Skip to content

Commit 870b7fd

Browse files
cschauflerpcmoore
cschaufler
authored and
pcmoore
committed
lsm: use lsm_prop in security_audit_rule_match
Change the secid parameter of security_audit_rule_match to a lsm_prop structure pointer. Pass the entry from the lsm_prop structure for the approprite slot to the LSM hook. Change the users of security_audit_rule_match to use the lsm_prop instead of a u32. The scaffolding function lsmprop_init() fills the structure with the value of the old secid, ensuring that it is available to the appropriate module hook. The sources of the secid, security_task_getsecid() and security_inode_getsecid(), will be converted to use the lsm_prop structure later in the series. At that point the use of lsmprop_init() is dropped. Signed-off-by: Casey Schaufler <[email protected]> [PM: subject line tweak] Signed-off-by: Paul Moore <[email protected]>
1 parent ed870e3 commit 870b7fd

File tree

12 files changed

+63
-31
lines changed

12 files changed

+63
-31
lines changed

‎include/linux/lsm_hook_defs.h‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -416,7 +416,8 @@ LSM_HOOK(void, LSM_RET_VOID, key_post_create_or_update, struct key *keyring,
416416
LSM_HOOK(int, 0, audit_rule_init, u32 field, u32 op, char *rulestr,
417417
void **lsmrule, gfp_t gfp)
418418
LSM_HOOK(int, 0, audit_rule_known, struct audit_krule *krule)
419-
LSM_HOOK(int, 0, audit_rule_match, u32 secid, u32 field, u32 op, void *lsmrule)
419+
LSM_HOOK(int, 0, audit_rule_match, struct lsm_prop *prop, u32 field, u32 op,
420+
void *lsmrule)
420421
LSM_HOOK(void, LSM_RET_VOID, audit_rule_free, void *lsmrule)
421422
#endif /* CONFIG_AUDIT */
422423

‎include/linux/security.h‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2115,7 +2115,8 @@ static inline void security_key_post_create_or_update(struct key *keyring,
21152115
int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule,
21162116
gfp_t gfp);
21172117
int security_audit_rule_known(struct audit_krule *krule);
2118-
int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule);
2118+
int security_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op,
2119+
void *lsmrule);
21192120
void security_audit_rule_free(void *lsmrule);
21202121

21212122
#else
@@ -2131,8 +2132,8 @@ static inline int security_audit_rule_known(struct audit_krule *krule)
21312132
return 0;
21322133
}
21332134

2134-
static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,
2135-
void *lsmrule)
2135+
static inline int security_audit_rule_match(struct lsm_prop *prop, u32 field,
2136+
u32 op, void *lsmrule)
21362137
{
21372138
return 0;
21382139
}

‎kernel/auditfilter.c‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1339,8 +1339,8 @@ int audit_filter(int msgtype, unsigned int listtype)
13391339

13401340
for (i = 0; i < e->rule.field_count; i++) {
13411341
struct audit_field *f = &e->rule.fields[i];
1342+
struct lsm_prop prop = { };
13421343
pid_t pid;
1343-
u32 sid;
13441344

13451345
switch (f->type) {
13461346
case AUDIT_PID:
@@ -1370,9 +1370,12 @@ int audit_filter(int msgtype, unsigned int listtype)
13701370
case AUDIT_SUBJ_SEN:
13711371
case AUDIT_SUBJ_CLR:
13721372
if (f->lsm_rule) {
1373-
security_current_getsecid_subj(&sid);
1374-
result = security_audit_rule_match(sid,
1375-
f->type, f->op, f->lsm_rule);
1373+
/* scaffolding */
1374+
security_current_getsecid_subj(
1375+
&prop.scaffold.secid);
1376+
result = security_audit_rule_match(
1377+
&prop, f->type, f->op,
1378+
f->lsm_rule);
13761379
}
13771380
break;
13781381
case AUDIT_EXE:

‎kernel/auditsc.c‎

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -471,6 +471,7 @@ static int audit_filter_rules(struct task_struct *tsk,
471471
const struct cred *cred;
472472
int i, need_sid = 1;
473473
u32 sid;
474+
struct lsm_prop prop = { };
474475
unsigned int sessionid;
475476

476477
if (ctx && rule->prio <= ctx->prio)
@@ -681,7 +682,10 @@ static int audit_filter_rules(struct task_struct *tsk,
681682
security_current_getsecid_subj(&sid);
682683
need_sid = 0;
683684
}
684-
result = security_audit_rule_match(sid, f->type,
685+
/* scaffolding */
686+
prop.scaffold.secid = sid;
687+
result = security_audit_rule_match(&prop,
688+
f->type,
685689
f->op,
686690
f->lsm_rule);
687691
}
@@ -696,15 +700,19 @@ static int audit_filter_rules(struct task_struct *tsk,
696700
if (f->lsm_rule) {
697701
/* Find files that match */
698702
if (name) {
703+
/* scaffolding */
704+
prop.scaffold.secid = name->osid;
699705
result = security_audit_rule_match(
700-
name->osid,
706+
&prop,
701707
f->type,
702708
f->op,
703709
f->lsm_rule);
704710
} else if (ctx) {
705711
list_for_each_entry(n, &ctx->names_list, list) {
712+
/* scaffolding */
713+
prop.scaffold.secid = n->osid;
706714
if (security_audit_rule_match(
707-
n->osid,
715+
&prop,
708716
f->type,
709717
f->op,
710718
f->lsm_rule)) {
@@ -716,7 +724,9 @@ static int audit_filter_rules(struct task_struct *tsk,
716724
/* Find ipc objects that match */
717725
if (!ctx || ctx->type != AUDIT_IPC)
718726
break;
719-
if (security_audit_rule_match(ctx->ipc.osid,
727+
/* scaffolding */
728+
prop.scaffold.secid = ctx->ipc.osid;
729+
if (security_audit_rule_match(&prop,
720730
f->type, f->op,
721731
f->lsm_rule))
722732
++result;

‎security/apparmor/audit.c‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -264,13 +264,17 @@ int aa_audit_rule_known(struct audit_krule *rule)
264264
return 0;
265265
}
266266

267-
int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule)
267+
int aa_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, void *vrule)
268268
{
269269
struct aa_audit_rule *rule = vrule;
270270
struct aa_label *label;
271271
int found = 0;
272272

273-
label = aa_secid_to_label(sid);
273+
/* scaffolding */
274+
if (!prop->apparmor.label && prop->scaffold.secid)
275+
label = aa_secid_to_label(prop->scaffold.secid);
276+
else
277+
label = prop->apparmor.label;
274278

275279
if (!label)
276280
return -ENOENT;

‎security/apparmor/include/audit.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -202,6 +202,6 @@ static inline int complain_error(int error)
202202
void aa_audit_rule_free(void *vrule);
203203
int aa_audit_rule_init(u32 field, u32 op, char *rulestr, void **vrule, gfp_t gfp);
204204
int aa_audit_rule_known(struct audit_krule *rule);
205-
int aa_audit_rule_match(u32 sid, u32 field, u32 op, void *vrule);
205+
int aa_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, void *vrule);
206206

207207
#endif /* __AA_AUDIT_H */

‎security/integrity/ima/ima.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -555,7 +555,7 @@ static inline void ima_filter_rule_free(void *lsmrule)
555555
{
556556
}
557557

558-
static inline int ima_filter_rule_match(u32 secid, u32 field, u32 op,
558+
static inline int ima_filter_rule_match(struct lsm_prop *prop, u32 field, u32 op,
559559
void *lsmrule)
560560
{
561561
return -EINVAL;

‎security/integrity/ima/ima_policy.c‎

Lines changed: 7 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -635,7 +635,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
635635
return false;
636636
for (i = 0; i < MAX_LSM_RULES; i++) {
637637
int rc = 0;
638-
u32 osid;
638+
struct lsm_prop prop = { };
639639

640640
if (!lsm_rule->lsm[i].rule) {
641641
if (!lsm_rule->lsm[i].args_p)
@@ -649,15 +649,18 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
649649
case LSM_OBJ_USER:
650650
case LSM_OBJ_ROLE:
651651
case LSM_OBJ_TYPE:
652-
security_inode_getsecid(inode, &osid);
653-
rc = ima_filter_rule_match(osid, lsm_rule->lsm[i].type,
652+
/* scaffolding */
653+
security_inode_getsecid(inode, &prop.scaffold.secid);
654+
rc = ima_filter_rule_match(&prop, lsm_rule->lsm[i].type,
654655
Audit_equal,
655656
lsm_rule->lsm[i].rule);
656657
break;
657658
case LSM_SUBJ_USER:
658659
case LSM_SUBJ_ROLE:
659660
case LSM_SUBJ_TYPE:
660-
rc = ima_filter_rule_match(secid, lsm_rule->lsm[i].type,
661+
/* scaffolding */
662+
prop.scaffold.secid = secid;
663+
rc = ima_filter_rule_match(&prop, lsm_rule->lsm[i].type,
661664
Audit_equal,
662665
lsm_rule->lsm[i].rule);
663666
break;

‎security/security.c‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -5570,7 +5570,7 @@ void security_audit_rule_free(void *lsmrule)
55705570

55715571
/**
55725572
* security_audit_rule_match() - Check if a label matches an audit rule
5573-
* @secid: security label
5573+
* @prop: security label
55745574
* @field: LSM audit field
55755575
* @op: matching operator
55765576
* @lsmrule: audit rule
@@ -5581,9 +5581,10 @@ void security_audit_rule_free(void *lsmrule)
55815581
* Return: Returns 1 if secid matches the rule, 0 if it does not, -ERRNO on
55825582
* failure.
55835583
*/
5584-
int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule)
5584+
int security_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op,
5585+
void *lsmrule)
55855586
{
5586-
return call_int_hook(audit_rule_match, secid, field, op, lsmrule);
5587+
return call_int_hook(audit_rule_match, prop, field, op, lsmrule);
55875588
}
55885589
#endif /* CONFIG_AUDIT */
55895590

‎security/selinux/include/audit.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -41,15 +41,15 @@ void selinux_audit_rule_free(void *rule);
4141

4242
/**
4343
* selinux_audit_rule_match - determine if a context ID matches a rule.
44-
* @sid: the context ID to check
44+
* @prop: includes the context ID to check
4545
* @field: the field this rule refers to
4646
* @op: the operator the rule uses
4747
* @rule: pointer to the audit rule to check against
4848
*
4949
* Returns 1 if the context id matches the rule, 0 if it does not, and
5050
* -errno on failure.
5151
*/
52-
int selinux_audit_rule_match(u32 sid, u32 field, u32 op, void *rule);
52+
int selinux_audit_rule_match(struct lsm_prop *prop, u32 field, u32 op, void *rule);
5353

5454
/**
5555
* selinux_audit_rule_known - check to see if rule contains selinux fields.

0 commit comments

Comments
 (0)