2008-04-23 12:10:25 -06:00
|
|
|
extern int cap_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp);
|
|
|
|
extern int cap_task_setioprio(struct task_struct *p, int ioprio);
|
|
|
|
extern int cap_task_setnice(struct task_struct *p, int nice);
|
|
|
|
extern int cap_syslog(int type);
|
2007-10-17 00:31:32 -06:00
|
|
|
extern int cap_vm_enough_memory(struct mm_struct *mm, long pages);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
struct msghdr;
|
|
|
|
struct sk_buff;
|
|
|
|
struct sock;
|
|
|
|
struct sockaddr;
|
|
|
|
struct socket;
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
struct flowi;
|
|
|
|
struct dst_entry;
|
|
|
|
struct xfrm_selector;
|
|
|
|
struct xfrm_policy;
|
|
|
|
struct xfrm_state;
|
|
|
|
struct xfrm_user_sec_ctx;
|
2008-07-03 17:47:13 -06:00
|
|
|
struct seq_file;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
extern int cap_netlink_send(struct sock *sk, struct sk_buff *skb);
|
2006-06-27 14:26:11 -06:00
|
|
|
extern int cap_netlink_recv(struct sk_buff *skb, int cap);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2007-06-28 13:55:21 -06:00
|
|
|
extern unsigned long mmap_min_addr;
|
2005-04-16 16:20:36 -06:00
|
|
|
/*
|
|
|
|
* Values used in the task_security_ops calls
|
|
|
|
*/
|
|
|
|
/* setuid or setgid, id0 == uid or gid */
|
|
|
|
#define LSM_SETID_ID 1
|
|
|
|
|
|
|
|
/* setreuid or setregid, id0 == real, id1 == eff */
|
|
|
|
#define LSM_SETID_RE 2
|
|
|
|
|
|
|
|
/* setresuid or setresgid, id0 == real, id1 == eff, uid2 == saved */
|
|
|
|
#define LSM_SETID_RES 4
|
|
|
|
|
|
|
|
/* setfsuid or setfsgid, id0 == fsuid or fsgid */
|
|
|
|
#define LSM_SETID_FS 8
|
|
|
|
|
|
|
|
/* forward declares to avoid warnings */
|
|
|
|
struct sched_param;
|
2006-07-25 00:32:50 -06:00
|
|
|
struct request_sock;
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/* bprm_apply_creds unsafe reasons */
|
|
|
|
#define LSM_UNSAFE_SHARE 1
|
|
|
|
#define LSM_UNSAFE_PTRACE 2
|
|
|
|
#define LSM_UNSAFE_PTRACE_CAP 4
|
|
|
|
|
|
|
|
#ifdef CONFIG_SECURITY
|
|
|
|
|
2008-03-05 08:31:54 -07:00
|
|
|
struct security_mnt_opts {
|
|
|
|
char **mnt_opts;
|
|
|
|
int *mnt_opts_flags;
|
|
|
|
int num_mnt_opts;
|
|
|
|
};
|
|
|
|
|
|
|
|
static inline void security_init_mnt_opts(struct security_mnt_opts *opts)
|
|
|
|
{
|
|
|
|
opts->mnt_opts = NULL;
|
|
|
|
opts->mnt_opts_flags = NULL;
|
|
|
|
opts->num_mnt_opts = 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
|
|
|
|
{
|
|
|
|
int i;
|
|
|
|
if (opts->mnt_opts)
|
2008-04-23 12:10:25 -06:00
|
|
|
for (i = 0; i < opts->num_mnt_opts; i++)
|
2008-03-05 08:31:54 -07:00
|
|
|
kfree(opts->mnt_opts[i]);
|
|
|
|
kfree(opts->mnt_opts);
|
|
|
|
opts->mnt_opts = NULL;
|
|
|
|
kfree(opts->mnt_opts_flags);
|
|
|
|
opts->mnt_opts_flags = NULL;
|
|
|
|
opts->num_mnt_opts = 0;
|
|
|
|
}
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
/**
|
|
|
|
* struct security_operations - main security structure
|
|
|
|
*
|
2008-03-06 09:09:10 -07:00
|
|
|
* Security module identifier.
|
|
|
|
*
|
|
|
|
* @name:
|
|
|
|
* A string that acts as a unique identifeir for the LSM with max number
|
|
|
|
* of characters = SECURITY_NAME_MAX.
|
|
|
|
*
|
2005-04-16 16:20:36 -06:00
|
|
|
* Security hooks for program execution operations.
|
|
|
|
*
|
|
|
|
* @bprm_alloc_security:
|
|
|
|
* Allocate and attach a security structure to the @bprm->security field.
|
|
|
|
* The security field is initialized to NULL when the bprm structure is
|
|
|
|
* allocated.
|
|
|
|
* @bprm contains the linux_binprm structure to be modified.
|
|
|
|
* Return 0 if operation was successful.
|
|
|
|
* @bprm_free_security:
|
|
|
|
* @bprm contains the linux_binprm structure to be modified.
|
|
|
|
* Deallocate and clear the @bprm->security field.
|
|
|
|
* @bprm_apply_creds:
|
|
|
|
* Compute and set the security attributes of a process being transformed
|
|
|
|
* by an execve operation based on the old attributes (current->security)
|
|
|
|
* and the information saved in @bprm->security by the set_security hook.
|
|
|
|
* Since this hook function (and its caller) are void, this hook can not
|
|
|
|
* return an error. However, it can leave the security attributes of the
|
|
|
|
* process unchanged if an access failure occurs at this point.
|
|
|
|
* bprm_apply_creds is called under task_lock. @unsafe indicates various
|
|
|
|
* reasons why it may be unsafe to change security state.
|
|
|
|
* @bprm contains the linux_binprm structure.
|
|
|
|
* @bprm_post_apply_creds:
|
|
|
|
* Runs after bprm_apply_creds with the task_lock dropped, so that
|
|
|
|
* functions which cannot be called safely under the task_lock can
|
|
|
|
* be used. This hook is a good place to perform state changes on
|
|
|
|
* the process such as closing open file descriptors to which access
|
|
|
|
* is no longer granted if the attributes were changed.
|
|
|
|
* Note that a security module might need to save state between
|
|
|
|
* bprm_apply_creds and bprm_post_apply_creds to store the decision
|
|
|
|
* on whether the process may proceed.
|
|
|
|
* @bprm contains the linux_binprm structure.
|
|
|
|
* @bprm_set_security:
|
|
|
|
* Save security information in the bprm->security field, typically based
|
|
|
|
* on information about the bprm->file, for later use by the apply_creds
|
|
|
|
* hook. This hook may also optionally check permissions (e.g. for
|
|
|
|
* transitions between security domains).
|
|
|
|
* This hook may be called multiple times during a single execve, e.g. for
|
|
|
|
* interpreters. The hook can tell whether it has already been called by
|
|
|
|
* checking to see if @bprm->security is non-NULL. If so, then the hook
|
|
|
|
* may decide either to retain the security information saved earlier or
|
|
|
|
* to replace it.
|
|
|
|
* @bprm contains the linux_binprm structure.
|
|
|
|
* Return 0 if the hook is successful and permission is granted.
|
|
|
|
* @bprm_check_security:
|
2008-04-23 12:10:25 -06:00
|
|
|
* This hook mediates the point when a search for a binary handler will
|
|
|
|
* begin. It allows a check the @bprm->security value which is set in
|
|
|
|
* the preceding set_security call. The primary difference from
|
|
|
|
* set_security is that the argv list and envp list are reliably
|
|
|
|
* available in @bprm. This hook may be called multiple times
|
|
|
|
* during a single execve; and in each pass set_security is called
|
|
|
|
* first.
|
|
|
|
* @bprm contains the linux_binprm structure.
|
2005-04-16 16:20:36 -06:00
|
|
|
* Return 0 if the hook is successful and permission is granted.
|
|
|
|
* @bprm_secureexec:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Return a boolean value (0 or 1) indicating whether a "secure exec"
|
|
|
|
* is required. The flag is passed in the auxiliary table
|
|
|
|
* on the initial stack to the ELF interpreter to indicate whether libc
|
|
|
|
* should enable secure mode.
|
|
|
|
* @bprm contains the linux_binprm structure.
|
2005-04-16 16:20:36 -06:00
|
|
|
*
|
|
|
|
* Security hooks for filesystem operations.
|
|
|
|
*
|
|
|
|
* @sb_alloc_security:
|
|
|
|
* Allocate and attach a security structure to the sb->s_security field.
|
|
|
|
* The s_security field is initialized to NULL when the structure is
|
|
|
|
* allocated.
|
|
|
|
* @sb contains the super_block structure to be modified.
|
|
|
|
* Return 0 if operation was successful.
|
|
|
|
* @sb_free_security:
|
|
|
|
* Deallocate and clear the sb->s_security field.
|
|
|
|
* @sb contains the super_block structure to be modified.
|
|
|
|
* @sb_statfs:
|
2006-06-23 03:02:58 -06:00
|
|
|
* Check permission before obtaining filesystem statistics for the @mnt
|
|
|
|
* mountpoint.
|
|
|
|
* @dentry is a handle on the superblock for the filesystem.
|
2008-04-23 12:10:25 -06:00
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @sb_mount:
|
|
|
|
* Check permission before an object specified by @dev_name is mounted on
|
|
|
|
* the mount point named by @nd. For an ordinary mount, @dev_name
|
|
|
|
* identifies a device if the file system type requires a device. For a
|
|
|
|
* remount (@flags & MS_REMOUNT), @dev_name is irrelevant. For a
|
|
|
|
* loopback/bind mount (@flags & MS_BIND), @dev_name identifies the
|
|
|
|
* pathname of the object being mounted.
|
|
|
|
* @dev_name contains the name for object being mounted.
|
2008-03-22 15:48:24 -06:00
|
|
|
* @path contains the path for mount point object.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @type contains the filesystem type.
|
|
|
|
* @flags contains the mount flags.
|
|
|
|
* @data contains the filesystem-specific data.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @sb_copy_data:
|
|
|
|
* Allow mount option data to be copied prior to parsing by the filesystem,
|
|
|
|
* so that the security module can extract security-specific mount
|
|
|
|
* options cleanly (a filesystem may modify the data e.g. with strsep()).
|
|
|
|
* This also allows the original mount data to be stripped of security-
|
|
|
|
* specific options to avoid having to make filesystems aware of them.
|
|
|
|
* @type the type of filesystem being mounted.
|
|
|
|
* @orig the original mount data copied from userspace.
|
|
|
|
* @copy copied data which will be passed to the security module.
|
|
|
|
* Returns 0 if the copy was successful.
|
|
|
|
* @sb_check_sb:
|
|
|
|
* Check permission before the device with superblock @mnt->sb is mounted
|
|
|
|
* on the mount point named by @nd.
|
|
|
|
* @mnt contains the vfsmount for device being mounted.
|
2008-03-22 15:48:24 -06:00
|
|
|
* @path contains the path for the mount point.
|
2005-04-16 16:20:36 -06:00
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @sb_umount:
|
|
|
|
* Check permission before the @mnt file system is unmounted.
|
|
|
|
* @mnt contains the mounted file system.
|
|
|
|
* @flags contains the unmount flags, e.g. MNT_FORCE.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @sb_umount_close:
|
|
|
|
* Close any files in the @mnt mounted filesystem that are held open by
|
|
|
|
* the security module. This hook is called during an umount operation
|
|
|
|
* prior to checking whether the filesystem is still busy.
|
|
|
|
* @mnt contains the mounted filesystem.
|
|
|
|
* @sb_umount_busy:
|
|
|
|
* Handle a failed umount of the @mnt mounted filesystem, e.g. re-opening
|
|
|
|
* any files that were closed by umount_close. This hook is called during
|
|
|
|
* an umount operation if the umount fails after a call to the
|
|
|
|
* umount_close hook.
|
|
|
|
* @mnt contains the mounted filesystem.
|
|
|
|
* @sb_post_remount:
|
|
|
|
* Update the security module's state when a filesystem is remounted.
|
|
|
|
* This hook is only called if the remount was successful.
|
|
|
|
* @mnt contains the mounted file system.
|
|
|
|
* @flags contains the new filesystem flags.
|
|
|
|
* @data contains the filesystem-specific data.
|
|
|
|
* @sb_post_addmount:
|
|
|
|
* Update the security module's state when a filesystem is mounted.
|
|
|
|
* This hook is called any time a mount is successfully grafetd to
|
|
|
|
* the tree.
|
|
|
|
* @mnt contains the mounted filesystem.
|
2008-03-22 15:48:24 -06:00
|
|
|
* @mountpoint contains the path for the mount point.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @sb_pivotroot:
|
|
|
|
* Check permission before pivoting the root filesystem.
|
2008-03-22 15:48:24 -06:00
|
|
|
* @old_path contains the path for the new location of the current root (put_old).
|
2008-04-23 12:10:25 -06:00
|
|
|
* @new_path contains the path for the new root (new_root).
|
2005-04-16 16:20:36 -06:00
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @sb_post_pivotroot:
|
|
|
|
* Update module state after a successful pivot.
|
2008-03-22 15:48:24 -06:00
|
|
|
* @old_path contains the path for the old root.
|
2008-04-23 12:10:25 -06:00
|
|
|
* @new_path contains the path for the new root.
|
2007-11-30 11:00:35 -07:00
|
|
|
* @sb_set_mnt_opts:
|
|
|
|
* Set the security relevant mount options used for a superblock
|
|
|
|
* @sb the superblock to set security mount options for
|
2008-03-05 08:31:54 -07:00
|
|
|
* @opts binary data structure containing all lsm mount data
|
2007-11-30 11:00:35 -07:00
|
|
|
* @sb_clone_mnt_opts:
|
|
|
|
* Copy all security options from a given superblock to another
|
|
|
|
* @oldsb old superblock which contain information to clone
|
|
|
|
* @newsb new superblock which needs filled in
|
2008-03-05 08:31:54 -07:00
|
|
|
* @sb_parse_opts_str:
|
|
|
|
* Parse a string of security data filling in the opts structure
|
|
|
|
* @options string containing all mount options known by the LSM
|
|
|
|
* @opts binary data structure usable by the LSM
|
2005-04-16 16:20:36 -06:00
|
|
|
*
|
|
|
|
* Security hooks for inode operations.
|
|
|
|
*
|
|
|
|
* @inode_alloc_security:
|
|
|
|
* Allocate and attach a security structure to @inode->i_security. The
|
|
|
|
* i_security field is initialized to NULL when the inode structure is
|
|
|
|
* allocated.
|
|
|
|
* @inode contains the inode structure.
|
|
|
|
* Return 0 if operation was successful.
|
|
|
|
* @inode_free_security:
|
|
|
|
* @inode contains the inode structure.
|
|
|
|
* Deallocate the inode security structure and set @inode->i_security to
|
2008-04-23 12:10:25 -06:00
|
|
|
* NULL.
|
2005-09-09 14:01:35 -06:00
|
|
|
* @inode_init_security:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Obtain the security attribute name suffix and value to set on a newly
|
2005-09-09 14:01:35 -06:00
|
|
|
* created inode and set up the incore security field for the new inode.
|
|
|
|
* This hook is called by the fs code as part of the inode creation
|
|
|
|
* transaction and provides for atomic labeling of the inode, unlike
|
|
|
|
* the post_create/mkdir/... hooks called by the VFS. The hook function
|
|
|
|
* is expected to allocate the name and value via kmalloc, with the caller
|
|
|
|
* being responsible for calling kfree after using them.
|
|
|
|
* If the security module does not use security attributes or does
|
|
|
|
* not wish to put a security attribute on this particular inode,
|
|
|
|
* then it should return -EOPNOTSUPP to skip this processing.
|
|
|
|
* @inode contains the inode structure of the newly created inode.
|
|
|
|
* @dir contains the inode structure of the parent directory.
|
|
|
|
* @name will be set to the allocated name suffix (e.g. selinux).
|
|
|
|
* @value will be set to the allocated attribute value.
|
|
|
|
* @len will be set to the length of the value.
|
|
|
|
* Returns 0 if @name and @value have been successfully set,
|
|
|
|
* -EOPNOTSUPP if no security attribute is needed, or
|
|
|
|
* -ENOMEM on memory allocation failure.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @inode_create:
|
|
|
|
* Check permission to create a regular file.
|
|
|
|
* @dir contains inode structure of the parent of the new file.
|
|
|
|
* @dentry contains the dentry structure for the file to be created.
|
|
|
|
* @mode contains the file mode of the file to be created.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_link:
|
|
|
|
* Check permission before creating a new hard link to a file.
|
|
|
|
* @old_dentry contains the dentry structure for an existing link to the file.
|
|
|
|
* @dir contains the inode structure of the parent directory of the new link.
|
|
|
|
* @new_dentry contains the dentry structure for the new link.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_unlink:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Check the permission to remove a hard link to a file.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @dir contains the inode structure of parent directory of the file.
|
|
|
|
* @dentry contains the dentry structure for file to be unlinked.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_symlink:
|
|
|
|
* Check the permission to create a symbolic link to a file.
|
|
|
|
* @dir contains the inode structure of parent directory of the symbolic link.
|
|
|
|
* @dentry contains the dentry structure of the symbolic link.
|
|
|
|
* @old_name contains the pathname of file.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_mkdir:
|
|
|
|
* Check permissions to create a new directory in the existing directory
|
2008-04-23 12:10:25 -06:00
|
|
|
* associated with inode strcture @dir.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @dir containst the inode structure of parent of the directory to be created.
|
|
|
|
* @dentry contains the dentry structure of new directory.
|
|
|
|
* @mode contains the mode of new directory.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_rmdir:
|
|
|
|
* Check the permission to remove a directory.
|
|
|
|
* @dir contains the inode structure of parent of the directory to be removed.
|
|
|
|
* @dentry contains the dentry structure of directory to be removed.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_mknod:
|
|
|
|
* Check permissions when creating a special file (or a socket or a fifo
|
|
|
|
* file created via the mknod system call). Note that if mknod operation
|
|
|
|
* is being done for a regular file, then the create hook will be called
|
|
|
|
* and not this hook.
|
|
|
|
* @dir contains the inode structure of parent of the new file.
|
|
|
|
* @dentry contains the dentry structure of the new file.
|
|
|
|
* @mode contains the mode of the new file.
|
2007-05-09 00:57:56 -06:00
|
|
|
* @dev contains the device number.
|
2005-04-16 16:20:36 -06:00
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_rename:
|
|
|
|
* Check for permission to rename a file or directory.
|
|
|
|
* @old_dir contains the inode structure for parent of the old link.
|
|
|
|
* @old_dentry contains the dentry structure of the old link.
|
|
|
|
* @new_dir contains the inode structure for parent of the new link.
|
|
|
|
* @new_dentry contains the dentry structure of the new link.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_readlink:
|
|
|
|
* Check the permission to read the symbolic link.
|
|
|
|
* @dentry contains the dentry structure for the file link.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_follow_link:
|
|
|
|
* Check permission to follow a symbolic link when looking up a pathname.
|
|
|
|
* @dentry contains the dentry structure for the link.
|
|
|
|
* @nd contains the nameidata structure for the parent directory.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_permission:
|
|
|
|
* Check permission before accessing an inode. This hook is called by the
|
|
|
|
* existing Linux permission function, so a security module can use it to
|
|
|
|
* provide additional checking for existing Linux permission checks.
|
|
|
|
* Notice that this hook is called when a file is opened (as well as many
|
|
|
|
* other operations), whereas the file_security_ops permission hook is
|
|
|
|
* called when the actual read/write operations are performed.
|
|
|
|
* @inode contains the inode structure to check.
|
|
|
|
* @mask contains the permission mask.
|
2008-04-23 12:10:25 -06:00
|
|
|
* @nd contains the nameidata (may be NULL).
|
2005-04-16 16:20:36 -06:00
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_setattr:
|
|
|
|
* Check permission before setting file attributes. Note that the kernel
|
|
|
|
* call to notify_change is performed from several locations, whenever
|
|
|
|
* file attributes change (such as when a file is truncated, chown/chmod
|
|
|
|
* operations, transferring disk quotas, etc).
|
|
|
|
* @dentry contains the dentry structure for the file.
|
|
|
|
* @attr is the iattr structure containing the new file attributes.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_getattr:
|
|
|
|
* Check permission before obtaining file attributes.
|
|
|
|
* @mnt is the vfsmount where the dentry was looked up
|
|
|
|
* @dentry contains the dentry structure for the file.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @inode_delete:
|
|
|
|
* @inode contains the inode structure for deleted inode.
|
|
|
|
* This hook is called when a deleted inode is released (i.e. an inode
|
|
|
|
* with no hard links has its use count drop to zero). A security module
|
|
|
|
* can use this hook to release any persistent label associated with the
|
|
|
|
* inode.
|
|
|
|
* @inode_setxattr:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Check permission before setting the extended attributes
|
|
|
|
* @value identified by @name for @dentry.
|
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @inode_post_setxattr:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Update inode security field after successful setxattr operation.
|
|
|
|
* @value identified by @name for @dentry.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @inode_getxattr:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Check permission before obtaining the extended attributes
|
|
|
|
* identified by @name for @dentry.
|
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @inode_listxattr:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Check permission before obtaining the list of extended attribute
|
|
|
|
* names for @dentry.
|
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @inode_removexattr:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Check permission before removing the extended attribute
|
|
|
|
* identified by @name for @dentry.
|
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @inode_getsecurity:
|
2008-02-04 23:29:39 -07:00
|
|
|
* Retrieve a copy of the extended attribute representation of the
|
|
|
|
* security label associated with @name for @inode via @buffer. Note that
|
|
|
|
* @name is the remainder of the attribute name after the security prefix
|
|
|
|
* has been removed. @alloc is used to specify of the call should return a
|
|
|
|
* value via the buffer or just the value length Return size of buffer on
|
|
|
|
* success.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @inode_setsecurity:
|
|
|
|
* Set the security label associated with @name for @inode from the
|
|
|
|
* extended attribute value @value. @size indicates the size of the
|
|
|
|
* @value in bytes. @flags may be XATTR_CREATE, XATTR_REPLACE, or 0.
|
2008-04-23 12:10:25 -06:00
|
|
|
* Note that @name is the remainder of the attribute name after the
|
2005-04-16 16:20:36 -06:00
|
|
|
* security. prefix has been removed.
|
|
|
|
* Return 0 on success.
|
|
|
|
* @inode_listsecurity:
|
|
|
|
* Copy the extended attribute names for the security labels
|
|
|
|
* associated with @inode into @buffer. The maximum size of @buffer
|
|
|
|
* is specified by @buffer_size. @buffer may be NULL to request
|
|
|
|
* the size of the buffer required.
|
|
|
|
* Returns number of bytes used/required on success.
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 00:31:36 -06:00
|
|
|
* @inode_need_killpriv:
|
|
|
|
* Called when an inode has been changed.
|
|
|
|
* @dentry is the dentry being changed.
|
|
|
|
* Return <0 on error to abort the inode change operation.
|
|
|
|
* Return 0 if inode_killpriv does not need to be called.
|
|
|
|
* Return >0 if inode_killpriv does need to be called.
|
|
|
|
* @inode_killpriv:
|
|
|
|
* The setuid bit is being removed. Remove similar security labels.
|
|
|
|
* Called with the dentry->d_inode->i_mutex held.
|
|
|
|
* @dentry is the dentry being changed.
|
|
|
|
* Return 0 on success. If error is returned, then the operation
|
|
|
|
* causing setuid bit removal is failed.
|
2008-03-01 12:51:09 -07:00
|
|
|
* @inode_getsecid:
|
|
|
|
* Get the secid associated with the node.
|
|
|
|
* @inode contains a pointer to the inode.
|
|
|
|
* @secid contains a pointer to the location where result will be saved.
|
|
|
|
* In case of failure, @secid will be set to zero.
|
2005-04-16 16:20:36 -06:00
|
|
|
*
|
|
|
|
* Security hooks for file operations
|
|
|
|
*
|
|
|
|
* @file_permission:
|
|
|
|
* Check file permissions before accessing an open file. This hook is
|
|
|
|
* called by various operations that read or write files. A security
|
|
|
|
* module can use this hook to perform additional checking on these
|
|
|
|
* operations, e.g. to revalidate permissions on use to support privilege
|
|
|
|
* bracketing or policy changes. Notice that this hook is used when the
|
|
|
|
* actual read/write operations are performed, whereas the
|
|
|
|
* inode_security_ops hook is called when a file is opened (as well as
|
|
|
|
* many other operations).
|
|
|
|
* Caveat: Although this hook can be used to revalidate permissions for
|
|
|
|
* various system call operations that read or write files, it does not
|
|
|
|
* address the revalidation of permissions for memory-mapped files.
|
|
|
|
* Security modules must handle this separately if they need such
|
|
|
|
* revalidation.
|
|
|
|
* @file contains the file structure being accessed.
|
|
|
|
* @mask contains the requested permissions.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @file_alloc_security:
|
|
|
|
* Allocate and attach a security structure to the file->f_security field.
|
|
|
|
* The security field is initialized to NULL when the structure is first
|
|
|
|
* created.
|
|
|
|
* @file contains the file structure to secure.
|
|
|
|
* Return 0 if the hook is successful and permission is granted.
|
|
|
|
* @file_free_security:
|
|
|
|
* Deallocate and free any security structures stored in file->f_security.
|
|
|
|
* @file contains the file structure being modified.
|
|
|
|
* @file_ioctl:
|
|
|
|
* @file contains the file structure.
|
|
|
|
* @cmd contains the operation to perform.
|
|
|
|
* @arg contains the operational arguments.
|
|
|
|
* Check permission for an ioctl operation on @file. Note that @arg can
|
|
|
|
* sometimes represents a user space pointer; in other cases, it may be a
|
|
|
|
* simple integer value. When @arg represents a user space pointer, it
|
|
|
|
* should never be used by the security module.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @file_mmap :
|
|
|
|
* Check permissions for a mmap operation. The @file may be NULL, e.g.
|
|
|
|
* if mapping anonymous memory.
|
|
|
|
* @file contains the file structure for file to map (may be NULL).
|
|
|
|
* @reqprot contains the protection requested by the application.
|
|
|
|
* @prot contains the protection that will be applied by the kernel.
|
|
|
|
* @flags contains the operational flags.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @file_mprotect:
|
|
|
|
* Check permissions before changing memory access permissions.
|
|
|
|
* @vma contains the memory region to modify.
|
|
|
|
* @reqprot contains the protection requested by the application.
|
|
|
|
* @prot contains the protection that will be applied by the kernel.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @file_lock:
|
|
|
|
* Check permission before performing file locking operations.
|
|
|
|
* Note: this hook mediates both flock and fcntl style locks.
|
|
|
|
* @file contains the file structure.
|
|
|
|
* @cmd contains the posix-translated lock operation to perform
|
|
|
|
* (e.g. F_RDLCK, F_WRLCK).
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @file_fcntl:
|
|
|
|
* Check permission before allowing the file operation specified by @cmd
|
|
|
|
* from being performed on the file @file. Note that @arg can sometimes
|
|
|
|
* represents a user space pointer; in other cases, it may be a simple
|
|
|
|
* integer value. When @arg represents a user space pointer, it should
|
|
|
|
* never be used by the security module.
|
|
|
|
* @file contains the file structure.
|
|
|
|
* @cmd contains the operation to be performed.
|
|
|
|
* @arg contains the operational arguments.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @file_set_fowner:
|
|
|
|
* Save owner security information (typically from current->security) in
|
|
|
|
* file->f_security for later use by the send_sigiotask hook.
|
|
|
|
* @file contains the file structure to update.
|
|
|
|
* Return 0 on success.
|
|
|
|
* @file_send_sigiotask:
|
|
|
|
* Check permission for the file owner @fown to send SIGIO or SIGURG to the
|
|
|
|
* process @tsk. Note that this hook is sometimes called from interrupt.
|
|
|
|
* Note that the fown_struct, @fown, is never outside the context of a
|
|
|
|
* struct file, so the file structure (and associated security information)
|
|
|
|
* can always be obtained:
|
2007-02-10 02:46:25 -07:00
|
|
|
* container_of(fown, struct file, f_owner)
|
2008-04-23 12:10:25 -06:00
|
|
|
* @tsk contains the structure of task receiving signal.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @fown contains the file owner information.
|
|
|
|
* @sig is the signal that will be sent. When 0, kernel sends SIGIO.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @file_receive:
|
|
|
|
* This hook allows security modules to control the ability of a process
|
|
|
|
* to receive an open file descriptor via socket IPC.
|
|
|
|
* @file contains the file structure being received.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
*
|
2007-09-13 18:27:07 -06:00
|
|
|
* Security hook for dentry
|
|
|
|
*
|
|
|
|
* @dentry_open
|
|
|
|
* Save open-time permission checking state for later use upon
|
|
|
|
* file_permission, and recheck access if anything has changed
|
|
|
|
* since inode_permission.
|
|
|
|
*
|
2005-04-16 16:20:36 -06:00
|
|
|
* Security hooks for task operations.
|
|
|
|
*
|
|
|
|
* @task_create:
|
|
|
|
* Check permission before creating a child process. See the clone(2)
|
|
|
|
* manual page for definitions of the @clone_flags.
|
|
|
|
* @clone_flags contains the flags indicating what should be shared.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @task_alloc_security:
|
|
|
|
* @p contains the task_struct for child process.
|
|
|
|
* Allocate and attach a security structure to the p->security field. The
|
|
|
|
* security field is initialized to NULL when the task structure is
|
|
|
|
* allocated.
|
|
|
|
* Return 0 if operation was successful.
|
|
|
|
* @task_free_security:
|
|
|
|
* @p contains the task_struct for process.
|
|
|
|
* Deallocate and clear the p->security field.
|
|
|
|
* @task_setuid:
|
|
|
|
* Check permission before setting one or more of the user identity
|
|
|
|
* attributes of the current process. The @flags parameter indicates
|
|
|
|
* which of the set*uid system calls invoked this hook and how to
|
|
|
|
* interpret the @id0, @id1, and @id2 parameters. See the LSM_SETID
|
|
|
|
* definitions at the beginning of this file for the @flags values and
|
|
|
|
* their meanings.
|
|
|
|
* @id0 contains a uid.
|
|
|
|
* @id1 contains a uid.
|
|
|
|
* @id2 contains a uid.
|
|
|
|
* @flags contains one of the LSM_SETID_* values.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @task_post_setuid:
|
|
|
|
* Update the module's state after setting one or more of the user
|
|
|
|
* identity attributes of the current process. The @flags parameter
|
|
|
|
* indicates which of the set*uid system calls invoked this hook. If
|
|
|
|
* @flags is LSM_SETID_FS, then @old_ruid is the old fs uid and the other
|
|
|
|
* parameters are not used.
|
|
|
|
* @old_ruid contains the old real uid (or fs uid if LSM_SETID_FS).
|
|
|
|
* @old_euid contains the old effective uid (or -1 if LSM_SETID_FS).
|
|
|
|
* @old_suid contains the old saved uid (or -1 if LSM_SETID_FS).
|
|
|
|
* @flags contains one of the LSM_SETID_* values.
|
|
|
|
* Return 0 on success.
|
|
|
|
* @task_setgid:
|
|
|
|
* Check permission before setting one or more of the group identity
|
|
|
|
* attributes of the current process. The @flags parameter indicates
|
|
|
|
* which of the set*gid system calls invoked this hook and how to
|
|
|
|
* interpret the @id0, @id1, and @id2 parameters. See the LSM_SETID
|
|
|
|
* definitions at the beginning of this file for the @flags values and
|
|
|
|
* their meanings.
|
|
|
|
* @id0 contains a gid.
|
|
|
|
* @id1 contains a gid.
|
|
|
|
* @id2 contains a gid.
|
|
|
|
* @flags contains one of the LSM_SETID_* values.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @task_setpgid:
|
|
|
|
* Check permission before setting the process group identifier of the
|
|
|
|
* process @p to @pgid.
|
|
|
|
* @p contains the task_struct for process being modified.
|
|
|
|
* @pgid contains the new pgid.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @task_getpgid:
|
|
|
|
* Check permission before getting the process group identifier of the
|
|
|
|
* process @p.
|
|
|
|
* @p contains the task_struct for the process.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @task_getsid:
|
|
|
|
* Check permission before getting the session identifier of the process
|
|
|
|
* @p.
|
|
|
|
* @p contains the task_struct for the process.
|
|
|
|
* Return 0 if permission is granted.
|
2006-06-30 02:55:46 -06:00
|
|
|
* @task_getsecid:
|
|
|
|
* Retrieve the security identifier of the process @p.
|
|
|
|
* @p contains the task_struct for the process and place is into @secid.
|
2008-03-01 12:51:09 -07:00
|
|
|
* In case of failure, @secid will be set to zero.
|
|
|
|
*
|
2005-04-16 16:20:36 -06:00
|
|
|
* @task_setgroups:
|
|
|
|
* Check permission before setting the supplementary group set of the
|
|
|
|
* current process.
|
|
|
|
* @group_info contains the new group information.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @task_setnice:
|
|
|
|
* Check permission before setting the nice value of @p to @nice.
|
|
|
|
* @p contains the task_struct of process.
|
|
|
|
* @nice contains the new nice value.
|
|
|
|
* Return 0 if permission is granted.
|
2006-06-23 03:03:58 -06:00
|
|
|
* @task_setioprio
|
|
|
|
* Check permission before setting the ioprio value of @p to @ioprio.
|
|
|
|
* @p contains the task_struct of process.
|
|
|
|
* @ioprio contains the new ioprio value
|
|
|
|
* Return 0 if permission is granted.
|
2006-06-30 02:55:49 -06:00
|
|
|
* @task_getioprio
|
|
|
|
* Check permission before getting the ioprio value of @p.
|
|
|
|
* @p contains the task_struct of process.
|
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @task_setrlimit:
|
|
|
|
* Check permission before setting the resource limits of the current
|
|
|
|
* process for @resource to @new_rlim. The old resource limit values can
|
|
|
|
* be examined by dereferencing (current->signal->rlim + resource).
|
|
|
|
* @resource contains the resource whose limit is being set.
|
|
|
|
* @new_rlim contains the new limits for @resource.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @task_setscheduler:
|
|
|
|
* Check permission before setting scheduling policy and/or parameters of
|
|
|
|
* process @p based on @policy and @lp.
|
|
|
|
* @p contains the task_struct for process.
|
|
|
|
* @policy contains the scheduling policy.
|
|
|
|
* @lp contains the scheduling parameters.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @task_getscheduler:
|
|
|
|
* Check permission before obtaining scheduling information for process
|
|
|
|
* @p.
|
|
|
|
* @p contains the task_struct for process.
|
|
|
|
* Return 0 if permission is granted.
|
2006-06-23 03:04:01 -06:00
|
|
|
* @task_movememory
|
|
|
|
* Check permission before moving memory owned by process @p.
|
|
|
|
* @p contains the task_struct for process.
|
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @task_kill:
|
|
|
|
* Check permission before sending signal @sig to @p. @info can be NULL,
|
|
|
|
* the constant 1, or a pointer to a siginfo structure. If @info is 1 or
|
|
|
|
* SI_FROMKERNEL(info) is true, then the signal should be viewed as coming
|
|
|
|
* from the kernel and should typically be permitted.
|
|
|
|
* SIGIO signals are handled separately by the send_sigiotask hook in
|
|
|
|
* file_security_ops.
|
|
|
|
* @p contains the task_struct for process.
|
|
|
|
* @info contains the signal information.
|
|
|
|
* @sig contains the signal value.
|
2006-06-30 02:55:46 -06:00
|
|
|
* @secid contains the sid of the process where the signal originated
|
2005-04-16 16:20:36 -06:00
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @task_wait:
|
|
|
|
* Check permission before allowing a process to reap a child process @p
|
|
|
|
* and collect its status information.
|
|
|
|
* @p contains the task_struct for process.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @task_prctl:
|
|
|
|
* Check permission before performing a process control operation on the
|
|
|
|
* current process.
|
|
|
|
* @option contains the operation.
|
|
|
|
* @arg2 contains a argument.
|
|
|
|
* @arg3 contains a argument.
|
|
|
|
* @arg4 contains a argument.
|
|
|
|
* @arg5 contains a argument.
|
capabilities: implement per-process securebits
Filesystem capability support makes it possible to do away with (set)uid-0
based privilege and use capabilities instead. That is, with filesystem
support for capabilities but without this present patch, it is (conceptually)
possible to manage a system with capabilities alone and never need to obtain
privilege via (set)uid-0.
Of course, conceptually isn't quite the same as currently possible since few
user applications, certainly not enough to run a viable system, are currently
prepared to leverage capabilities to exercise privilege. Further, many
applications exist that may never get upgraded in this way, and the kernel
will continue to want to support their setuid-0 base privilege needs.
Where pure-capability applications evolve and replace setuid-0 binaries, it is
desirable that there be a mechanisms by which they can contain their
privilege. In addition to leveraging the per-process bounding and inheritable
sets, this should include suppressing the privilege of the uid-0 superuser
from the process' tree of children.
The feature added by this patch can be leveraged to suppress the privilege
associated with (set)uid-0. This suppression requires CAP_SETPCAP to
initiate, and only immediately affects the 'current' process (it is inherited
through fork()/exec()). This reimplementation differs significantly from the
historical support for securebits which was system-wide, unwieldy and which
has ultimately withered to a dead relic in the source of the modern kernel.
With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
all legacy privilege (through uid=0) for itself and all subsequently
fork()'d/exec()'d children with:
prctl(PR_SET_SECUREBITS, 0x2f);
This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
enabled at configure time.
[akpm@linux-foundation.org: fix uninitialised var warning]
[serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Reviewed-by: James Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 03:13:40 -06:00
|
|
|
* @rc_p contains a pointer to communicate back the forced return code
|
|
|
|
* Return 0 if permission is granted, and non-zero if the security module
|
|
|
|
* has taken responsibility (setting *rc_p) for the prctl call.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @task_reparent_to_init:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Set the security attributes in @p->security for a kernel thread that
|
|
|
|
* is being reparented to the init task.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @p contains the task_struct for the kernel thread.
|
|
|
|
* @task_to_inode:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Set the security attributes for an inode based on an associated task's
|
|
|
|
* security attributes, e.g. for /proc/pid inodes.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @p contains the task_struct for the task.
|
|
|
|
* @inode contains the inode structure for the inode.
|
|
|
|
*
|
|
|
|
* Security hooks for Netlink messaging.
|
|
|
|
*
|
|
|
|
* @netlink_send:
|
|
|
|
* Save security information for a netlink message so that permission
|
|
|
|
* checking can be performed when the message is processed. The security
|
|
|
|
* information can be saved using the eff_cap field of the
|
2008-04-23 12:10:25 -06:00
|
|
|
* netlink_skb_parms structure. Also may be used to provide fine
|
2005-04-16 16:20:36 -06:00
|
|
|
* grained control over message transmission.
|
|
|
|
* @sk associated sock of task sending the message.,
|
|
|
|
* @skb contains the sk_buff structure for the netlink message.
|
|
|
|
* Return 0 if the information was successfully saved and message
|
|
|
|
* is allowed to be transmitted.
|
|
|
|
* @netlink_recv:
|
|
|
|
* Check permission before processing the received netlink message in
|
|
|
|
* @skb.
|
|
|
|
* @skb contains the sk_buff structure for the netlink message.
|
2006-06-27 14:26:11 -06:00
|
|
|
* @cap indicates the capability required
|
2005-04-16 16:20:36 -06:00
|
|
|
* Return 0 if permission is granted.
|
|
|
|
*
|
|
|
|
* Security hooks for Unix domain networking.
|
|
|
|
*
|
|
|
|
* @unix_stream_connect:
|
|
|
|
* Check permissions before establishing a Unix domain stream connection
|
|
|
|
* between @sock and @other.
|
|
|
|
* @sock contains the socket structure.
|
|
|
|
* @other contains the peer socket structure.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @unix_may_send:
|
|
|
|
* Check permissions before connecting or sending datagrams from @sock to
|
|
|
|
* @other.
|
|
|
|
* @sock contains the socket structure.
|
|
|
|
* @sock contains the peer socket structure.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
*
|
|
|
|
* The @unix_stream_connect and @unix_may_send hooks were necessary because
|
|
|
|
* Linux provides an alternative to the conventional file name space for Unix
|
|
|
|
* domain sockets. Whereas binding and connecting to sockets in the file name
|
|
|
|
* space is mediated by the typical file permissions (and caught by the mknod
|
|
|
|
* and permission hooks in inode_security_ops), binding and connecting to
|
|
|
|
* sockets in the abstract name space is completely unmediated. Sufficient
|
|
|
|
* control of Unix domain sockets in the abstract name space isn't possible
|
|
|
|
* using only the socket layer hooks, since we need to know the actual target
|
|
|
|
* socket, which is not looked up until we are inside the af_unix code.
|
|
|
|
*
|
|
|
|
* Security hooks for socket operations.
|
|
|
|
*
|
|
|
|
* @socket_create:
|
|
|
|
* Check permissions prior to creating a new socket.
|
|
|
|
* @family contains the requested protocol family.
|
|
|
|
* @type contains the requested communications type.
|
|
|
|
* @protocol contains the requested protocol.
|
|
|
|
* @kern set to 1 if a kernel socket.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @socket_post_create:
|
|
|
|
* This hook allows a module to update or allocate a per-socket security
|
|
|
|
* structure. Note that the security field was not added directly to the
|
|
|
|
* socket structure, but rather, the socket security information is stored
|
|
|
|
* in the associated inode. Typically, the inode alloc_security hook will
|
|
|
|
* allocate and and attach security information to
|
|
|
|
* sock->inode->i_security. This hook may be used to update the
|
|
|
|
* sock->inode->i_security field with additional information that wasn't
|
|
|
|
* available when the inode was allocated.
|
|
|
|
* @sock contains the newly created socket structure.
|
|
|
|
* @family contains the requested protocol family.
|
|
|
|
* @type contains the requested communications type.
|
|
|
|
* @protocol contains the requested protocol.
|
|
|
|
* @kern set to 1 if a kernel socket.
|
|
|
|
* @socket_bind:
|
|
|
|
* Check permission before socket protocol layer bind operation is
|
|
|
|
* performed and the socket @sock is bound to the address specified in the
|
|
|
|
* @address parameter.
|
|
|
|
* @sock contains the socket structure.
|
|
|
|
* @address contains the address to bind to.
|
|
|
|
* @addrlen contains the length of address.
|
2008-04-23 12:10:25 -06:00
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @socket_connect:
|
|
|
|
* Check permission before socket protocol layer connect operation
|
|
|
|
* attempts to connect socket @sock to a remote address, @address.
|
|
|
|
* @sock contains the socket structure.
|
|
|
|
* @address contains the address of remote endpoint.
|
|
|
|
* @addrlen contains the length of address.
|
2008-04-23 12:10:25 -06:00
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @socket_listen:
|
|
|
|
* Check permission before socket protocol layer listen operation.
|
|
|
|
* @sock contains the socket structure.
|
|
|
|
* @backlog contains the maximum length for the pending connection queue.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @socket_accept:
|
|
|
|
* Check permission before accepting a new connection. Note that the new
|
|
|
|
* socket, @newsock, has been created and some information copied to it,
|
|
|
|
* but the accept operation has not actually been performed.
|
|
|
|
* @sock contains the listening socket structure.
|
|
|
|
* @newsock contains the newly created server socket for connection.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @socket_post_accept:
|
|
|
|
* This hook allows a security module to copy security
|
|
|
|
* information into the newly created socket's inode.
|
|
|
|
* @sock contains the listening socket structure.
|
|
|
|
* @newsock contains the newly created server socket for connection.
|
|
|
|
* @socket_sendmsg:
|
|
|
|
* Check permission before transmitting a message to another socket.
|
|
|
|
* @sock contains the socket structure.
|
|
|
|
* @msg contains the message to be transmitted.
|
|
|
|
* @size contains the size of message.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @socket_recvmsg:
|
|
|
|
* Check permission before receiving a message from a socket.
|
|
|
|
* @sock contains the socket structure.
|
|
|
|
* @msg contains the message structure.
|
|
|
|
* @size contains the size of message structure.
|
|
|
|
* @flags contains the operational flags.
|
2008-04-23 12:10:25 -06:00
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @socket_getsockname:
|
|
|
|
* Check permission before the local address (name) of the socket object
|
|
|
|
* @sock is retrieved.
|
|
|
|
* @sock contains the socket structure.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @socket_getpeername:
|
|
|
|
* Check permission before the remote address (name) of a socket object
|
|
|
|
* @sock is retrieved.
|
|
|
|
* @sock contains the socket structure.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @socket_getsockopt:
|
|
|
|
* Check permissions before retrieving the options associated with socket
|
|
|
|
* @sock.
|
|
|
|
* @sock contains the socket structure.
|
|
|
|
* @level contains the protocol level to retrieve option from.
|
|
|
|
* @optname contains the name of option to retrieve.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @socket_setsockopt:
|
|
|
|
* Check permissions before setting the options associated with socket
|
|
|
|
* @sock.
|
|
|
|
* @sock contains the socket structure.
|
|
|
|
* @level contains the protocol level to set options for.
|
|
|
|
* @optname contains the name of the option to set.
|
2008-04-23 12:10:25 -06:00
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @socket_shutdown:
|
|
|
|
* Checks permission before all or part of a connection on the socket
|
|
|
|
* @sock is shut down.
|
|
|
|
* @sock contains the socket structure.
|
|
|
|
* @how contains the flag indicating how future sends and receives are handled.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @socket_sock_rcv_skb:
|
|
|
|
* Check permissions on incoming network packets. This hook is distinct
|
|
|
|
* from Netfilter's IP input hooks since it is the first time that the
|
|
|
|
* incoming sk_buff @skb has been associated with a particular socket, @sk.
|
|
|
|
* @sk contains the sock (not socket) associated with the incoming sk_buff.
|
|
|
|
* @skb contains the incoming network data.
|
2007-10-19 16:53:30 -06:00
|
|
|
* @socket_getpeersec_stream:
|
2005-04-16 16:20:36 -06:00
|
|
|
* This hook allows the security module to provide peer socket security
|
2007-10-19 16:53:30 -06:00
|
|
|
* state for unix or connected tcp sockets to userspace via getsockopt
|
|
|
|
* SO_GETPEERSEC. For tcp sockets this can be meaningful if the
|
|
|
|
* socket is associated with an ipsec SA.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @sock is the local socket.
|
|
|
|
* @optval userspace memory where the security state is to be copied.
|
|
|
|
* @optlen userspace int where the module should copy the actual length
|
|
|
|
* of the security state.
|
|
|
|
* @len as input is the maximum length to copy to userspace provided
|
|
|
|
* by the caller.
|
|
|
|
* Return 0 if all is well, otherwise, typical getsockopt return
|
|
|
|
* values.
|
2007-10-19 16:53:30 -06:00
|
|
|
* @socket_getpeersec_dgram:
|
2008-04-23 12:10:25 -06:00
|
|
|
* This hook allows the security module to provide peer socket security
|
|
|
|
* state for udp sockets on a per-packet basis to userspace via
|
|
|
|
* getsockopt SO_GETPEERSEC. The application must first have indicated
|
|
|
|
* the IP_PASSSEC option via getsockopt. It can then retrieve the
|
|
|
|
* security state returned by this hook for a packet via the SCM_SECURITY
|
|
|
|
* ancillary message type.
|
|
|
|
* @skb is the skbuff for the packet being queried
|
|
|
|
* @secdata is a pointer to a buffer in which to copy the security data
|
|
|
|
* @seclen is the maximum length for @secdata
|
|
|
|
* Return 0 on success, error on failure.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @sk_alloc_security:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Allocate and attach a security structure to the sk->sk_security field,
|
|
|
|
* which is used to copy security attributes between local stream sockets.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @sk_free_security:
|
|
|
|
* Deallocate security structure.
|
2006-08-05 00:08:56 -06:00
|
|
|
* @sk_clone_security:
|
|
|
|
* Clone/copy security structure.
|
2006-08-05 00:12:42 -06:00
|
|
|
* @sk_getsecid:
|
|
|
|
* Retrieve the LSM-specific secid for the sock to enable caching of network
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
* authorizations.
|
2006-07-25 00:32:50 -06:00
|
|
|
* @sock_graft:
|
|
|
|
* Sets the socket's isec sid to the sock's sid.
|
|
|
|
* @inet_conn_request:
|
|
|
|
* Sets the openreq's sid to socket's sid with MLS portion taken from peer sid.
|
|
|
|
* @inet_csk_clone:
|
|
|
|
* Sets the new child socket's sid to the openreq sid.
|
2006-11-08 16:04:09 -07:00
|
|
|
* @inet_conn_established:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Sets the connection's peersid to the secmark on skb.
|
2006-07-25 00:32:50 -06:00
|
|
|
* @req_classify_flow:
|
|
|
|
* Sets the flow's sid to the openreq sid.
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
*
|
|
|
|
* Security hooks for XFRM operations.
|
|
|
|
*
|
|
|
|
* @xfrm_policy_alloc_security:
|
2008-04-12 20:07:52 -06:00
|
|
|
* @ctxp is a pointer to the xfrm_sec_ctx being added to Security Policy
|
|
|
|
* Database used by the XFRM system.
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
* @sec_ctx contains the security context information being provided by
|
|
|
|
* the user-level policy update program (e.g., setkey).
|
2006-07-25 00:29:07 -06:00
|
|
|
* Allocate a security structure to the xp->security field; the security
|
2006-11-08 16:03:44 -07:00
|
|
|
* field is initialized to NULL when the xfrm_policy is allocated.
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
* Return 0 if operation was successful (memory to allocate, legal context)
|
|
|
|
* @xfrm_policy_clone_security:
|
2008-04-12 20:07:52 -06:00
|
|
|
* @old_ctx contains an existing xfrm_sec_ctx.
|
|
|
|
* @new_ctxp contains a new xfrm_sec_ctx being cloned from old.
|
|
|
|
* Allocate a security structure in new_ctxp that contains the
|
|
|
|
* information from the old_ctx structure.
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
* Return 0 if operation was successful (memory to allocate).
|
|
|
|
* @xfrm_policy_free_security:
|
2008-04-12 20:07:52 -06:00
|
|
|
* @ctx contains the xfrm_sec_ctx
|
2006-06-09 00:39:49 -06:00
|
|
|
* Deallocate xp->security.
|
|
|
|
* @xfrm_policy_delete_security:
|
2008-04-12 20:07:52 -06:00
|
|
|
* @ctx contains the xfrm_sec_ctx.
|
2006-06-09 00:39:49 -06:00
|
|
|
* Authorize deletion of xp->security.
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
* @xfrm_state_alloc_security:
|
|
|
|
* @x contains the xfrm_state being added to the Security Association
|
|
|
|
* Database by the XFRM system.
|
|
|
|
* @sec_ctx contains the security context information being provided by
|
|
|
|
* the user-level SA generation program (e.g., setkey or racoon).
|
2006-07-25 00:29:07 -06:00
|
|
|
* @secid contains the secid from which to take the mls portion of the context.
|
|
|
|
* Allocate a security structure to the x->security field; the security
|
|
|
|
* field is initialized to NULL when the xfrm_state is allocated. Set the
|
|
|
|
* context to correspond to either sec_ctx or polsec, with the mls portion
|
|
|
|
* taken from secid in the latter case.
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
* Return 0 if operation was successful (memory to allocate, legal context).
|
|
|
|
* @xfrm_state_free_security:
|
|
|
|
* @x contains the xfrm_state.
|
2006-06-09 00:39:49 -06:00
|
|
|
* Deallocate x->security.
|
|
|
|
* @xfrm_state_delete_security:
|
|
|
|
* @x contains the xfrm_state.
|
|
|
|
* Authorize deletion of x->security.
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
* @xfrm_policy_lookup:
|
2008-04-12 20:07:52 -06:00
|
|
|
* @ctx contains the xfrm_sec_ctx for which the access control is being
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
* checked.
|
2006-07-25 00:29:07 -06:00
|
|
|
* @fl_secid contains the flow security label that is used to authorize
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
* access to the policy xp.
|
|
|
|
* @dir contains the direction of the flow (input or output).
|
2006-07-25 00:29:07 -06:00
|
|
|
* Check permission when a flow selects a xfrm_policy for processing
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
* XFRMs on a packet. The hook is called when selecting either a
|
|
|
|
* per-socket policy or a generic xfrm policy.
|
IPsec: correct semantics for SELinux policy matching
Currently when an IPSec policy rule doesn't specify a security
context, it is assumed to be "unlabeled" by SELinux, and so
the IPSec policy rule fails to match to a flow that it would
otherwise match to, unless one has explicitly added an SELinux
policy rule allowing the flow to "polmatch" to the "unlabeled"
IPSec policy rules. In the absence of such an explicitly added
SELinux policy rule, the IPSec policy rule fails to match and
so the packet(s) flow in clear text without the otherwise applicable
xfrm(s) applied.
The above SELinux behavior violates the SELinux security notion of
"deny by default" which should actually translate to "encrypt by
default" in the above case.
This was first reported by Evgeniy Polyakov and the way James Morris
was seeing the problem was when connecting via IPsec to a
confined service on an SELinux box (vsftpd), which did not have the
appropriate SELinux policy permissions to send packets via IPsec.
With this patch applied, SELinux "polmatching" of flows Vs. IPSec
policy rules will only come into play when there's a explicit context
specified for the IPSec policy rule (which also means there's corresponding
SELinux policy allowing appropriate domains/flows to polmatch to this context).
Secondly, when a security module is loaded (in this case, SELinux), the
security_xfrm_policy_lookup() hook can return errors other than access denied,
such as -EINVAL. We were not handling that correctly, and in fact
inverting the return logic and propagating a false "ok" back up to
xfrm_lookup(), which then allowed packets to pass as if they were not
associated with an xfrm policy.
The solution for this is to first ensure that errno values are
correctly propagated all the way back up through the various call chains
from security_xfrm_policy_lookup(), and handled correctly.
Then, flow_cache_lookup() is modified, so that if the policy resolver
fails (typically a permission denied via the security module), the flow
cache entry is killed rather than having a null policy assigned (which
indicates that the packet can pass freely). This also forces any future
lookups for the same flow to consult the security module (e.g. SELinux)
for current security policy (rather than, say, caching the error on the
flow cache entry).
This patch: Fix the selinux side of things.
This makes sure SELinux polmatching of flow contexts to IPSec policy
rules comes into play only when an explicit context is associated
with the IPSec policy rule.
Also, this no longer defaults the context of a socket policy to
the context of the socket since the "no explicit context" case
is now handled properly.
Signed-off-by: Venkat Yekkirala <vyekkirala@TrustedCS.com>
Signed-off-by: James Morris <jmorris@namei.org>
2006-10-05 14:42:18 -06:00
|
|
|
* Return 0 if permission is granted, -ESRCH otherwise, or -errno
|
|
|
|
* on other errors.
|
2006-07-25 00:29:07 -06:00
|
|
|
* @xfrm_state_pol_flow_match:
|
|
|
|
* @x contains the state to match.
|
|
|
|
* @xp contains the policy to check for a match.
|
|
|
|
* @fl contains the flow to check for a match.
|
|
|
|
* Return 1 if there is a match.
|
|
|
|
* @xfrm_decode_session:
|
|
|
|
* @skb points to skb to decode.
|
2006-08-05 00:12:42 -06:00
|
|
|
* @secid points to the flow key secid to set.
|
|
|
|
* @ckall says if all xfrms used should be checked for same secid.
|
|
|
|
* Return 0 if ckall is zero or all xfrms used have the same secid.
|
2005-04-16 16:20:36 -06:00
|
|
|
*
|
2005-10-30 16:02:44 -07:00
|
|
|
* Security hooks affecting all Key Management operations
|
|
|
|
*
|
|
|
|
* @key_alloc:
|
|
|
|
* Permit allocation of a key and assign security data. Note that key does
|
|
|
|
* not have a serial number assigned at this point.
|
|
|
|
* @key points to the key.
|
2006-06-26 01:24:50 -06:00
|
|
|
* @flags is the allocation flags
|
2005-10-30 16:02:44 -07:00
|
|
|
* Return 0 if permission is granted, -ve error otherwise.
|
|
|
|
* @key_free:
|
|
|
|
* Notification of destruction; free security data.
|
|
|
|
* @key points to the key.
|
|
|
|
* No return value.
|
|
|
|
* @key_permission:
|
|
|
|
* See whether a specific operational right is granted to a process on a
|
2008-04-23 12:10:25 -06:00
|
|
|
* key.
|
2005-10-30 16:02:44 -07:00
|
|
|
* @key_ref refers to the key (key pointer + possession attribute bit).
|
|
|
|
* @context points to the process to provide the context against which to
|
2008-04-23 12:10:25 -06:00
|
|
|
* evaluate the security data on the key.
|
2005-10-30 16:02:44 -07:00
|
|
|
* @perm describes the combination of permissions required of this key.
|
|
|
|
* Return 1 if permission granted, 0 if permission denied and -ve it the
|
2008-04-23 12:10:25 -06:00
|
|
|
* normal permissions model should be effected.
|
2008-04-29 02:01:26 -06:00
|
|
|
* @key_getsecurity:
|
|
|
|
* Get a textual representation of the security context attached to a key
|
|
|
|
* for the purposes of honouring KEYCTL_GETSECURITY. This function
|
|
|
|
* allocates the storage for the NUL-terminated string and the caller
|
|
|
|
* should free it.
|
|
|
|
* @key points to the key to be queried.
|
|
|
|
* @_buffer points to a pointer that should be set to point to the
|
|
|
|
* resulting string (if no label or an error occurs).
|
|
|
|
* Return the length of the string (including terminating NUL) or -ve if
|
|
|
|
* an error.
|
|
|
|
* May also return 0 (and a NULL buffer pointer) if there is no label.
|
2005-10-30 16:02:44 -07:00
|
|
|
*
|
2005-04-16 16:20:36 -06:00
|
|
|
* Security hooks affecting all System V IPC operations.
|
|
|
|
*
|
|
|
|
* @ipc_permission:
|
|
|
|
* Check permissions for access to IPC
|
|
|
|
* @ipcp contains the kernel IPC permission structure
|
|
|
|
* @flag contains the desired (requested) permission set
|
|
|
|
* Return 0 if permission is granted.
|
2008-03-01 12:51:09 -07:00
|
|
|
* @ipc_getsecid:
|
|
|
|
* Get the secid associated with the ipc object.
|
|
|
|
* @ipcp contains the kernel IPC permission structure.
|
|
|
|
* @secid contains a pointer to the location where result will be saved.
|
|
|
|
* In case of failure, @secid will be set to zero.
|
2005-04-16 16:20:36 -06:00
|
|
|
*
|
|
|
|
* Security hooks for individual messages held in System V IPC message queues
|
|
|
|
* @msg_msg_alloc_security:
|
|
|
|
* Allocate and attach a security structure to the msg->security field.
|
|
|
|
* The security field is initialized to NULL when the structure is first
|
|
|
|
* created.
|
|
|
|
* @msg contains the message structure to be modified.
|
|
|
|
* Return 0 if operation was successful and permission is granted.
|
|
|
|
* @msg_msg_free_security:
|
|
|
|
* Deallocate the security structure for this message.
|
|
|
|
* @msg contains the message structure to be modified.
|
|
|
|
*
|
|
|
|
* Security hooks for System V IPC Message Queues
|
|
|
|
*
|
|
|
|
* @msg_queue_alloc_security:
|
|
|
|
* Allocate and attach a security structure to the
|
|
|
|
* msq->q_perm.security field. The security field is initialized to
|
|
|
|
* NULL when the structure is first created.
|
|
|
|
* @msq contains the message queue structure to be modified.
|
|
|
|
* Return 0 if operation was successful and permission is granted.
|
|
|
|
* @msg_queue_free_security:
|
|
|
|
* Deallocate security structure for this message queue.
|
|
|
|
* @msq contains the message queue structure to be modified.
|
|
|
|
* @msg_queue_associate:
|
|
|
|
* Check permission when a message queue is requested through the
|
|
|
|
* msgget system call. This hook is only called when returning the
|
|
|
|
* message queue identifier for an existing message queue, not when a
|
|
|
|
* new message queue is created.
|
|
|
|
* @msq contains the message queue to act upon.
|
|
|
|
* @msqflg contains the operation control flags.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @msg_queue_msgctl:
|
|
|
|
* Check permission when a message control operation specified by @cmd
|
|
|
|
* is to be performed on the message queue @msq.
|
|
|
|
* The @msq may be NULL, e.g. for IPC_INFO or MSG_INFO.
|
|
|
|
* @msq contains the message queue to act upon. May be NULL.
|
|
|
|
* @cmd contains the operation to be performed.
|
2008-04-23 12:10:25 -06:00
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @msg_queue_msgsnd:
|
|
|
|
* Check permission before a message, @msg, is enqueued on the message
|
|
|
|
* queue, @msq.
|
|
|
|
* @msq contains the message queue to send message to.
|
|
|
|
* @msg contains the message to be enqueued.
|
|
|
|
* @msqflg contains operational flags.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @msg_queue_msgrcv:
|
|
|
|
* Check permission before a message, @msg, is removed from the message
|
2008-04-23 12:10:25 -06:00
|
|
|
* queue, @msq. The @target task structure contains a pointer to the
|
|
|
|
* process that will be receiving the message (not equal to the current
|
2005-04-16 16:20:36 -06:00
|
|
|
* process when inline receives are being performed).
|
|
|
|
* @msq contains the message queue to retrieve message from.
|
|
|
|
* @msg contains the message destination.
|
|
|
|
* @target contains the task structure for recipient process.
|
|
|
|
* @type contains the type of message requested.
|
|
|
|
* @mode contains the operational flags.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
*
|
|
|
|
* Security hooks for System V Shared Memory Segments
|
|
|
|
*
|
|
|
|
* @shm_alloc_security:
|
|
|
|
* Allocate and attach a security structure to the shp->shm_perm.security
|
|
|
|
* field. The security field is initialized to NULL when the structure is
|
|
|
|
* first created.
|
|
|
|
* @shp contains the shared memory structure to be modified.
|
|
|
|
* Return 0 if operation was successful and permission is granted.
|
|
|
|
* @shm_free_security:
|
|
|
|
* Deallocate the security struct for this memory segment.
|
|
|
|
* @shp contains the shared memory structure to be modified.
|
|
|
|
* @shm_associate:
|
|
|
|
* Check permission when a shared memory region is requested through the
|
|
|
|
* shmget system call. This hook is only called when returning the shared
|
|
|
|
* memory region identifier for an existing region, not when a new shared
|
|
|
|
* memory region is created.
|
|
|
|
* @shp contains the shared memory structure to be modified.
|
|
|
|
* @shmflg contains the operation control flags.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @shm_shmctl:
|
|
|
|
* Check permission when a shared memory control operation specified by
|
|
|
|
* @cmd is to be performed on the shared memory region @shp.
|
|
|
|
* The @shp may be NULL, e.g. for IPC_INFO or SHM_INFO.
|
|
|
|
* @shp contains shared memory structure to be modified.
|
|
|
|
* @cmd contains the operation to be performed.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @shm_shmat:
|
|
|
|
* Check permissions prior to allowing the shmat system call to attach the
|
|
|
|
* shared memory segment @shp to the data segment of the calling process.
|
|
|
|
* The attaching address is specified by @shmaddr.
|
|
|
|
* @shp contains the shared memory structure to be modified.
|
|
|
|
* @shmaddr contains the address to attach memory region to.
|
|
|
|
* @shmflg contains the operational flags.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
*
|
|
|
|
* Security hooks for System V Semaphores
|
|
|
|
*
|
|
|
|
* @sem_alloc_security:
|
|
|
|
* Allocate and attach a security structure to the sma->sem_perm.security
|
|
|
|
* field. The security field is initialized to NULL when the structure is
|
|
|
|
* first created.
|
|
|
|
* @sma contains the semaphore structure
|
|
|
|
* Return 0 if operation was successful and permission is granted.
|
|
|
|
* @sem_free_security:
|
|
|
|
* deallocate security struct for this semaphore
|
|
|
|
* @sma contains the semaphore structure.
|
|
|
|
* @sem_associate:
|
|
|
|
* Check permission when a semaphore is requested through the semget
|
|
|
|
* system call. This hook is only called when returning the semaphore
|
|
|
|
* identifier for an existing semaphore, not when a new one must be
|
|
|
|
* created.
|
|
|
|
* @sma contains the semaphore structure.
|
|
|
|
* @semflg contains the operation control flags.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @sem_semctl:
|
|
|
|
* Check permission when a semaphore operation specified by @cmd is to be
|
2008-04-23 12:10:25 -06:00
|
|
|
* performed on the semaphore @sma. The @sma may be NULL, e.g. for
|
2005-04-16 16:20:36 -06:00
|
|
|
* IPC_INFO or SEM_INFO.
|
|
|
|
* @sma contains the semaphore structure. May be NULL.
|
|
|
|
* @cmd contains the operation to be performed.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @sem_semop
|
|
|
|
* Check permissions before performing operations on members of the
|
2008-04-23 12:10:25 -06:00
|
|
|
* semaphore set @sma. If the @alter flag is nonzero, the semaphore set
|
|
|
|
* may be modified.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @sma contains the semaphore structure.
|
|
|
|
* @sops contains the operations to perform.
|
|
|
|
* @nsops contains the number of operations to perform.
|
|
|
|
* @alter contains the flag indicating whether changes are to be made.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
*
|
security: Fix setting of PF_SUPERPRIV by __capable()
Fix the setting of PF_SUPERPRIV by __capable() as it could corrupt the flags
the target process if that is not the current process and it is trying to
change its own flags in a different way at the same time.
__capable() is using neither atomic ops nor locking to protect t->flags. This
patch removes __capable() and introduces has_capability() that doesn't set
PF_SUPERPRIV on the process being queried.
This patch further splits security_ptrace() in two:
(1) security_ptrace_may_access(). This passes judgement on whether one
process may access another only (PTRACE_MODE_ATTACH for ptrace() and
PTRACE_MODE_READ for /proc), and takes a pointer to the child process.
current is the parent.
(2) security_ptrace_traceme(). This passes judgement on PTRACE_TRACEME only,
and takes only a pointer to the parent process. current is the child.
In Smack and commoncap, this uses has_capability() to determine whether
the parent will be permitted to use PTRACE_ATTACH if normal checks fail.
This does not set PF_SUPERPRIV.
Two of the instances of __capable() actually only act on current, and so have
been changed to calls to capable().
Of the places that were using __capable():
(1) The OOM killer calls __capable() thrice when weighing the killability of a
process. All of these now use has_capability().
(2) cap_ptrace() and smack_ptrace() were using __capable() to check to see
whether the parent was allowed to trace any process. As mentioned above,
these have been split. For PTRACE_ATTACH and /proc, capable() is now
used, and for PTRACE_TRACEME, has_capability() is used.
(3) cap_safe_nice() only ever saw current, so now uses capable().
(4) smack_setprocattr() rejected accesses to tasks other than current just
after calling __capable(), so the order of these two tests have been
switched and capable() is used instead.
(5) In smack_file_send_sigiotask(), we need to allow privileged processes to
receive SIGIO on files they're manipulating.
(6) In smack_task_wait(), we let a process wait for a privileged process,
whether or not the process doing the waiting is privileged.
I've tested this with the LTP SELinux and syscalls testscripts.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Morris <jmorris@namei.org>
2008-08-14 04:37:28 -06:00
|
|
|
* @ptrace_may_access:
|
|
|
|
* Check permission before allowing the current process to trace the
|
2005-04-16 16:20:36 -06:00
|
|
|
* @child process.
|
|
|
|
* Security modules may also want to perform a process tracing check
|
|
|
|
* during an execve in the set_security or apply_creds hooks of
|
|
|
|
* binprm_security_ops if the process is being traced and its security
|
|
|
|
* attributes would be changed by the execve.
|
security: Fix setting of PF_SUPERPRIV by __capable()
Fix the setting of PF_SUPERPRIV by __capable() as it could corrupt the flags
the target process if that is not the current process and it is trying to
change its own flags in a different way at the same time.
__capable() is using neither atomic ops nor locking to protect t->flags. This
patch removes __capable() and introduces has_capability() that doesn't set
PF_SUPERPRIV on the process being queried.
This patch further splits security_ptrace() in two:
(1) security_ptrace_may_access(). This passes judgement on whether one
process may access another only (PTRACE_MODE_ATTACH for ptrace() and
PTRACE_MODE_READ for /proc), and takes a pointer to the child process.
current is the parent.
(2) security_ptrace_traceme(). This passes judgement on PTRACE_TRACEME only,
and takes only a pointer to the parent process. current is the child.
In Smack and commoncap, this uses has_capability() to determine whether
the parent will be permitted to use PTRACE_ATTACH if normal checks fail.
This does not set PF_SUPERPRIV.
Two of the instances of __capable() actually only act on current, and so have
been changed to calls to capable().
Of the places that were using __capable():
(1) The OOM killer calls __capable() thrice when weighing the killability of a
process. All of these now use has_capability().
(2) cap_ptrace() and smack_ptrace() were using __capable() to check to see
whether the parent was allowed to trace any process. As mentioned above,
these have been split. For PTRACE_ATTACH and /proc, capable() is now
used, and for PTRACE_TRACEME, has_capability() is used.
(3) cap_safe_nice() only ever saw current, so now uses capable().
(4) smack_setprocattr() rejected accesses to tasks other than current just
after calling __capable(), so the order of these two tests have been
switched and capable() is used instead.
(5) In smack_file_send_sigiotask(), we need to allow privileged processes to
receive SIGIO on files they're manipulating.
(6) In smack_task_wait(), we let a process wait for a privileged process,
whether or not the process doing the waiting is privileged.
I've tested this with the LTP SELinux and syscalls testscripts.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Morris <jmorris@namei.org>
2008-08-14 04:37:28 -06:00
|
|
|
* @child contains the task_struct structure for the target process.
|
Security: split proc ptrace checking into read vs. attach
Enable security modules to distinguish reading of process state via
proc from full ptrace access by renaming ptrace_may_attach to
ptrace_may_access and adding a mode argument indicating whether only
read access or full attach access is requested. This allows security
modules to permit access to reading process state without granting
full ptrace access. The base DAC/capability checking remains unchanged.
Read access to /proc/pid/mem continues to apply a full ptrace attach
check since check_mem_permission() already requires the current task
to already be ptracing the target. The other ptrace checks within
proc for elements like environ, maps, and fds are changed to pass the
read mode instead of attach.
In the SELinux case, we model such reading of process state as a
reading of a proc file labeled with the target process' label. This
enables SELinux policy to permit such reading of process state without
permitting control or manipulation of the target process, as there are
a number of cases where programs probe for such information via proc
but do not need to be able to control the target (e.g. procps,
lsof, PolicyKit, ConsoleKit). At present we have to choose between
allowing full ptrace in policy (more permissive than required/desired)
or breaking functionality (or in some cases just silencing the denials
via dontaudit rules but this can hide genuine attacks).
This version of the patch incorporates comments from Casey Schaufler
(change/replace existing ptrace_may_attach interface, pass access
mode), and Chris Wright (provide greater consistency in the checking).
Note that like their predecessors __ptrace_may_attach and
ptrace_may_attach, the __ptrace_may_access and ptrace_may_access
interfaces use different return value conventions from each other (0
or -errno vs. 1 or 0). I retained this difference to avoid any
changes to the caller logic but made the difference clearer by
changing the latter interface to return a bool rather than an int and
by adding a comment about it to ptrace.h for any future callers.
Signed-off-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Chris Wright <chrisw@sous-sol.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-05-19 06:32:49 -06:00
|
|
|
* @mode contains the PTRACE_MODE flags indicating the form of access.
|
2005-04-16 16:20:36 -06:00
|
|
|
* Return 0 if permission is granted.
|
security: Fix setting of PF_SUPERPRIV by __capable()
Fix the setting of PF_SUPERPRIV by __capable() as it could corrupt the flags
the target process if that is not the current process and it is trying to
change its own flags in a different way at the same time.
__capable() is using neither atomic ops nor locking to protect t->flags. This
patch removes __capable() and introduces has_capability() that doesn't set
PF_SUPERPRIV on the process being queried.
This patch further splits security_ptrace() in two:
(1) security_ptrace_may_access(). This passes judgement on whether one
process may access another only (PTRACE_MODE_ATTACH for ptrace() and
PTRACE_MODE_READ for /proc), and takes a pointer to the child process.
current is the parent.
(2) security_ptrace_traceme(). This passes judgement on PTRACE_TRACEME only,
and takes only a pointer to the parent process. current is the child.
In Smack and commoncap, this uses has_capability() to determine whether
the parent will be permitted to use PTRACE_ATTACH if normal checks fail.
This does not set PF_SUPERPRIV.
Two of the instances of __capable() actually only act on current, and so have
been changed to calls to capable().
Of the places that were using __capable():
(1) The OOM killer calls __capable() thrice when weighing the killability of a
process. All of these now use has_capability().
(2) cap_ptrace() and smack_ptrace() were using __capable() to check to see
whether the parent was allowed to trace any process. As mentioned above,
these have been split. For PTRACE_ATTACH and /proc, capable() is now
used, and for PTRACE_TRACEME, has_capability() is used.
(3) cap_safe_nice() only ever saw current, so now uses capable().
(4) smack_setprocattr() rejected accesses to tasks other than current just
after calling __capable(), so the order of these two tests have been
switched and capable() is used instead.
(5) In smack_file_send_sigiotask(), we need to allow privileged processes to
receive SIGIO on files they're manipulating.
(6) In smack_task_wait(), we let a process wait for a privileged process,
whether or not the process doing the waiting is privileged.
I've tested this with the LTP SELinux and syscalls testscripts.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Morris <jmorris@namei.org>
2008-08-14 04:37:28 -06:00
|
|
|
* @ptrace_traceme:
|
|
|
|
* Check that the @parent process has sufficient permission to trace the
|
|
|
|
* current process before allowing the current process to present itself
|
|
|
|
* to the @parent process for tracing.
|
|
|
|
* The parent process will still have to undergo the ptrace_may_access
|
|
|
|
* checks before it is allowed to trace this one.
|
|
|
|
* @parent contains the task_struct structure for debugger process.
|
|
|
|
* Return 0 if permission is granted.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @capget:
|
|
|
|
* Get the @effective, @inheritable, and @permitted capability sets for
|
|
|
|
* the @target process. The hook may also perform permission checking to
|
|
|
|
* determine if the current process is allowed to see the capability sets
|
|
|
|
* of the @target process.
|
|
|
|
* @target contains the task_struct structure for target process.
|
|
|
|
* @effective contains the effective capability set.
|
|
|
|
* @inheritable contains the inheritable capability set.
|
|
|
|
* @permitted contains the permitted capability set.
|
|
|
|
* Return 0 if the capability sets were successfully obtained.
|
|
|
|
* @capset_check:
|
|
|
|
* Check permission before setting the @effective, @inheritable, and
|
|
|
|
* @permitted capability sets for the @target process.
|
|
|
|
* Caveat: @target is also set to current if a set of processes is
|
|
|
|
* specified (i.e. all processes other than current and init or a
|
|
|
|
* particular process group). Hence, the capset_set hook may need to
|
|
|
|
* revalidate permission to the actual target process.
|
|
|
|
* @target contains the task_struct structure for target process.
|
|
|
|
* @effective contains the effective capability set.
|
|
|
|
* @inheritable contains the inheritable capability set.
|
|
|
|
* @permitted contains the permitted capability set.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @capset_set:
|
|
|
|
* Set the @effective, @inheritable, and @permitted capability sets for
|
|
|
|
* the @target process. Since capset_check cannot always check permission
|
|
|
|
* to the real @target process, this hook may also perform permission
|
|
|
|
* checking to determine if the current process is allowed to set the
|
|
|
|
* capability sets of the @target process. However, this hook has no way
|
|
|
|
* of returning an error due to the structure of the sys_capset code.
|
|
|
|
* @target contains the task_struct structure for target process.
|
|
|
|
* @effective contains the effective capability set.
|
|
|
|
* @inheritable contains the inheritable capability set.
|
|
|
|
* @permitted contains the permitted capability set.
|
2006-03-25 04:07:41 -07:00
|
|
|
* @capable:
|
|
|
|
* Check whether the @tsk process has the @cap capability.
|
|
|
|
* @tsk contains the task_struct for the process.
|
|
|
|
* @cap contains the capability <include/linux/capability.h>.
|
|
|
|
* Return 0 if the capability is granted for @tsk.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @acct:
|
|
|
|
* Check permission before enabling or disabling process accounting. If
|
|
|
|
* accounting is being enabled, then @file refers to the open file used to
|
|
|
|
* store accounting records. If accounting is being disabled, then @file
|
|
|
|
* is NULL.
|
|
|
|
* @file contains the file structure for the accounting file (may be NULL).
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @sysctl:
|
|
|
|
* Check permission before accessing the @table sysctl variable in the
|
|
|
|
* manner specified by @op.
|
|
|
|
* @table contains the ctl_table structure for the sysctl variable.
|
|
|
|
* @op contains the operation (001 = search, 002 = write, 004 = read).
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @syslog:
|
|
|
|
* Check permission before accessing the kernel message ring or changing
|
|
|
|
* logging to the console.
|
2008-04-23 12:10:25 -06:00
|
|
|
* See the syslog(2) manual page for an explanation of the @type values.
|
2005-04-16 16:20:36 -06:00
|
|
|
* @type contains the type of action.
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @settime:
|
|
|
|
* Check permission to change the system time.
|
|
|
|
* struct timespec and timezone are defined in include/linux/time.h
|
|
|
|
* @ts contains new time
|
|
|
|
* @tz contains new timezone
|
|
|
|
* Return 0 if permission is granted.
|
|
|
|
* @vm_enough_memory:
|
|
|
|
* Check permissions for allocating a new virtual mapping.
|
2007-08-22 15:01:28 -06:00
|
|
|
* @mm contains the mm struct it is being added to.
|
2008-04-23 12:10:25 -06:00
|
|
|
* @pages contains the number of pages.
|
2005-04-16 16:20:36 -06:00
|
|
|
* Return 0 if permission is granted.
|
|
|
|
*
|
2006-08-02 15:12:06 -06:00
|
|
|
* @secid_to_secctx:
|
|
|
|
* Convert secid to security context.
|
|
|
|
* @secid contains the security ID.
|
|
|
|
* @secdata contains the pointer that stores the converted security context.
|
2008-01-15 16:47:35 -07:00
|
|
|
* @secctx_to_secid:
|
2008-04-23 12:10:25 -06:00
|
|
|
* Convert security context to secid.
|
|
|
|
* @secid contains the pointer to the generated security ID.
|
|
|
|
* @secdata contains the security context.
|
2006-08-02 15:12:06 -06:00
|
|
|
*
|
|
|
|
* @release_secctx:
|
|
|
|
* Release the security context.
|
|
|
|
* @secdata contains the security context.
|
|
|
|
* @seclen contains the length of the security context.
|
|
|
|
*
|
2008-03-01 13:00:05 -07:00
|
|
|
* Security hooks for Audit
|
|
|
|
*
|
|
|
|
* @audit_rule_init:
|
|
|
|
* Allocate and initialize an LSM audit rule structure.
|
|
|
|
* @field contains the required Audit action. Fields flags are defined in include/linux/audit.h
|
|
|
|
* @op contains the operator the rule uses.
|
|
|
|
* @rulestr contains the context where the rule will be applied to.
|
|
|
|
* @lsmrule contains a pointer to receive the result.
|
|
|
|
* Return 0 if @lsmrule has been successfully set,
|
|
|
|
* -EINVAL in case of an invalid rule.
|
|
|
|
*
|
|
|
|
* @audit_rule_known:
|
|
|
|
* Specifies whether given @rule contains any fields related to current LSM.
|
|
|
|
* @rule contains the audit rule of interest.
|
|
|
|
* Return 1 in case of relation found, 0 otherwise.
|
|
|
|
*
|
|
|
|
* @audit_rule_match:
|
|
|
|
* Determine if given @secid matches a rule previously approved
|
|
|
|
* by @audit_rule_known.
|
|
|
|
* @secid contains the security id in question.
|
|
|
|
* @field contains the field which relates to current LSM.
|
|
|
|
* @op contains the operator that will be used for matching.
|
|
|
|
* @rule points to the audit rule that will be checked against.
|
|
|
|
* @actx points to the audit context associated with the check.
|
|
|
|
* Return 1 if secid matches the rule, 0 if it does not, -ERRNO on failure.
|
|
|
|
*
|
|
|
|
* @audit_rule_free:
|
|
|
|
* Deallocate the LSM audit rule structure previously allocated by
|
|
|
|
* audit_rule_init.
|
|
|
|
* @rule contains the allocated rule
|
|
|
|
*
|
2005-04-16 16:20:36 -06:00
|
|
|
* This is the main security structure.
|
|
|
|
*/
|
|
|
|
struct security_operations {
|
2008-03-06 09:09:10 -07:00
|
|
|
char name[SECURITY_NAME_MAX + 1];
|
|
|
|
|
security: Fix setting of PF_SUPERPRIV by __capable()
Fix the setting of PF_SUPERPRIV by __capable() as it could corrupt the flags
the target process if that is not the current process and it is trying to
change its own flags in a different way at the same time.
__capable() is using neither atomic ops nor locking to protect t->flags. This
patch removes __capable() and introduces has_capability() that doesn't set
PF_SUPERPRIV on the process being queried.
This patch further splits security_ptrace() in two:
(1) security_ptrace_may_access(). This passes judgement on whether one
process may access another only (PTRACE_MODE_ATTACH for ptrace() and
PTRACE_MODE_READ for /proc), and takes a pointer to the child process.
current is the parent.
(2) security_ptrace_traceme(). This passes judgement on PTRACE_TRACEME only,
and takes only a pointer to the parent process. current is the child.
In Smack and commoncap, this uses has_capability() to determine whether
the parent will be permitted to use PTRACE_ATTACH if normal checks fail.
This does not set PF_SUPERPRIV.
Two of the instances of __capable() actually only act on current, and so have
been changed to calls to capable().
Of the places that were using __capable():
(1) The OOM killer calls __capable() thrice when weighing the killability of a
process. All of these now use has_capability().
(2) cap_ptrace() and smack_ptrace() were using __capable() to check to see
whether the parent was allowed to trace any process. As mentioned above,
these have been split. For PTRACE_ATTACH and /proc, capable() is now
used, and for PTRACE_TRACEME, has_capability() is used.
(3) cap_safe_nice() only ever saw current, so now uses capable().
(4) smack_setprocattr() rejected accesses to tasks other than current just
after calling __capable(), so the order of these two tests have been
switched and capable() is used instead.
(5) In smack_file_send_sigiotask(), we need to allow privileged processes to
receive SIGIO on files they're manipulating.
(6) In smack_task_wait(), we let a process wait for a privileged process,
whether or not the process doing the waiting is privileged.
I've tested this with the LTP SELinux and syscalls testscripts.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Morris <jmorris@namei.org>
2008-08-14 04:37:28 -06:00
|
|
|
int (*ptrace_may_access) (struct task_struct *child, unsigned int mode);
|
|
|
|
int (*ptrace_traceme) (struct task_struct *parent);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*capget) (struct task_struct *target,
|
|
|
|
kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable, kernel_cap_t *permitted);
|
|
|
|
int (*capset_check) (struct task_struct *target,
|
|
|
|
kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable,
|
|
|
|
kernel_cap_t *permitted);
|
|
|
|
void (*capset_set) (struct task_struct *target,
|
|
|
|
kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable,
|
|
|
|
kernel_cap_t *permitted);
|
|
|
|
int (*capable) (struct task_struct *tsk, int cap);
|
|
|
|
int (*acct) (struct file *file);
|
|
|
|
int (*sysctl) (struct ctl_table *table, int op);
|
|
|
|
int (*quotactl) (int cmds, int type, int id, struct super_block *sb);
|
|
|
|
int (*quota_on) (struct dentry *dentry);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*syslog) (int type);
|
|
|
|
int (*settime) (struct timespec *ts, struct timezone *tz);
|
2007-08-22 15:01:28 -06:00
|
|
|
int (*vm_enough_memory) (struct mm_struct *mm, long pages);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*bprm_alloc_security) (struct linux_binprm *bprm);
|
|
|
|
void (*bprm_free_security) (struct linux_binprm *bprm);
|
|
|
|
void (*bprm_apply_creds) (struct linux_binprm *bprm, int unsafe);
|
|
|
|
void (*bprm_post_apply_creds) (struct linux_binprm *bprm);
|
|
|
|
int (*bprm_set_security) (struct linux_binprm *bprm);
|
|
|
|
int (*bprm_check_security) (struct linux_binprm *bprm);
|
|
|
|
int (*bprm_secureexec) (struct linux_binprm *bprm);
|
|
|
|
|
|
|
|
int (*sb_alloc_security) (struct super_block *sb);
|
|
|
|
void (*sb_free_security) (struct super_block *sb);
|
|
|
|
int (*sb_copy_data) (char *orig, char *copy);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*sb_kern_mount) (struct super_block *sb, void *data);
|
2008-07-03 17:47:13 -06:00
|
|
|
int (*sb_show_options) (struct seq_file *m, struct super_block *sb);
|
2006-06-23 03:02:58 -06:00
|
|
|
int (*sb_statfs) (struct dentry *dentry);
|
2008-03-22 15:48:24 -06:00
|
|
|
int (*sb_mount) (char *dev_name, struct path *path,
|
2005-04-16 16:20:36 -06:00
|
|
|
char *type, unsigned long flags, void *data);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*sb_check_sb) (struct vfsmount *mnt, struct path *path);
|
|
|
|
int (*sb_umount) (struct vfsmount *mnt, int flags);
|
|
|
|
void (*sb_umount_close) (struct vfsmount *mnt);
|
|
|
|
void (*sb_umount_busy) (struct vfsmount *mnt);
|
|
|
|
void (*sb_post_remount) (struct vfsmount *mnt,
|
2005-04-16 16:20:36 -06:00
|
|
|
unsigned long flags, void *data);
|
2008-04-23 12:10:25 -06:00
|
|
|
void (*sb_post_addmount) (struct vfsmount *mnt,
|
2008-03-22 15:48:24 -06:00
|
|
|
struct path *mountpoint);
|
|
|
|
int (*sb_pivotroot) (struct path *old_path,
|
|
|
|
struct path *new_path);
|
|
|
|
void (*sb_post_pivotroot) (struct path *old_path,
|
|
|
|
struct path *new_path);
|
2008-03-05 08:31:54 -07:00
|
|
|
int (*sb_set_mnt_opts) (struct super_block *sb,
|
|
|
|
struct security_mnt_opts *opts);
|
2007-11-30 11:00:35 -07:00
|
|
|
void (*sb_clone_mnt_opts) (const struct super_block *oldsb,
|
|
|
|
struct super_block *newsb);
|
2008-03-05 08:31:54 -07:00
|
|
|
int (*sb_parse_opts_str) (char *options, struct security_mnt_opts *opts);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*inode_alloc_security) (struct inode *inode);
|
2005-04-16 16:20:36 -06:00
|
|
|
void (*inode_free_security) (struct inode *inode);
|
2005-09-09 14:01:35 -06:00
|
|
|
int (*inode_init_security) (struct inode *inode, struct inode *dir,
|
|
|
|
char **name, void **value, size_t *len);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*inode_create) (struct inode *dir,
|
2008-04-23 12:10:25 -06:00
|
|
|
struct dentry *dentry, int mode);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*inode_link) (struct dentry *old_dentry,
|
2008-04-23 12:10:25 -06:00
|
|
|
struct inode *dir, struct dentry *new_dentry);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*inode_unlink) (struct inode *dir, struct dentry *dentry);
|
|
|
|
int (*inode_symlink) (struct inode *dir,
|
2008-04-23 12:10:25 -06:00
|
|
|
struct dentry *dentry, const char *old_name);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*inode_mkdir) (struct inode *dir, struct dentry *dentry, int mode);
|
|
|
|
int (*inode_rmdir) (struct inode *dir, struct dentry *dentry);
|
|
|
|
int (*inode_mknod) (struct inode *dir, struct dentry *dentry,
|
2008-04-23 12:10:25 -06:00
|
|
|
int mode, dev_t dev);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*inode_rename) (struct inode *old_dir, struct dentry *old_dentry,
|
2008-04-23 12:10:25 -06:00
|
|
|
struct inode *new_dir, struct dentry *new_dentry);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*inode_readlink) (struct dentry *dentry);
|
|
|
|
int (*inode_follow_link) (struct dentry *dentry, struct nameidata *nd);
|
2008-07-17 07:37:02 -06:00
|
|
|
int (*inode_permission) (struct inode *inode, int mask);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*inode_setattr) (struct dentry *dentry, struct iattr *attr);
|
|
|
|
int (*inode_getattr) (struct vfsmount *mnt, struct dentry *dentry);
|
2008-04-23 12:10:25 -06:00
|
|
|
void (*inode_delete) (struct inode *inode);
|
2008-04-29 01:59:41 -06:00
|
|
|
int (*inode_setxattr) (struct dentry *dentry, const char *name,
|
|
|
|
const void *value, size_t size, int flags);
|
|
|
|
void (*inode_post_setxattr) (struct dentry *dentry, const char *name,
|
|
|
|
const void *value, size_t size, int flags);
|
|
|
|
int (*inode_getxattr) (struct dentry *dentry, const char *name);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*inode_listxattr) (struct dentry *dentry);
|
2008-04-29 01:59:41 -06:00
|
|
|
int (*inode_removexattr) (struct dentry *dentry, const char *name);
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 00:31:36 -06:00
|
|
|
int (*inode_need_killpriv) (struct dentry *dentry);
|
|
|
|
int (*inode_killpriv) (struct dentry *dentry);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*inode_getsecurity) (const struct inode *inode, const char *name, void **buffer, bool alloc);
|
|
|
|
int (*inode_setsecurity) (struct inode *inode, const char *name, const void *value, size_t size, int flags);
|
|
|
|
int (*inode_listsecurity) (struct inode *inode, char *buffer, size_t buffer_size);
|
|
|
|
void (*inode_getsecid) (const struct inode *inode, u32 *secid);
|
|
|
|
|
|
|
|
int (*file_permission) (struct file *file, int mask);
|
|
|
|
int (*file_alloc_security) (struct file *file);
|
|
|
|
void (*file_free_security) (struct file *file);
|
|
|
|
int (*file_ioctl) (struct file *file, unsigned int cmd,
|
2005-04-16 16:20:36 -06:00
|
|
|
unsigned long arg);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*file_mmap) (struct file *file,
|
2007-06-28 13:55:21 -06:00
|
|
|
unsigned long reqprot, unsigned long prot,
|
|
|
|
unsigned long flags, unsigned long addr,
|
|
|
|
unsigned long addr_only);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*file_mprotect) (struct vm_area_struct *vma,
|
2005-04-16 16:20:36 -06:00
|
|
|
unsigned long reqprot,
|
|
|
|
unsigned long prot);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*file_lock) (struct file *file, unsigned int cmd);
|
|
|
|
int (*file_fcntl) (struct file *file, unsigned int cmd,
|
2005-04-16 16:20:36 -06:00
|
|
|
unsigned long arg);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*file_set_fowner) (struct file *file);
|
|
|
|
int (*file_send_sigiotask) (struct task_struct *tsk,
|
|
|
|
struct fown_struct *fown, int sig);
|
|
|
|
int (*file_receive) (struct file *file);
|
|
|
|
int (*dentry_open) (struct file *file);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
int (*task_create) (unsigned long clone_flags);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*task_alloc_security) (struct task_struct *p);
|
|
|
|
void (*task_free_security) (struct task_struct *p);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*task_setuid) (uid_t id0, uid_t id1, uid_t id2, int flags);
|
|
|
|
int (*task_post_setuid) (uid_t old_ruid /* or fsuid */ ,
|
|
|
|
uid_t old_euid, uid_t old_suid, int flags);
|
|
|
|
int (*task_setgid) (gid_t id0, gid_t id1, gid_t id2, int flags);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*task_setpgid) (struct task_struct *p, pid_t pgid);
|
|
|
|
int (*task_getpgid) (struct task_struct *p);
|
|
|
|
int (*task_getsid) (struct task_struct *p);
|
|
|
|
void (*task_getsecid) (struct task_struct *p, u32 *secid);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*task_setgroups) (struct group_info *group_info);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*task_setnice) (struct task_struct *p, int nice);
|
|
|
|
int (*task_setioprio) (struct task_struct *p, int ioprio);
|
|
|
|
int (*task_getioprio) (struct task_struct *p);
|
|
|
|
int (*task_setrlimit) (unsigned int resource, struct rlimit *new_rlim);
|
|
|
|
int (*task_setscheduler) (struct task_struct *p, int policy,
|
|
|
|
struct sched_param *lp);
|
|
|
|
int (*task_getscheduler) (struct task_struct *p);
|
|
|
|
int (*task_movememory) (struct task_struct *p);
|
|
|
|
int (*task_kill) (struct task_struct *p,
|
|
|
|
struct siginfo *info, int sig, u32 secid);
|
|
|
|
int (*task_wait) (struct task_struct *p);
|
2005-04-16 16:20:36 -06:00
|
|
|
int (*task_prctl) (int option, unsigned long arg2,
|
|
|
|
unsigned long arg3, unsigned long arg4,
|
capabilities: implement per-process securebits
Filesystem capability support makes it possible to do away with (set)uid-0
based privilege and use capabilities instead. That is, with filesystem
support for capabilities but without this present patch, it is (conceptually)
possible to manage a system with capabilities alone and never need to obtain
privilege via (set)uid-0.
Of course, conceptually isn't quite the same as currently possible since few
user applications, certainly not enough to run a viable system, are currently
prepared to leverage capabilities to exercise privilege. Further, many
applications exist that may never get upgraded in this way, and the kernel
will continue to want to support their setuid-0 base privilege needs.
Where pure-capability applications evolve and replace setuid-0 binaries, it is
desirable that there be a mechanisms by which they can contain their
privilege. In addition to leveraging the per-process bounding and inheritable
sets, this should include suppressing the privilege of the uid-0 superuser
from the process' tree of children.
The feature added by this patch can be leveraged to suppress the privilege
associated with (set)uid-0. This suppression requires CAP_SETPCAP to
initiate, and only immediately affects the 'current' process (it is inherited
through fork()/exec()). This reimplementation differs significantly from the
historical support for securebits which was system-wide, unwieldy and which
has ultimately withered to a dead relic in the source of the modern kernel.
With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
all legacy privilege (through uid=0) for itself and all subsequently
fork()'d/exec()'d children with:
prctl(PR_SET_SECUREBITS, 0x2f);
This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
enabled at configure time.
[akpm@linux-foundation.org: fix uninitialised var warning]
[serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Reviewed-by: James Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 03:13:40 -06:00
|
|
|
unsigned long arg5, long *rc_p);
|
2008-04-23 12:10:25 -06:00
|
|
|
void (*task_reparent_to_init) (struct task_struct *p);
|
|
|
|
void (*task_to_inode) (struct task_struct *p, struct inode *inode);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*ipc_permission) (struct kern_ipc_perm *ipcp, short flag);
|
2008-03-01 12:51:09 -07:00
|
|
|
void (*ipc_getsecid) (struct kern_ipc_perm *ipcp, u32 *secid);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*msg_msg_alloc_security) (struct msg_msg *msg);
|
|
|
|
void (*msg_msg_free_security) (struct msg_msg *msg);
|
|
|
|
|
|
|
|
int (*msg_queue_alloc_security) (struct msg_queue *msq);
|
|
|
|
void (*msg_queue_free_security) (struct msg_queue *msq);
|
|
|
|
int (*msg_queue_associate) (struct msg_queue *msq, int msqflg);
|
|
|
|
int (*msg_queue_msgctl) (struct msg_queue *msq, int cmd);
|
|
|
|
int (*msg_queue_msgsnd) (struct msg_queue *msq,
|
|
|
|
struct msg_msg *msg, int msqflg);
|
|
|
|
int (*msg_queue_msgrcv) (struct msg_queue *msq,
|
|
|
|
struct msg_msg *msg,
|
|
|
|
struct task_struct *target,
|
2005-04-16 16:20:36 -06:00
|
|
|
long type, int mode);
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*shm_alloc_security) (struct shmid_kernel *shp);
|
|
|
|
void (*shm_free_security) (struct shmid_kernel *shp);
|
|
|
|
int (*shm_associate) (struct shmid_kernel *shp, int shmflg);
|
|
|
|
int (*shm_shmctl) (struct shmid_kernel *shp, int cmd);
|
|
|
|
int (*shm_shmat) (struct shmid_kernel *shp,
|
2005-04-16 16:20:36 -06:00
|
|
|
char __user *shmaddr, int shmflg);
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*sem_alloc_security) (struct sem_array *sma);
|
|
|
|
void (*sem_free_security) (struct sem_array *sma);
|
|
|
|
int (*sem_associate) (struct sem_array *sma, int semflg);
|
|
|
|
int (*sem_semctl) (struct sem_array *sma, int cmd);
|
|
|
|
int (*sem_semop) (struct sem_array *sma,
|
|
|
|
struct sembuf *sops, unsigned nsops, int alter);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*netlink_send) (struct sock *sk, struct sk_buff *skb);
|
|
|
|
int (*netlink_recv) (struct sk_buff *skb, int cap);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
void (*d_instantiate) (struct dentry *dentry, struct inode *inode);
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*getprocattr) (struct task_struct *p, char *name, char **value);
|
|
|
|
int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t size);
|
|
|
|
int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen);
|
2008-04-29 13:52:51 -06:00
|
|
|
int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid);
|
2008-04-23 12:10:25 -06:00
|
|
|
void (*release_secctx) (char *secdata, u32 seclen);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
#ifdef CONFIG_SECURITY_NETWORK
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*unix_stream_connect) (struct socket *sock,
|
|
|
|
struct socket *other, struct sock *newsk);
|
|
|
|
int (*unix_may_send) (struct socket *sock, struct socket *other);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
int (*socket_create) (int family, int type, int protocol, int kern);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*socket_post_create) (struct socket *sock, int family,
|
2006-08-05 00:17:57 -06:00
|
|
|
int type, int protocol, int kern);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*socket_bind) (struct socket *sock,
|
|
|
|
struct sockaddr *address, int addrlen);
|
|
|
|
int (*socket_connect) (struct socket *sock,
|
|
|
|
struct sockaddr *address, int addrlen);
|
|
|
|
int (*socket_listen) (struct socket *sock, int backlog);
|
|
|
|
int (*socket_accept) (struct socket *sock, struct socket *newsock);
|
|
|
|
void (*socket_post_accept) (struct socket *sock,
|
|
|
|
struct socket *newsock);
|
|
|
|
int (*socket_sendmsg) (struct socket *sock,
|
|
|
|
struct msghdr *msg, int size);
|
|
|
|
int (*socket_recvmsg) (struct socket *sock,
|
|
|
|
struct msghdr *msg, int size, int flags);
|
|
|
|
int (*socket_getsockname) (struct socket *sock);
|
|
|
|
int (*socket_getpeername) (struct socket *sock);
|
|
|
|
int (*socket_getsockopt) (struct socket *sock, int level, int optname);
|
|
|
|
int (*socket_setsockopt) (struct socket *sock, int level, int optname);
|
|
|
|
int (*socket_shutdown) (struct socket *sock, int how);
|
|
|
|
int (*socket_sock_rcv_skb) (struct sock *sk, struct sk_buff *skb);
|
[SECURITY]: TCP/UDP getpeersec
This patch implements an application of the LSM-IPSec networking
controls whereby an application can determine the label of the
security association its TCP or UDP sockets are currently connected to
via getsockopt and the auxiliary data mechanism of recvmsg.
Patch purpose:
This patch enables a security-aware application to retrieve the
security context of an IPSec security association a particular TCP or
UDP socket is using. The application can then use this security
context to determine the security context for processing on behalf of
the peer at the other end of this connection. In the case of UDP, the
security context is for each individual packet. An example
application is the inetd daemon, which could be modified to start
daemons running at security contexts dependent on the remote client.
Patch design approach:
- Design for TCP
The patch enables the SELinux LSM to set the peer security context for
a socket based on the security context of the IPSec security
association. The application may retrieve this context using
getsockopt. When called, the kernel determines if the socket is a
connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry
cache on the socket to retrieve the security associations. If a
security association has a security context, the context string is
returned, as for UNIX domain sockets.
- Design for UDP
Unlike TCP, UDP is connectionless. This requires a somewhat different
API to retrieve the peer security context. With TCP, the peer
security context stays the same throughout the connection, thus it can
be retrieved at any time between when the connection is established
and when it is torn down. With UDP, each read/write can have
different peer and thus the security context might change every time.
As a result the security context retrieval must be done TOGETHER with
the packet retrieval.
The solution is to build upon the existing Unix domain socket API for
retrieving user credentials. Linux offers the API for obtaining user
credentials via ancillary messages (i.e., out of band/control messages
that are bundled together with a normal message).
Patch implementation details:
- Implementation for TCP
The security context can be retrieved by applications using getsockopt
with the existing SO_PEERSEC flag. As an example (ignoring error
checking):
getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen);
printf("Socket peer context is: %s\n", optbuf);
The SELinux function, selinux_socket_getpeersec, is extended to check
for labeled security associations for connected (TCP_ESTABLISHED ==
sk->sk_state) TCP sockets only. If so, the socket has a dst_cache of
struct dst_entry values that may refer to security associations. If
these have security associations with security contexts, the security
context is returned.
getsockopt returns a buffer that contains a security context string or
the buffer is unmodified.
- Implementation for UDP
To retrieve the security context, the application first indicates to
the kernel such desire by setting the IP_PASSSEC option via
getsockopt. Then the application retrieves the security context using
the auxiliary data mechanism.
An example server application for UDP should look like this:
toggle = 1;
toggle_len = sizeof(toggle);
setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len);
recvmsg(sockfd, &msg_hdr, 0);
if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
cmsg_hdr->cmsg_level == SOL_IP &&
cmsg_hdr->cmsg_type == SCM_SECURITY) {
memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
}
}
ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow
a server socket to receive security context of the peer. A new
ancillary message type SCM_SECURITY.
When the packet is received we get the security context from the
sec_path pointer which is contained in the sk_buff, and copy it to the
ancillary message space. An additional LSM hook,
selinux_socket_getpeersec_udp, is defined to retrieve the security
context from the SELinux space. The existing function,
selinux_socket_getpeersec does not suit our purpose, because the
security context is copied directly to user space, rather than to
kernel space.
Testing:
We have tested the patch by setting up TCP and UDP connections between
applications on two machines using the IPSec policies that result in
labeled security associations being built. For TCP, we can then
extract the peer security context using getsockopt on either end. For
UDP, the receiving end can retrieve the security context using the
auxiliary data mechanism of recvmsg.
Signed-off-by: Catherine Zhang <cxzhang@watson.ibm.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 23:41:23 -07:00
|
|
|
int (*socket_getpeersec_stream) (struct socket *sock, char __user *optval, int __user *optlen, unsigned len);
|
2006-08-02 15:12:06 -06:00
|
|
|
int (*socket_getpeersec_dgram) (struct socket *sock, struct sk_buff *skb, u32 *secid);
|
2005-10-21 01:20:43 -06:00
|
|
|
int (*sk_alloc_security) (struct sock *sk, int family, gfp_t priority);
|
2005-04-16 16:20:36 -06:00
|
|
|
void (*sk_free_security) (struct sock *sk);
|
2006-08-05 00:08:56 -06:00
|
|
|
void (*sk_clone_security) (const struct sock *sk, struct sock *newsk);
|
2006-08-05 00:12:42 -06:00
|
|
|
void (*sk_getsecid) (struct sock *sk, u32 *secid);
|
2008-04-23 12:10:25 -06:00
|
|
|
void (*sock_graft) (struct sock *sk, struct socket *parent);
|
|
|
|
int (*inet_conn_request) (struct sock *sk, struct sk_buff *skb,
|
|
|
|
struct request_sock *req);
|
|
|
|
void (*inet_csk_clone) (struct sock *newsk, const struct request_sock *req);
|
|
|
|
void (*inet_conn_established) (struct sock *sk, struct sk_buff *skb);
|
|
|
|
void (*req_classify_flow) (const struct request_sock *req, struct flowi *fl);
|
2005-04-16 16:20:36 -06:00
|
|
|
#endif /* CONFIG_SECURITY_NETWORK */
|
2005-10-30 16:02:44 -07:00
|
|
|
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
#ifdef CONFIG_SECURITY_NETWORK_XFRM
|
2008-04-12 20:07:52 -06:00
|
|
|
int (*xfrm_policy_alloc_security) (struct xfrm_sec_ctx **ctxp,
|
2006-11-08 16:03:44 -07:00
|
|
|
struct xfrm_user_sec_ctx *sec_ctx);
|
2008-04-12 20:07:52 -06:00
|
|
|
int (*xfrm_policy_clone_security) (struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctx);
|
|
|
|
void (*xfrm_policy_free_security) (struct xfrm_sec_ctx *ctx);
|
|
|
|
int (*xfrm_policy_delete_security) (struct xfrm_sec_ctx *ctx);
|
2006-07-25 00:29:07 -06:00
|
|
|
int (*xfrm_state_alloc_security) (struct xfrm_state *x,
|
2006-11-08 16:03:44 -07:00
|
|
|
struct xfrm_user_sec_ctx *sec_ctx,
|
2006-07-25 00:29:07 -06:00
|
|
|
u32 secid);
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
void (*xfrm_state_free_security) (struct xfrm_state *x);
|
2006-06-09 00:39:49 -06:00
|
|
|
int (*xfrm_state_delete_security) (struct xfrm_state *x);
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*xfrm_policy_lookup) (struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
|
|
|
|
int (*xfrm_state_pol_flow_match) (struct xfrm_state *x,
|
|
|
|
struct xfrm_policy *xp,
|
|
|
|
struct flowi *fl);
|
|
|
|
int (*xfrm_decode_session) (struct sk_buff *skb, u32 *secid, int ckall);
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
#endif /* CONFIG_SECURITY_NETWORK_XFRM */
|
|
|
|
|
2005-10-30 16:02:44 -07:00
|
|
|
/* key management security hooks */
|
|
|
|
#ifdef CONFIG_KEYS
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*key_alloc) (struct key *key, struct task_struct *tsk, unsigned long flags);
|
|
|
|
void (*key_free) (struct key *key);
|
|
|
|
int (*key_permission) (key_ref_t key_ref,
|
|
|
|
struct task_struct *context,
|
|
|
|
key_perm_t perm);
|
2008-04-29 02:01:26 -06:00
|
|
|
int (*key_getsecurity)(struct key *key, char **_buffer);
|
2005-10-30 16:02:44 -07:00
|
|
|
#endif /* CONFIG_KEYS */
|
|
|
|
|
2008-03-01 13:00:05 -07:00
|
|
|
#ifdef CONFIG_AUDIT
|
2008-04-23 12:10:25 -06:00
|
|
|
int (*audit_rule_init) (u32 field, u32 op, char *rulestr, void **lsmrule);
|
|
|
|
int (*audit_rule_known) (struct audit_krule *krule);
|
|
|
|
int (*audit_rule_match) (u32 secid, u32 field, u32 op, void *lsmrule,
|
|
|
|
struct audit_context *actx);
|
|
|
|
void (*audit_rule_free) (void *lsmrule);
|
2008-03-01 13:00:05 -07:00
|
|
|
#endif /* CONFIG_AUDIT */
|
2005-04-16 16:20:36 -06:00
|
|
|
};
|
|
|
|
|
|
|
|
/* prototypes */
|
2008-04-23 12:10:25 -06:00
|
|
|
extern int security_init(void);
|
2008-03-06 09:09:10 -07:00
|
|
|
extern int security_module_enable(struct security_operations *ops);
|
2008-04-23 12:10:25 -06:00
|
|
|
extern int register_security(struct security_operations *ops);
|
2005-07-07 15:37:53 -06:00
|
|
|
extern struct dentry *securityfs_create_file(const char *name, mode_t mode,
|
|
|
|
struct dentry *parent, void *data,
|
2007-02-12 01:55:28 -07:00
|
|
|
const struct file_operations *fops);
|
2005-07-07 15:37:53 -06:00
|
|
|
extern struct dentry *securityfs_create_dir(const char *name, struct dentry *parent);
|
|
|
|
extern void securityfs_remove(struct dentry *dentry);
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2007-10-17 00:31:32 -06:00
|
|
|
/* Security operations */
|
security: Fix setting of PF_SUPERPRIV by __capable()
Fix the setting of PF_SUPERPRIV by __capable() as it could corrupt the flags
the target process if that is not the current process and it is trying to
change its own flags in a different way at the same time.
__capable() is using neither atomic ops nor locking to protect t->flags. This
patch removes __capable() and introduces has_capability() that doesn't set
PF_SUPERPRIV on the process being queried.
This patch further splits security_ptrace() in two:
(1) security_ptrace_may_access(). This passes judgement on whether one
process may access another only (PTRACE_MODE_ATTACH for ptrace() and
PTRACE_MODE_READ for /proc), and takes a pointer to the child process.
current is the parent.
(2) security_ptrace_traceme(). This passes judgement on PTRACE_TRACEME only,
and takes only a pointer to the parent process. current is the child.
In Smack and commoncap, this uses has_capability() to determine whether
the parent will be permitted to use PTRACE_ATTACH if normal checks fail.
This does not set PF_SUPERPRIV.
Two of the instances of __capable() actually only act on current, and so have
been changed to calls to capable().
Of the places that were using __capable():
(1) The OOM killer calls __capable() thrice when weighing the killability of a
process. All of these now use has_capability().
(2) cap_ptrace() and smack_ptrace() were using __capable() to check to see
whether the parent was allowed to trace any process. As mentioned above,
these have been split. For PTRACE_ATTACH and /proc, capable() is now
used, and for PTRACE_TRACEME, has_capability() is used.
(3) cap_safe_nice() only ever saw current, so now uses capable().
(4) smack_setprocattr() rejected accesses to tasks other than current just
after calling __capable(), so the order of these two tests have been
switched and capable() is used instead.
(5) In smack_file_send_sigiotask(), we need to allow privileged processes to
receive SIGIO on files they're manipulating.
(6) In smack_task_wait(), we let a process wait for a privileged process,
whether or not the process doing the waiting is privileged.
I've tested this with the LTP SELinux and syscalls testscripts.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Morris <jmorris@namei.org>
2008-08-14 04:37:28 -06:00
|
|
|
int security_ptrace_may_access(struct task_struct *child, unsigned int mode);
|
|
|
|
int security_ptrace_traceme(struct task_struct *parent);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_capget(struct task_struct *target,
|
2008-04-23 12:10:25 -06:00
|
|
|
kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable,
|
|
|
|
kernel_cap_t *permitted);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_capset_check(struct task_struct *target,
|
|
|
|
kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable,
|
|
|
|
kernel_cap_t *permitted);
|
2008-04-23 12:10:25 -06:00
|
|
|
void security_capset_set(struct task_struct *target,
|
|
|
|
kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable,
|
|
|
|
kernel_cap_t *permitted);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_capable(struct task_struct *tsk, int cap);
|
|
|
|
int security_acct(struct file *file);
|
|
|
|
int security_sysctl(struct ctl_table *table, int op);
|
|
|
|
int security_quotactl(int cmds, int type, int id, struct super_block *sb);
|
|
|
|
int security_quota_on(struct dentry *dentry);
|
|
|
|
int security_syslog(int type);
|
|
|
|
int security_settime(struct timespec *ts, struct timezone *tz);
|
|
|
|
int security_vm_enough_memory(long pages);
|
|
|
|
int security_vm_enough_memory_mm(struct mm_struct *mm, long pages);
|
|
|
|
int security_bprm_alloc(struct linux_binprm *bprm);
|
|
|
|
void security_bprm_free(struct linux_binprm *bprm);
|
|
|
|
void security_bprm_apply_creds(struct linux_binprm *bprm, int unsafe);
|
|
|
|
void security_bprm_post_apply_creds(struct linux_binprm *bprm);
|
|
|
|
int security_bprm_set(struct linux_binprm *bprm);
|
|
|
|
int security_bprm_check(struct linux_binprm *bprm);
|
|
|
|
int security_bprm_secureexec(struct linux_binprm *bprm);
|
|
|
|
int security_sb_alloc(struct super_block *sb);
|
|
|
|
void security_sb_free(struct super_block *sb);
|
2008-03-05 08:31:54 -07:00
|
|
|
int security_sb_copy_data(char *orig, char *copy);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_sb_kern_mount(struct super_block *sb, void *data);
|
2008-07-03 17:47:13 -06:00
|
|
|
int security_sb_show_options(struct seq_file *m, struct super_block *sb);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_sb_statfs(struct dentry *dentry);
|
2008-03-22 15:48:24 -06:00
|
|
|
int security_sb_mount(char *dev_name, struct path *path,
|
2008-04-23 12:10:25 -06:00
|
|
|
char *type, unsigned long flags, void *data);
|
2008-03-22 15:48:24 -06:00
|
|
|
int security_sb_check_sb(struct vfsmount *mnt, struct path *path);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_sb_umount(struct vfsmount *mnt, int flags);
|
|
|
|
void security_sb_umount_close(struct vfsmount *mnt);
|
|
|
|
void security_sb_umount_busy(struct vfsmount *mnt);
|
|
|
|
void security_sb_post_remount(struct vfsmount *mnt, unsigned long flags, void *data);
|
2008-03-22 15:48:24 -06:00
|
|
|
void security_sb_post_addmount(struct vfsmount *mnt, struct path *mountpoint);
|
|
|
|
int security_sb_pivotroot(struct path *old_path, struct path *new_path);
|
|
|
|
void security_sb_post_pivotroot(struct path *old_path, struct path *new_path);
|
2008-03-05 08:31:54 -07:00
|
|
|
int security_sb_set_mnt_opts(struct super_block *sb, struct security_mnt_opts *opts);
|
2007-11-30 11:00:35 -07:00
|
|
|
void security_sb_clone_mnt_opts(const struct super_block *oldsb,
|
|
|
|
struct super_block *newsb);
|
2008-03-05 08:31:54 -07:00
|
|
|
int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts);
|
2007-11-30 11:00:35 -07:00
|
|
|
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_inode_alloc(struct inode *inode);
|
|
|
|
void security_inode_free(struct inode *inode);
|
|
|
|
int security_inode_init_security(struct inode *inode, struct inode *dir,
|
|
|
|
char **name, void **value, size_t *len);
|
|
|
|
int security_inode_create(struct inode *dir, struct dentry *dentry, int mode);
|
|
|
|
int security_inode_link(struct dentry *old_dentry, struct inode *dir,
|
|
|
|
struct dentry *new_dentry);
|
|
|
|
int security_inode_unlink(struct inode *dir, struct dentry *dentry);
|
|
|
|
int security_inode_symlink(struct inode *dir, struct dentry *dentry,
|
2008-04-23 12:10:25 -06:00
|
|
|
const char *old_name);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_inode_mkdir(struct inode *dir, struct dentry *dentry, int mode);
|
|
|
|
int security_inode_rmdir(struct inode *dir, struct dentry *dentry);
|
|
|
|
int security_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev);
|
|
|
|
int security_inode_rename(struct inode *old_dir, struct dentry *old_dentry,
|
2008-04-23 12:10:25 -06:00
|
|
|
struct inode *new_dir, struct dentry *new_dentry);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_inode_readlink(struct dentry *dentry);
|
|
|
|
int security_inode_follow_link(struct dentry *dentry, struct nameidata *nd);
|
2008-07-17 07:37:02 -06:00
|
|
|
int security_inode_permission(struct inode *inode, int mask);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_inode_setattr(struct dentry *dentry, struct iattr *attr);
|
|
|
|
int security_inode_getattr(struct vfsmount *mnt, struct dentry *dentry);
|
|
|
|
void security_inode_delete(struct inode *inode);
|
2008-04-29 01:59:41 -06:00
|
|
|
int security_inode_setxattr(struct dentry *dentry, const char *name,
|
|
|
|
const void *value, size_t size, int flags);
|
|
|
|
void security_inode_post_setxattr(struct dentry *dentry, const char *name,
|
|
|
|
const void *value, size_t size, int flags);
|
|
|
|
int security_inode_getxattr(struct dentry *dentry, const char *name);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_inode_listxattr(struct dentry *dentry);
|
2008-04-29 01:59:41 -06:00
|
|
|
int security_inode_removexattr(struct dentry *dentry, const char *name);
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 00:31:36 -06:00
|
|
|
int security_inode_need_killpriv(struct dentry *dentry);
|
|
|
|
int security_inode_killpriv(struct dentry *dentry);
|
2008-02-04 23:29:39 -07:00
|
|
|
int security_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags);
|
|
|
|
int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size);
|
2008-03-01 12:51:09 -07:00
|
|
|
void security_inode_getsecid(const struct inode *inode, u32 *secid);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_file_permission(struct file *file, int mask);
|
|
|
|
int security_file_alloc(struct file *file);
|
|
|
|
void security_file_free(struct file *file);
|
|
|
|
int security_file_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
|
|
|
|
int security_file_mmap(struct file *file, unsigned long reqprot,
|
|
|
|
unsigned long prot, unsigned long flags,
|
|
|
|
unsigned long addr, unsigned long addr_only);
|
|
|
|
int security_file_mprotect(struct vm_area_struct *vma, unsigned long reqprot,
|
2008-04-23 12:10:25 -06:00
|
|
|
unsigned long prot);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_file_lock(struct file *file, unsigned int cmd);
|
|
|
|
int security_file_fcntl(struct file *file, unsigned int cmd, unsigned long arg);
|
|
|
|
int security_file_set_fowner(struct file *file);
|
|
|
|
int security_file_send_sigiotask(struct task_struct *tsk,
|
2008-04-23 12:10:25 -06:00
|
|
|
struct fown_struct *fown, int sig);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_file_receive(struct file *file);
|
|
|
|
int security_dentry_open(struct file *file);
|
|
|
|
int security_task_create(unsigned long clone_flags);
|
|
|
|
int security_task_alloc(struct task_struct *p);
|
|
|
|
void security_task_free(struct task_struct *p);
|
|
|
|
int security_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags);
|
|
|
|
int security_task_post_setuid(uid_t old_ruid, uid_t old_euid,
|
2008-04-23 12:10:25 -06:00
|
|
|
uid_t old_suid, int flags);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags);
|
|
|
|
int security_task_setpgid(struct task_struct *p, pid_t pgid);
|
|
|
|
int security_task_getpgid(struct task_struct *p);
|
|
|
|
int security_task_getsid(struct task_struct *p);
|
|
|
|
void security_task_getsecid(struct task_struct *p, u32 *secid);
|
|
|
|
int security_task_setgroups(struct group_info *group_info);
|
|
|
|
int security_task_setnice(struct task_struct *p, int nice);
|
|
|
|
int security_task_setioprio(struct task_struct *p, int ioprio);
|
|
|
|
int security_task_getioprio(struct task_struct *p);
|
|
|
|
int security_task_setrlimit(unsigned int resource, struct rlimit *new_rlim);
|
|
|
|
int security_task_setscheduler(struct task_struct *p,
|
|
|
|
int policy, struct sched_param *lp);
|
|
|
|
int security_task_getscheduler(struct task_struct *p);
|
|
|
|
int security_task_movememory(struct task_struct *p);
|
|
|
|
int security_task_kill(struct task_struct *p, struct siginfo *info,
|
|
|
|
int sig, u32 secid);
|
|
|
|
int security_task_wait(struct task_struct *p);
|
|
|
|
int security_task_prctl(int option, unsigned long arg2, unsigned long arg3,
|
capabilities: implement per-process securebits
Filesystem capability support makes it possible to do away with (set)uid-0
based privilege and use capabilities instead. That is, with filesystem
support for capabilities but without this present patch, it is (conceptually)
possible to manage a system with capabilities alone and never need to obtain
privilege via (set)uid-0.
Of course, conceptually isn't quite the same as currently possible since few
user applications, certainly not enough to run a viable system, are currently
prepared to leverage capabilities to exercise privilege. Further, many
applications exist that may never get upgraded in this way, and the kernel
will continue to want to support their setuid-0 base privilege needs.
Where pure-capability applications evolve and replace setuid-0 binaries, it is
desirable that there be a mechanisms by which they can contain their
privilege. In addition to leveraging the per-process bounding and inheritable
sets, this should include suppressing the privilege of the uid-0 superuser
from the process' tree of children.
The feature added by this patch can be leveraged to suppress the privilege
associated with (set)uid-0. This suppression requires CAP_SETPCAP to
initiate, and only immediately affects the 'current' process (it is inherited
through fork()/exec()). This reimplementation differs significantly from the
historical support for securebits which was system-wide, unwieldy and which
has ultimately withered to a dead relic in the source of the modern kernel.
With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
all legacy privilege (through uid=0) for itself and all subsequently
fork()'d/exec()'d children with:
prctl(PR_SET_SECUREBITS, 0x2f);
This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
enabled at configure time.
[akpm@linux-foundation.org: fix uninitialised var warning]
[serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Reviewed-by: James Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 03:13:40 -06:00
|
|
|
unsigned long arg4, unsigned long arg5, long *rc_p);
|
2007-10-17 00:31:32 -06:00
|
|
|
void security_task_reparent_to_init(struct task_struct *p);
|
|
|
|
void security_task_to_inode(struct task_struct *p, struct inode *inode);
|
|
|
|
int security_ipc_permission(struct kern_ipc_perm *ipcp, short flag);
|
2008-03-01 12:51:09 -07:00
|
|
|
void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_msg_msg_alloc(struct msg_msg *msg);
|
|
|
|
void security_msg_msg_free(struct msg_msg *msg);
|
|
|
|
int security_msg_queue_alloc(struct msg_queue *msq);
|
|
|
|
void security_msg_queue_free(struct msg_queue *msq);
|
|
|
|
int security_msg_queue_associate(struct msg_queue *msq, int msqflg);
|
|
|
|
int security_msg_queue_msgctl(struct msg_queue *msq, int cmd);
|
|
|
|
int security_msg_queue_msgsnd(struct msg_queue *msq,
|
2008-04-23 12:10:25 -06:00
|
|
|
struct msg_msg *msg, int msqflg);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
|
2008-04-23 12:10:25 -06:00
|
|
|
struct task_struct *target, long type, int mode);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_shm_alloc(struct shmid_kernel *shp);
|
|
|
|
void security_shm_free(struct shmid_kernel *shp);
|
|
|
|
int security_shm_associate(struct shmid_kernel *shp, int shmflg);
|
|
|
|
int security_shm_shmctl(struct shmid_kernel *shp, int cmd);
|
|
|
|
int security_shm_shmat(struct shmid_kernel *shp, char __user *shmaddr, int shmflg);
|
|
|
|
int security_sem_alloc(struct sem_array *sma);
|
|
|
|
void security_sem_free(struct sem_array *sma);
|
|
|
|
int security_sem_associate(struct sem_array *sma, int semflg);
|
|
|
|
int security_sem_semctl(struct sem_array *sma, int cmd);
|
|
|
|
int security_sem_semop(struct sem_array *sma, struct sembuf *sops,
|
|
|
|
unsigned nsops, int alter);
|
2008-04-23 12:10:25 -06:00
|
|
|
void security_d_instantiate(struct dentry *dentry, struct inode *inode);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_getprocattr(struct task_struct *p, char *name, char **value);
|
|
|
|
int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size);
|
|
|
|
int security_netlink_send(struct sock *sk, struct sk_buff *skb);
|
|
|
|
int security_netlink_recv(struct sk_buff *skb, int cap);
|
|
|
|
int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
|
2008-04-29 13:52:51 -06:00
|
|
|
int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
|
2007-10-17 00:31:32 -06:00
|
|
|
void security_release_secctx(char *secdata, u32 seclen);
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
#else /* CONFIG_SECURITY */
|
2008-03-05 08:31:54 -07:00
|
|
|
struct security_mnt_opts {
|
|
|
|
};
|
|
|
|
|
|
|
|
static inline void security_init_mnt_opts(struct security_mnt_opts *opts)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
|
|
|
|
{
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
|
|
|
|
/*
|
|
|
|
* This is the default capabilities functionality. Most of these functions
|
|
|
|
* are just stubbed out, but a few must call the proper capable code.
|
|
|
|
*/
|
|
|
|
|
|
|
|
static inline int security_init(void)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
security: Fix setting of PF_SUPERPRIV by __capable()
Fix the setting of PF_SUPERPRIV by __capable() as it could corrupt the flags
the target process if that is not the current process and it is trying to
change its own flags in a different way at the same time.
__capable() is using neither atomic ops nor locking to protect t->flags. This
patch removes __capable() and introduces has_capability() that doesn't set
PF_SUPERPRIV on the process being queried.
This patch further splits security_ptrace() in two:
(1) security_ptrace_may_access(). This passes judgement on whether one
process may access another only (PTRACE_MODE_ATTACH for ptrace() and
PTRACE_MODE_READ for /proc), and takes a pointer to the child process.
current is the parent.
(2) security_ptrace_traceme(). This passes judgement on PTRACE_TRACEME only,
and takes only a pointer to the parent process. current is the child.
In Smack and commoncap, this uses has_capability() to determine whether
the parent will be permitted to use PTRACE_ATTACH if normal checks fail.
This does not set PF_SUPERPRIV.
Two of the instances of __capable() actually only act on current, and so have
been changed to calls to capable().
Of the places that were using __capable():
(1) The OOM killer calls __capable() thrice when weighing the killability of a
process. All of these now use has_capability().
(2) cap_ptrace() and smack_ptrace() were using __capable() to check to see
whether the parent was allowed to trace any process. As mentioned above,
these have been split. For PTRACE_ATTACH and /proc, capable() is now
used, and for PTRACE_TRACEME, has_capability() is used.
(3) cap_safe_nice() only ever saw current, so now uses capable().
(4) smack_setprocattr() rejected accesses to tasks other than current just
after calling __capable(), so the order of these two tests have been
switched and capable() is used instead.
(5) In smack_file_send_sigiotask(), we need to allow privileged processes to
receive SIGIO on files they're manipulating.
(6) In smack_task_wait(), we let a process wait for a privileged process,
whether or not the process doing the waiting is privileged.
I've tested this with the LTP SELinux and syscalls testscripts.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Morris <jmorris@namei.org>
2008-08-14 04:37:28 -06:00
|
|
|
static inline int security_ptrace_may_access(struct task_struct *child,
|
|
|
|
unsigned int mode)
|
|
|
|
{
|
|
|
|
return cap_ptrace_may_access(child, mode);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_ptrace_traceme(struct task_struct *child)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
security: Fix setting of PF_SUPERPRIV by __capable()
Fix the setting of PF_SUPERPRIV by __capable() as it could corrupt the flags
the target process if that is not the current process and it is trying to
change its own flags in a different way at the same time.
__capable() is using neither atomic ops nor locking to protect t->flags. This
patch removes __capable() and introduces has_capability() that doesn't set
PF_SUPERPRIV on the process being queried.
This patch further splits security_ptrace() in two:
(1) security_ptrace_may_access(). This passes judgement on whether one
process may access another only (PTRACE_MODE_ATTACH for ptrace() and
PTRACE_MODE_READ for /proc), and takes a pointer to the child process.
current is the parent.
(2) security_ptrace_traceme(). This passes judgement on PTRACE_TRACEME only,
and takes only a pointer to the parent process. current is the child.
In Smack and commoncap, this uses has_capability() to determine whether
the parent will be permitted to use PTRACE_ATTACH if normal checks fail.
This does not set PF_SUPERPRIV.
Two of the instances of __capable() actually only act on current, and so have
been changed to calls to capable().
Of the places that were using __capable():
(1) The OOM killer calls __capable() thrice when weighing the killability of a
process. All of these now use has_capability().
(2) cap_ptrace() and smack_ptrace() were using __capable() to check to see
whether the parent was allowed to trace any process. As mentioned above,
these have been split. For PTRACE_ATTACH and /proc, capable() is now
used, and for PTRACE_TRACEME, has_capability() is used.
(3) cap_safe_nice() only ever saw current, so now uses capable().
(4) smack_setprocattr() rejected accesses to tasks other than current just
after calling __capable(), so the order of these two tests have been
switched and capable() is used instead.
(5) In smack_file_send_sigiotask(), we need to allow privileged processes to
receive SIGIO on files they're manipulating.
(6) In smack_task_wait(), we let a process wait for a privileged process,
whether or not the process doing the waiting is privileged.
I've tested this with the LTP SELinux and syscalls testscripts.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Morris <jmorris@namei.org>
2008-08-14 04:37:28 -06:00
|
|
|
return cap_ptrace_traceme(parent);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_capget(struct task_struct *target,
|
2005-04-16 16:20:36 -06:00
|
|
|
kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable,
|
|
|
|
kernel_cap_t *permitted)
|
|
|
|
{
|
2008-04-23 12:10:25 -06:00
|
|
|
return cap_capget(target, effective, inheritable, permitted);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_capset_check(struct task_struct *target,
|
2005-04-16 16:20:36 -06:00
|
|
|
kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable,
|
|
|
|
kernel_cap_t *permitted)
|
|
|
|
{
|
2008-04-23 12:10:25 -06:00
|
|
|
return cap_capset_check(target, effective, inheritable, permitted);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_capset_set(struct task_struct *target,
|
2005-04-16 16:20:36 -06:00
|
|
|
kernel_cap_t *effective,
|
|
|
|
kernel_cap_t *inheritable,
|
|
|
|
kernel_cap_t *permitted)
|
|
|
|
{
|
2008-04-23 12:10:25 -06:00
|
|
|
cap_capset_set(target, effective, inheritable, permitted);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2006-03-25 04:07:41 -07:00
|
|
|
static inline int security_capable(struct task_struct *tsk, int cap)
|
|
|
|
{
|
|
|
|
return cap_capable(tsk, cap);
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_acct(struct file *file)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_sysctl(struct ctl_table *table, int op)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_quotactl(int cmds, int type, int id,
|
|
|
|
struct super_block *sb)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_quota_on(struct dentry *dentry)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_syslog(int type)
|
|
|
|
{
|
|
|
|
return cap_syslog(type);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_settime(struct timespec *ts, struct timezone *tz)
|
|
|
|
{
|
|
|
|
return cap_settime(ts, tz);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_vm_enough_memory(long pages)
|
|
|
|
{
|
2007-08-22 15:01:28 -06:00
|
|
|
return cap_vm_enough_memory(current->mm, pages);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_vm_enough_memory_mm(struct mm_struct *mm, long pages)
|
|
|
|
{
|
|
|
|
return cap_vm_enough_memory(mm, pages);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_bprm_alloc(struct linux_binprm *bprm)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_bprm_free(struct linux_binprm *bprm)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
|
|
|
|
{
|
|
|
|
cap_bprm_apply_creds(bprm, unsafe);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_bprm_post_apply_creds(struct linux_binprm *bprm)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_bprm_set(struct linux_binprm *bprm)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-04-23 12:10:25 -06:00
|
|
|
return cap_bprm_set_security(bprm);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_bprm_check(struct linux_binprm *bprm)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_bprm_secureexec(struct linux_binprm *bprm)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return cap_bprm_secureexec(bprm);
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sb_alloc(struct super_block *sb)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_sb_free(struct super_block *sb)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sb_copy_data(char *orig, char *copy)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sb_kern_mount(struct super_block *sb, void *data)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-07-03 17:47:13 -06:00
|
|
|
static inline int security_sb_show_options(struct seq_file *m,
|
|
|
|
struct super_block *sb)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sb_statfs(struct dentry *dentry)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sb_mount(char *dev_name, struct path *path,
|
2005-04-16 16:20:36 -06:00
|
|
|
char *type, unsigned long flags,
|
|
|
|
void *data)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sb_check_sb(struct vfsmount *mnt,
|
|
|
|
struct path *path)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sb_umount(struct vfsmount *mnt, int flags)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_sb_umount_close(struct vfsmount *mnt)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_sb_umount_busy(struct vfsmount *mnt)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_sb_post_remount(struct vfsmount *mnt,
|
2005-04-16 16:20:36 -06:00
|
|
|
unsigned long flags, void *data)
|
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_sb_post_addmount(struct vfsmount *mnt,
|
|
|
|
struct path *mountpoint)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sb_pivotroot(struct path *old_path,
|
|
|
|
struct path *new_path)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_sb_post_pivotroot(struct path *old_path,
|
|
|
|
struct path *new_path)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
2008-03-05 08:31:54 -07:00
|
|
|
|
|
|
|
static inline int security_sb_set_mnt_opts(struct super_block *sb,
|
|
|
|
struct security_mnt_opts *opts)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void security_sb_clone_mnt_opts(const struct super_block *oldsb,
|
|
|
|
struct super_block *newsb)
|
|
|
|
{ }
|
|
|
|
|
|
|
|
static inline int security_sb_parse_opts_str(char *options, struct security_mnt_opts *opts)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_alloc(struct inode *inode)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_inode_free(struct inode *inode)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
2005-09-09 14:01:35 -06:00
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_init_security(struct inode *inode,
|
2005-09-09 14:01:35 -06:00
|
|
|
struct inode *dir,
|
|
|
|
char **name,
|
|
|
|
void **value,
|
|
|
|
size_t *len)
|
|
|
|
{
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
}
|
2008-04-23 12:10:25 -06:00
|
|
|
|
|
|
|
static inline int security_inode_create(struct inode *dir,
|
2005-04-16 16:20:36 -06:00
|
|
|
struct dentry *dentry,
|
|
|
|
int mode)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_link(struct dentry *old_dentry,
|
2005-04-16 16:20:36 -06:00
|
|
|
struct inode *dir,
|
|
|
|
struct dentry *new_dentry)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_unlink(struct inode *dir,
|
2005-04-16 16:20:36 -06:00
|
|
|
struct dentry *dentry)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_symlink(struct inode *dir,
|
2005-04-16 16:20:36 -06:00
|
|
|
struct dentry *dentry,
|
|
|
|
const char *old_name)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_mkdir(struct inode *dir,
|
2005-04-16 16:20:36 -06:00
|
|
|
struct dentry *dentry,
|
|
|
|
int mode)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_rmdir(struct inode *dir,
|
2005-04-16 16:20:36 -06:00
|
|
|
struct dentry *dentry)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_mknod(struct inode *dir,
|
2005-04-16 16:20:36 -06:00
|
|
|
struct dentry *dentry,
|
|
|
|
int mode, dev_t dev)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_rename(struct inode *old_dir,
|
2005-04-16 16:20:36 -06:00
|
|
|
struct dentry *old_dentry,
|
|
|
|
struct inode *new_dir,
|
|
|
|
struct dentry *new_dentry)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_readlink(struct dentry *dentry)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_follow_link(struct dentry *dentry,
|
2005-04-16 16:20:36 -06:00
|
|
|
struct nameidata *nd)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-07-17 07:37:02 -06:00
|
|
|
static inline int security_inode_permission(struct inode *inode, int mask)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_setattr(struct dentry *dentry,
|
2005-04-16 16:20:36 -06:00
|
|
|
struct iattr *attr)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_getattr(struct vfsmount *mnt,
|
2005-04-16 16:20:36 -06:00
|
|
|
struct dentry *dentry)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_inode_delete(struct inode *inode)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-29 01:59:41 -06:00
|
|
|
static inline int security_inode_setxattr(struct dentry *dentry,
|
|
|
|
const char *name, const void *value, size_t size, int flags)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return cap_inode_setxattr(dentry, name, value, size, flags);
|
|
|
|
}
|
|
|
|
|
2008-04-29 01:59:41 -06:00
|
|
|
static inline void security_inode_post_setxattr(struct dentry *dentry,
|
|
|
|
const char *name, const void *value, size_t size, int flags)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-29 01:59:41 -06:00
|
|
|
static inline int security_inode_getxattr(struct dentry *dentry,
|
|
|
|
const char *name)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_inode_listxattr(struct dentry *dentry)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-29 01:59:41 -06:00
|
|
|
static inline int security_inode_removexattr(struct dentry *dentry,
|
|
|
|
const char *name)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return cap_inode_removexattr(dentry, name);
|
|
|
|
}
|
|
|
|
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 00:31:36 -06:00
|
|
|
static inline int security_inode_need_killpriv(struct dentry *dentry)
|
|
|
|
{
|
|
|
|
return cap_inode_need_killpriv(dentry);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_inode_killpriv(struct dentry *dentry)
|
|
|
|
{
|
|
|
|
return cap_inode_killpriv(dentry);
|
|
|
|
}
|
|
|
|
|
2008-02-04 23:29:39 -07:00
|
|
|
static inline int security_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_inode_setsecurity(struct inode *inode, const char *name, const void *value, size_t size, int flags)
|
|
|
|
{
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-03-01 12:51:09 -07:00
|
|
|
static inline void security_inode_getsecid(const struct inode *inode, u32 *secid)
|
|
|
|
{
|
|
|
|
*secid = 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_file_permission(struct file *file, int mask)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_file_alloc(struct file *file)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_file_free(struct file *file)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_file_ioctl(struct file *file, unsigned int cmd,
|
|
|
|
unsigned long arg)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_file_mmap(struct file *file, unsigned long reqprot,
|
|
|
|
unsigned long prot,
|
|
|
|
unsigned long flags,
|
|
|
|
unsigned long addr,
|
|
|
|
unsigned long addr_only)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_file_mprotect(struct vm_area_struct *vma,
|
|
|
|
unsigned long reqprot,
|
|
|
|
unsigned long prot)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_file_lock(struct file *file, unsigned int cmd)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_file_fcntl(struct file *file, unsigned int cmd,
|
|
|
|
unsigned long arg)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_file_set_fowner(struct file *file)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_file_send_sigiotask(struct task_struct *tsk,
|
|
|
|
struct fown_struct *fown,
|
|
|
|
int sig)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_file_receive(struct file *file)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_dentry_open(struct file *file)
|
2007-09-13 18:27:07 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_create(unsigned long clone_flags)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_alloc(struct task_struct *p)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_task_free(struct task_struct *p)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_setuid(uid_t id0, uid_t id1, uid_t id2,
|
|
|
|
int flags)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_post_setuid(uid_t old_ruid, uid_t old_euid,
|
|
|
|
uid_t old_suid, int flags)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-04-23 12:10:25 -06:00
|
|
|
return cap_task_post_setuid(old_ruid, old_euid, old_suid, flags);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_setgid(gid_t id0, gid_t id1, gid_t id2,
|
|
|
|
int flags)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_setpgid(struct task_struct *p, pid_t pgid)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_getpgid(struct task_struct *p)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_getsid(struct task_struct *p)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_task_getsecid(struct task_struct *p, u32 *secid)
|
2008-03-01 12:51:09 -07:00
|
|
|
{
|
|
|
|
*secid = 0;
|
|
|
|
}
|
2006-06-30 02:55:46 -06:00
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_setgroups(struct group_info *group_info)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_setnice(struct task_struct *p, int nice)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 00:31:36 -06:00
|
|
|
return cap_task_setnice(p, nice);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_setioprio(struct task_struct *p, int ioprio)
|
2006-06-23 03:03:58 -06:00
|
|
|
{
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 00:31:36 -06:00
|
|
|
return cap_task_setioprio(p, ioprio);
|
2006-06-23 03:03:58 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_getioprio(struct task_struct *p)
|
2006-06-30 02:55:49 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_setrlimit(unsigned int resource,
|
|
|
|
struct rlimit *new_rlim)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_setscheduler(struct task_struct *p,
|
|
|
|
int policy,
|
|
|
|
struct sched_param *lp)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 00:31:36 -06:00
|
|
|
return cap_task_setscheduler(p, policy, lp);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_getscheduler(struct task_struct *p)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_movememory(struct task_struct *p)
|
2006-06-23 03:04:01 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_kill(struct task_struct *p,
|
|
|
|
struct siginfo *info, int sig,
|
|
|
|
u32 secid)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-02-29 08:14:57 -07:00
|
|
|
return 0;
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_wait(struct task_struct *p)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_task_prctl(int option, unsigned long arg2,
|
|
|
|
unsigned long arg3,
|
|
|
|
unsigned long arg4,
|
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6:
SELinux: Fix a RCU free problem with the netport cache
SELinux: Made netnode cache adds faster
SELinux: include/security.h whitespace, syntax, and other cleanups
SELinux: policydb.h whitespace, syntax, and other cleanups
SELinux: mls_types.h whitespace, syntax, and other cleanups
SELinux: mls.h whitespace, syntax, and other cleanups
SELinux: hashtab.h whitespace, syntax, and other cleanups
SELinux: context.h whitespace, syntax, and other cleanups
SELinux: ss/conditional.h whitespace, syntax, and other cleanups
SELinux: selinux/include/security.h whitespace, syntax, and other cleanups
SELinux: objsec.h whitespace, syntax, and other cleanups
SELinux: netlabel.h whitespace, syntax, and other cleanups
SELinux: avc_ss.h whitespace, syntax, and other cleanups
Fixed up conflict in include/linux/security.h manually
2008-04-28 11:08:49 -06:00
|
|
|
unsigned long arg5, long *rc_p)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
capabilities: implement per-process securebits
Filesystem capability support makes it possible to do away with (set)uid-0
based privilege and use capabilities instead. That is, with filesystem
support for capabilities but without this present patch, it is (conceptually)
possible to manage a system with capabilities alone and never need to obtain
privilege via (set)uid-0.
Of course, conceptually isn't quite the same as currently possible since few
user applications, certainly not enough to run a viable system, are currently
prepared to leverage capabilities to exercise privilege. Further, many
applications exist that may never get upgraded in this way, and the kernel
will continue to want to support their setuid-0 base privilege needs.
Where pure-capability applications evolve and replace setuid-0 binaries, it is
desirable that there be a mechanisms by which they can contain their
privilege. In addition to leveraging the per-process bounding and inheritable
sets, this should include suppressing the privilege of the uid-0 superuser
from the process' tree of children.
The feature added by this patch can be leveraged to suppress the privilege
associated with (set)uid-0. This suppression requires CAP_SETPCAP to
initiate, and only immediately affects the 'current' process (it is inherited
through fork()/exec()). This reimplementation differs significantly from the
historical support for securebits which was system-wide, unwieldy and which
has ultimately withered to a dead relic in the source of the modern kernel.
With this patch applied a process, that is capable(CAP_SETPCAP), can now drop
all legacy privilege (through uid=0) for itself and all subsequently
fork()'d/exec()'d children with:
prctl(PR_SET_SECUREBITS, 0x2f);
This patch represents a no-op unless CONFIG_SECURITY_FILE_CAPABILITIES is
enabled at configure time.
[akpm@linux-foundation.org: fix uninitialised var warning]
[serue@us.ibm.com: capabilities: use cap_task_prctl when !CONFIG_SECURITY]
Signed-off-by: Andrew G. Morgan <morgan@kernel.org>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Reviewed-by: James Morris <jmorris@namei.org>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Paul Moore <paul.moore@hp.com>
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2008-04-28 03:13:40 -06:00
|
|
|
return cap_task_prctl(option, arg2, arg3, arg3, arg5, rc_p);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_task_reparent_to_init(struct task_struct *p)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-04-23 12:10:25 -06:00
|
|
|
cap_task_reparent_to_init(p);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
|
|
|
static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
|
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_ipc_permission(struct kern_ipc_perm *ipcp,
|
|
|
|
short flag)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-03-01 12:51:09 -07:00
|
|
|
static inline void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
|
|
|
|
{
|
|
|
|
*secid = 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_msg_msg_alloc(struct msg_msg *msg)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_msg_msg_free(struct msg_msg *msg)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_msg_queue_alloc(struct msg_queue *msq)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_msg_queue_free(struct msg_queue *msq)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_msg_queue_associate(struct msg_queue *msq,
|
|
|
|
int msqflg)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_msg_queue_msgctl(struct msg_queue *msq, int cmd)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_msg_queue_msgsnd(struct msg_queue *msq,
|
|
|
|
struct msg_msg *msg, int msqflg)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_msg_queue_msgrcv(struct msg_queue *msq,
|
|
|
|
struct msg_msg *msg,
|
|
|
|
struct task_struct *target,
|
|
|
|
long type, int mode)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_shm_alloc(struct shmid_kernel *shp)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_shm_free(struct shmid_kernel *shp)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_shm_associate(struct shmid_kernel *shp,
|
|
|
|
int shmflg)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_shm_shmctl(struct shmid_kernel *shp, int cmd)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_shm_shmat(struct shmid_kernel *shp,
|
|
|
|
char __user *shmaddr, int shmflg)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sem_alloc(struct sem_array *sma)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_sem_free(struct sem_array *sma)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sem_associate(struct sem_array *sma, int semflg)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sem_semctl(struct sem_array *sma, int cmd)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sem_semop(struct sem_array *sma,
|
|
|
|
struct sembuf *sops, unsigned nsops,
|
|
|
|
int alter)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_d_instantiate(struct dentry *dentry, struct inode *inode)
|
2005-04-16 16:20:36 -06:00
|
|
|
{ }
|
|
|
|
|
2007-03-12 10:17:58 -06:00
|
|
|
static inline int security_getprocattr(struct task_struct *p, char *name, char **value)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size)
|
|
|
|
{
|
|
|
|
return -EINVAL;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-04-23 12:10:25 -06:00
|
|
|
return cap_netlink_send(sk, skb);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_netlink_recv(struct sk_buff *skb, int cap)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2008-04-23 12:10:25 -06:00
|
|
|
return cap_netlink_recv(skb, cap);
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2006-02-01 04:05:00 -07:00
|
|
|
static inline struct dentry *securityfs_create_dir(const char *name,
|
|
|
|
struct dentry *parent)
|
|
|
|
{
|
|
|
|
return ERR_PTR(-ENODEV);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline struct dentry *securityfs_create_file(const char *name,
|
|
|
|
mode_t mode,
|
|
|
|
struct dentry *parent,
|
|
|
|
void *data,
|
2008-01-22 16:02:58 -07:00
|
|
|
const struct file_operations *fops)
|
2006-02-01 04:05:00 -07:00
|
|
|
{
|
|
|
|
return ERR_PTR(-ENODEV);
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void securityfs_remove(struct dentry *dentry)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
2006-08-02 15:12:06 -06:00
|
|
|
static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
|
|
|
|
{
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
}
|
|
|
|
|
2008-04-29 13:52:51 -06:00
|
|
|
static inline int security_secctx_to_secid(const char *secdata,
|
2008-01-15 16:47:35 -07:00
|
|
|
u32 seclen,
|
|
|
|
u32 *secid)
|
|
|
|
{
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
}
|
|
|
|
|
2006-08-02 15:12:06 -06:00
|
|
|
static inline void security_release_secctx(char *secdata, u32 seclen)
|
|
|
|
{
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
#endif /* CONFIG_SECURITY */
|
|
|
|
|
|
|
|
#ifdef CONFIG_SECURITY_NETWORK
|
2006-07-25 00:32:50 -06:00
|
|
|
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_unix_stream_connect(struct socket *sock, struct socket *other,
|
|
|
|
struct sock *newsk);
|
|
|
|
int security_unix_may_send(struct socket *sock, struct socket *other);
|
|
|
|
int security_socket_create(int family, int type, int protocol, int kern);
|
|
|
|
int security_socket_post_create(struct socket *sock, int family,
|
|
|
|
int type, int protocol, int kern);
|
|
|
|
int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen);
|
|
|
|
int security_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen);
|
|
|
|
int security_socket_listen(struct socket *sock, int backlog);
|
|
|
|
int security_socket_accept(struct socket *sock, struct socket *newsock);
|
|
|
|
void security_socket_post_accept(struct socket *sock, struct socket *newsock);
|
|
|
|
int security_socket_sendmsg(struct socket *sock, struct msghdr *msg, int size);
|
|
|
|
int security_socket_recvmsg(struct socket *sock, struct msghdr *msg,
|
|
|
|
int size, int flags);
|
|
|
|
int security_socket_getsockname(struct socket *sock);
|
|
|
|
int security_socket_getpeername(struct socket *sock);
|
|
|
|
int security_socket_getsockopt(struct socket *sock, int level, int optname);
|
|
|
|
int security_socket_setsockopt(struct socket *sock, int level, int optname);
|
|
|
|
int security_socket_shutdown(struct socket *sock, int how);
|
|
|
|
int security_sock_rcv_skb(struct sock *sk, struct sk_buff *skb);
|
|
|
|
int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
|
|
|
|
int __user *optlen, unsigned len);
|
|
|
|
int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid);
|
|
|
|
int security_sk_alloc(struct sock *sk, int family, gfp_t priority);
|
|
|
|
void security_sk_free(struct sock *sk);
|
|
|
|
void security_sk_clone(const struct sock *sk, struct sock *newsk);
|
|
|
|
void security_sk_classify_flow(struct sock *sk, struct flowi *fl);
|
|
|
|
void security_req_classify_flow(const struct request_sock *req, struct flowi *fl);
|
|
|
|
void security_sock_graft(struct sock*sk, struct socket *parent);
|
|
|
|
int security_inet_conn_request(struct sock *sk,
|
|
|
|
struct sk_buff *skb, struct request_sock *req);
|
|
|
|
void security_inet_csk_clone(struct sock *newsk,
|
|
|
|
const struct request_sock *req);
|
|
|
|
void security_inet_conn_established(struct sock *sk,
|
|
|
|
struct sk_buff *skb);
|
2006-11-08 16:04:09 -07:00
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
#else /* CONFIG_SECURITY_NETWORK */
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_unix_stream_connect(struct socket *sock,
|
|
|
|
struct socket *other,
|
|
|
|
struct sock *newsk)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_unix_may_send(struct socket *sock,
|
|
|
|
struct socket *other)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_create(int family, int type,
|
|
|
|
int protocol, int kern)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_post_create(struct socket *sock,
|
2006-08-05 00:17:57 -06:00
|
|
|
int family,
|
|
|
|
int type,
|
|
|
|
int protocol, int kern)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
2006-08-05 00:17:57 -06:00
|
|
|
return 0;
|
2005-04-16 16:20:36 -06:00
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_bind(struct socket *sock,
|
|
|
|
struct sockaddr *address,
|
2005-04-16 16:20:36 -06:00
|
|
|
int addrlen)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_connect(struct socket *sock,
|
|
|
|
struct sockaddr *address,
|
2005-04-16 16:20:36 -06:00
|
|
|
int addrlen)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_listen(struct socket *sock, int backlog)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_accept(struct socket *sock,
|
|
|
|
struct socket *newsock)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_socket_post_accept(struct socket *sock,
|
|
|
|
struct socket *newsock)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_sendmsg(struct socket *sock,
|
|
|
|
struct msghdr *msg, int size)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_recvmsg(struct socket *sock,
|
|
|
|
struct msghdr *msg, int size,
|
2005-04-16 16:20:36 -06:00
|
|
|
int flags)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_getsockname(struct socket *sock)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_getpeername(struct socket *sock)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_getsockopt(struct socket *sock,
|
2005-04-16 16:20:36 -06:00
|
|
|
int level, int optname)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_setsockopt(struct socket *sock,
|
2005-04-16 16:20:36 -06:00
|
|
|
int level, int optname)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_socket_shutdown(struct socket *sock, int how)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline int security_sock_rcv_skb(struct sock *sk,
|
|
|
|
struct sk_buff *skb)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
[SECURITY]: TCP/UDP getpeersec
This patch implements an application of the LSM-IPSec networking
controls whereby an application can determine the label of the
security association its TCP or UDP sockets are currently connected to
via getsockopt and the auxiliary data mechanism of recvmsg.
Patch purpose:
This patch enables a security-aware application to retrieve the
security context of an IPSec security association a particular TCP or
UDP socket is using. The application can then use this security
context to determine the security context for processing on behalf of
the peer at the other end of this connection. In the case of UDP, the
security context is for each individual packet. An example
application is the inetd daemon, which could be modified to start
daemons running at security contexts dependent on the remote client.
Patch design approach:
- Design for TCP
The patch enables the SELinux LSM to set the peer security context for
a socket based on the security context of the IPSec security
association. The application may retrieve this context using
getsockopt. When called, the kernel determines if the socket is a
connected (TCP_ESTABLISHED) TCP socket and, if so, uses the dst_entry
cache on the socket to retrieve the security associations. If a
security association has a security context, the context string is
returned, as for UNIX domain sockets.
- Design for UDP
Unlike TCP, UDP is connectionless. This requires a somewhat different
API to retrieve the peer security context. With TCP, the peer
security context stays the same throughout the connection, thus it can
be retrieved at any time between when the connection is established
and when it is torn down. With UDP, each read/write can have
different peer and thus the security context might change every time.
As a result the security context retrieval must be done TOGETHER with
the packet retrieval.
The solution is to build upon the existing Unix domain socket API for
retrieving user credentials. Linux offers the API for obtaining user
credentials via ancillary messages (i.e., out of band/control messages
that are bundled together with a normal message).
Patch implementation details:
- Implementation for TCP
The security context can be retrieved by applications using getsockopt
with the existing SO_PEERSEC flag. As an example (ignoring error
checking):
getsockopt(sockfd, SOL_SOCKET, SO_PEERSEC, optbuf, &optlen);
printf("Socket peer context is: %s\n", optbuf);
The SELinux function, selinux_socket_getpeersec, is extended to check
for labeled security associations for connected (TCP_ESTABLISHED ==
sk->sk_state) TCP sockets only. If so, the socket has a dst_cache of
struct dst_entry values that may refer to security associations. If
these have security associations with security contexts, the security
context is returned.
getsockopt returns a buffer that contains a security context string or
the buffer is unmodified.
- Implementation for UDP
To retrieve the security context, the application first indicates to
the kernel such desire by setting the IP_PASSSEC option via
getsockopt. Then the application retrieves the security context using
the auxiliary data mechanism.
An example server application for UDP should look like this:
toggle = 1;
toggle_len = sizeof(toggle);
setsockopt(sockfd, SOL_IP, IP_PASSSEC, &toggle, &toggle_len);
recvmsg(sockfd, &msg_hdr, 0);
if (msg_hdr.msg_controllen > sizeof(struct cmsghdr)) {
cmsg_hdr = CMSG_FIRSTHDR(&msg_hdr);
if (cmsg_hdr->cmsg_len <= CMSG_LEN(sizeof(scontext)) &&
cmsg_hdr->cmsg_level == SOL_IP &&
cmsg_hdr->cmsg_type == SCM_SECURITY) {
memcpy(&scontext, CMSG_DATA(cmsg_hdr), sizeof(scontext));
}
}
ip_setsockopt is enhanced with a new socket option IP_PASSSEC to allow
a server socket to receive security context of the peer. A new
ancillary message type SCM_SECURITY.
When the packet is received we get the security context from the
sec_path pointer which is contained in the sk_buff, and copy it to the
ancillary message space. An additional LSM hook,
selinux_socket_getpeersec_udp, is defined to retrieve the security
context from the SELinux space. The existing function,
selinux_socket_getpeersec does not suit our purpose, because the
security context is copied directly to user space, rather than to
kernel space.
Testing:
We have tested the patch by setting up TCP and UDP connections between
applications on two machines using the IPSec policies that result in
labeled security associations being built. For TCP, we can then
extract the peer security context using getsockopt on either end. For
UDP, the receiving end can retrieve the security context using the
auxiliary data mechanism of recvmsg.
Signed-off-by: Catherine Zhang <cxzhang@watson.ibm.com>
Acked-by: James Morris <jmorris@namei.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-03-20 23:41:23 -07:00
|
|
|
static inline int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
|
|
|
|
int __user *optlen, unsigned len)
|
|
|
|
{
|
|
|
|
return -ENOPROTOOPT;
|
|
|
|
}
|
|
|
|
|
2006-08-02 15:12:06 -06:00
|
|
|
static inline int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return -ENOPROTOOPT;
|
|
|
|
}
|
|
|
|
|
2005-10-07 00:46:04 -06:00
|
|
|
static inline int security_sk_alloc(struct sock *sk, int family, gfp_t priority)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void security_sk_free(struct sock *sk)
|
2006-08-05 00:08:56 -06:00
|
|
|
{
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void security_sk_clone(const struct sock *sk, struct sock *newsk)
|
2005-04-16 16:20:36 -06:00
|
|
|
{
|
|
|
|
}
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
|
2006-08-05 00:12:42 -06:00
|
|
|
static inline void security_sk_classify_flow(struct sock *sk, struct flowi *fl)
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
{
|
|
|
|
}
|
2006-07-25 00:32:50 -06:00
|
|
|
|
|
|
|
static inline void security_req_classify_flow(const struct request_sock *req, struct flowi *fl)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
2008-04-23 12:10:25 -06:00
|
|
|
static inline void security_sock_graft(struct sock *sk, struct socket *parent)
|
2006-07-25 00:32:50 -06:00
|
|
|
{
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_inet_conn_request(struct sock *sk,
|
|
|
|
struct sk_buff *skb, struct request_sock *req)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void security_inet_csk_clone(struct sock *newsk,
|
|
|
|
const struct request_sock *req)
|
|
|
|
{
|
|
|
|
}
|
2006-11-08 16:04:09 -07:00
|
|
|
|
|
|
|
static inline void security_inet_conn_established(struct sock *sk,
|
|
|
|
struct sk_buff *skb)
|
|
|
|
{
|
|
|
|
}
|
2005-04-16 16:20:36 -06:00
|
|
|
#endif /* CONFIG_SECURITY_NETWORK */
|
|
|
|
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
#ifdef CONFIG_SECURITY_NETWORK_XFRM
|
2006-08-05 00:12:42 -06:00
|
|
|
|
2008-04-12 20:07:52 -06:00
|
|
|
int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx);
|
|
|
|
int security_xfrm_policy_clone(struct xfrm_sec_ctx *old_ctx, struct xfrm_sec_ctx **new_ctxp);
|
|
|
|
void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx);
|
|
|
|
int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_xfrm_state_alloc(struct xfrm_state *x, struct xfrm_user_sec_ctx *sec_ctx);
|
|
|
|
int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
|
|
|
|
struct xfrm_sec_ctx *polsec, u32 secid);
|
|
|
|
int security_xfrm_state_delete(struct xfrm_state *x);
|
|
|
|
void security_xfrm_state_free(struct xfrm_state *x);
|
2008-04-12 20:07:52 -06:00
|
|
|
int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir);
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
|
|
|
|
struct xfrm_policy *xp, struct flowi *fl);
|
|
|
|
int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid);
|
|
|
|
void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl);
|
2006-08-05 00:12:42 -06:00
|
|
|
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
#else /* CONFIG_SECURITY_NETWORK_XFRM */
|
2007-10-17 00:31:32 -06:00
|
|
|
|
2008-04-12 20:07:52 -06:00
|
|
|
static inline int security_xfrm_policy_alloc(struct xfrm_sec_ctx **ctxp, struct xfrm_user_sec_ctx *sec_ctx)
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-12 20:07:52 -06:00
|
|
|
static inline int security_xfrm_policy_clone(struct xfrm_sec_ctx *old, struct xfrm_sec_ctx **new_ctxp)
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-12 20:07:52 -06:00
|
|
|
static inline void security_xfrm_policy_free(struct xfrm_sec_ctx *ctx)
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
{
|
|
|
|
}
|
|
|
|
|
2008-04-12 20:07:52 -06:00
|
|
|
static inline int security_xfrm_policy_delete(struct xfrm_sec_ctx *ctx)
|
2006-06-09 00:39:49 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2006-07-25 00:29:07 -06:00
|
|
|
static inline int security_xfrm_state_alloc(struct xfrm_state *x,
|
|
|
|
struct xfrm_user_sec_ctx *sec_ctx)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_xfrm_state_alloc_acquire(struct xfrm_state *x,
|
|
|
|
struct xfrm_sec_ctx *polsec, u32 secid)
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void security_xfrm_state_free(struct xfrm_state *x)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
2006-06-09 00:58:52 -06:00
|
|
|
static inline int security_xfrm_state_delete(struct xfrm_state *x)
|
2006-06-09 00:39:49 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-12 20:07:52 -06:00
|
|
|
static inline int security_xfrm_policy_lookup(struct xfrm_sec_ctx *ctx, u32 fl_secid, u8 dir)
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
2006-07-25 00:29:07 -06:00
|
|
|
|
|
|
|
static inline int security_xfrm_state_pol_flow_match(struct xfrm_state *x,
|
|
|
|
struct xfrm_policy *xp, struct flowi *fl)
|
|
|
|
{
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2006-08-05 00:12:42 -06:00
|
|
|
static inline int security_xfrm_decode_session(struct sk_buff *skb, u32 *secid)
|
2006-07-25 00:29:07 -06:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2006-08-05 00:12:42 -06:00
|
|
|
static inline void security_skb_classify_flow(struct sk_buff *skb, struct flowi *fl)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
[LSM-IPSec]: Security association restriction.
This patch series implements per packet access control via the
extension of the Linux Security Modules (LSM) interface by hooks in
the XFRM and pfkey subsystems that leverage IPSec security
associations to label packets. Extensions to the SELinux LSM are
included that leverage the patch for this purpose.
This patch implements the changes necessary to the XFRM subsystem,
pfkey interface, ipv4/ipv6, and xfrm_user interface to restrict a
socket to use only authorized security associations (or no security
association) to send/receive network packets.
Patch purpose:
The patch is designed to enable access control per packets based on
the strongly authenticated IPSec security association. Such access
controls augment the existing ones based on network interface and IP
address. The former are very coarse-grained, and the latter can be
spoofed. By using IPSec, the system can control access to remote
hosts based on cryptographic keys generated using the IPSec mechanism.
This enables access control on a per-machine basis or per-application
if the remote machine is running the same mechanism and trusted to
enforce the access control policy.
Patch design approach:
The overall approach is that policy (xfrm_policy) entries set by
user-level programs (e.g., setkey for ipsec-tools) are extended with a
security context that is used at policy selection time in the XFRM
subsystem to restrict the sockets that can send/receive packets via
security associations (xfrm_states) that are built from those
policies.
A presentation available at
www.selinux-symposium.org/2005/presentations/session2/2-3-jaeger.pdf
from the SELinux symposium describes the overall approach.
Patch implementation details:
On output, the policy retrieved (via xfrm_policy_lookup or
xfrm_sk_policy_lookup) must be authorized for the security context of
the socket and the same security context is required for resultant
security association (retrieved or negotiated via racoon in
ipsec-tools). This is enforced in xfrm_state_find.
On input, the policy retrieved must also be authorized for the socket
(at __xfrm_policy_check), and the security context of the policy must
also match the security association being used.
The patch has virtually no impact on packets that do not use IPSec.
The existing Netfilter (outgoing) and LSM rcv_skb hooks are used as
before.
Also, if IPSec is used without security contexts, the impact is
minimal. The LSM must allow such policies to be selected for the
combination of socket and remote machine, but subsequent IPSec
processing proceeds as in the original case.
Testing:
The pfkey interface is tested using the ipsec-tools. ipsec-tools have
been modified (a separate ipsec-tools patch is available for version
0.5) that supports assignment of xfrm_policy entries and security
associations with security contexts via setkey and the negotiation
using the security contexts via racoon.
The xfrm_user interface is tested via ad hoc programs that set
security contexts. These programs are also available from me, and
contain programs for setting, getting, and deleting policy for testing
this interface. Testing of sa functions was done by tracing kernel
behavior.
Signed-off-by: Trent Jaeger <tjaeger@cse.psu.edu>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
2005-12-14 00:12:27 -07:00
|
|
|
#endif /* CONFIG_SECURITY_NETWORK_XFRM */
|
|
|
|
|
2005-10-30 16:02:44 -07:00
|
|
|
#ifdef CONFIG_KEYS
|
|
|
|
#ifdef CONFIG_SECURITY
|
|
|
|
|
2007-10-17 00:31:32 -06:00
|
|
|
int security_key_alloc(struct key *key, struct task_struct *tsk, unsigned long flags);
|
|
|
|
void security_key_free(struct key *key);
|
|
|
|
int security_key_permission(key_ref_t key_ref,
|
|
|
|
struct task_struct *context, key_perm_t perm);
|
2008-04-29 02:01:26 -06:00
|
|
|
int security_key_getsecurity(struct key *key, char **_buffer);
|
2005-10-30 16:02:44 -07:00
|
|
|
|
|
|
|
#else
|
|
|
|
|
2006-06-22 15:47:17 -06:00
|
|
|
static inline int security_key_alloc(struct key *key,
|
2006-06-26 01:24:50 -06:00
|
|
|
struct task_struct *tsk,
|
|
|
|
unsigned long flags)
|
2005-10-30 16:02:44 -07:00
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void security_key_free(struct key *key)
|
|
|
|
{
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_key_permission(key_ref_t key_ref,
|
|
|
|
struct task_struct *context,
|
|
|
|
key_perm_t perm)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-04-29 02:01:26 -06:00
|
|
|
static inline int security_key_getsecurity(struct key *key, char **_buffer)
|
|
|
|
{
|
|
|
|
*_buffer = NULL;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2005-10-30 16:02:44 -07:00
|
|
|
#endif
|
|
|
|
#endif /* CONFIG_KEYS */
|
|
|
|
|
2008-03-01 13:00:05 -07:00
|
|
|
#ifdef CONFIG_AUDIT
|
|
|
|
#ifdef CONFIG_SECURITY
|
|
|
|
int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule);
|
|
|
|
int security_audit_rule_known(struct audit_krule *krule);
|
|
|
|
int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule,
|
|
|
|
struct audit_context *actx);
|
|
|
|
void security_audit_rule_free(void *lsmrule);
|
|
|
|
|
|
|
|
#else
|
|
|
|
|
|
|
|
static inline int security_audit_rule_init(u32 field, u32 op, char *rulestr,
|
|
|
|
void **lsmrule)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_audit_rule_known(struct audit_krule *krule)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,
|
|
|
|
void *lsmrule, struct audit_context *actx)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static inline void security_audit_rule_free(void *lsmrule)
|
|
|
|
{ }
|
|
|
|
|
|
|
|
#endif /* CONFIG_SECURITY */
|
|
|
|
#endif /* CONFIG_AUDIT */
|
|
|
|
|
2005-04-16 16:20:36 -06:00
|
|
|
#endif /* ! __LINUX_SECURITY_H */
|
|
|
|
|