Skip to content

Commit cc4a875

Browse files
torvaldstorvalds
committed
Merge tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm
Pull lsm updates from Paul Moore: - Promote IMA/EVM to a proper LSM This is the bulk of the diffstat, and the source of all the changes in the VFS code. Prior to the start of the LSM stacking work it was important that IMA/EVM were separate from the rest of the LSMs, complete with their own hooks, infrastructure, etc. as it was the only way to enable IMA/EVM at the same time as a LSM. However, now that the bulk of the LSM infrastructure supports multiple simultaneous LSMs, we can simplify things greatly by bringing IMA/EVM into the LSM infrastructure as proper LSMs. This is something I've wanted to see happen for quite some time and Roberto was kind enough to put in the work to make it happen. - Use the LSM hook default values to simplify the call_int_hook() macro Previously the call_int_hook() macro required callers to supply a default return value, despite a default value being specified when the LSM hook was defined. This simplifies the macro by using the defined default return value which makes life easier for callers and should also reduce the number of return value bugs in the future (we've had a few pop up recently, hence this work). - Use the KMEM_CACHE() macro instead of kmem_cache_create() The guidance appears to be to use the KMEM_CACHE() macro when possible and there is no reason why we can't use the macro, so let's use it. - Fix a number of comment typos in the LSM hook comment blocks Not much to say here, we fixed some questionable grammar decisions in the LSM hook comment blocks. * tag 'lsm-pr-20240312' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/lsm: (28 commits) cred: Use KMEM_CACHE() instead of kmem_cache_create() lsm: use default hook return value in call_int_hook() lsm: fix typos in security/security.c comment headers integrity: Remove LSM ima: Make it independent from 'integrity' LSM evm: Make it independent from 'integrity' LSM evm: Move to LSM infrastructure ima: Move IMA-Appraisal to LSM infrastructure ima: Move to LSM infrastructure integrity: Move integrity_kernel_module_request() to IMA security: Introduce key_post_create_or_update hook security: Introduce inode_post_remove_acl hook security: Introduce inode_post_set_acl hook security: Introduce inode_post_create_tmpfile hook security: Introduce path_post_mknod hook security: Introduce file_release hook security: Introduce file_post_open hook security: Introduce inode_post_removexattr hook security: Introduce inode_post_setattr hook security: Align inode_setattr hook definition with EVM ...
2 parents ca661c5 + edc6670 commit cc4a875

36 files changed

+1126
-1141
lines changed

‎fs/attr.c‎

Lines changed: 1 addition & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,6 @@
1616
#include <linux/fcntl.h>
1717
#include <linux/filelock.h>
1818
#include <linux/security.h>
19-
#include <linux/evm.h>
20-
#include <linux/ima.h>
2119

2220
#include "internal.h"
2321

@@ -502,8 +500,7 @@ int notify_change(struct mnt_idmap *idmap, struct dentry *dentry,
502500

503501
if (!error) {
504502
fsnotify_change(dentry, ia_valid);
505-
ima_inode_post_setattr(idmap, dentry);
506-
evm_inode_post_setattr(dentry, ia_valid);
503+
security_inode_post_setattr(idmap, dentry, ia_valid);
507504
}
508505

509506
return error;

‎fs/file_table.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@
2626
#include <linux/percpu_counter.h>
2727
#include <linux/percpu.h>
2828
#include <linux/task_work.h>
29-
#include <linux/ima.h>
3029
#include <linux/swap.h>
3130
#include <linux/kmemleak.h>
3231

@@ -414,7 +413,7 @@ static void __fput(struct file *file)
414413
eventpoll_release(file);
415414
locks_remove_file(file);
416415

417-
ima_file_free(file);
416+
security_file_release(file);
418417
if (unlikely(file->f_flags & FASYNC)) {
419418
if (file->f_op->fasync)
420419
file->f_op->fasync(-1, file, 0);

‎fs/namei.c‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,6 @@
2727
#include <linux/fsnotify.h>
2828
#include <linux/personality.h>
2929
#include <linux/security.h>
30-
#include <linux/ima.h>
3130
#include <linux/syscalls.h>
3231
#include <linux/mount.h>
3332
#include <linux/audit.h>
@@ -3642,7 +3641,7 @@ static int do_open(struct nameidata *nd,
36423641
if (!error && !(file->f_mode & FMODE_OPENED))
36433642
error = vfs_open(&nd->path, file);
36443643
if (!error)
3645-
error = ima_file_check(file, op->acc_mode);
3644+
error = security_file_post_open(file, op->acc_mode);
36463645
if (!error && do_truncate)
36473646
error = handle_truncate(idmap, file);
36483647
if (unlikely(error > 0)) {
@@ -3705,7 +3704,7 @@ static int vfs_tmpfile(struct mnt_idmap *idmap,
37053704
inode->i_state |= I_LINKABLE;
37063705
spin_unlock(&inode->i_lock);
37073706
}
3708-
ima_post_create_tmpfile(idmap, inode);
3707+
security_inode_post_create_tmpfile(idmap, inode);
37093708
return 0;
37103709
}
37113710

@@ -4051,8 +4050,6 @@ static int do_mknodat(int dfd, struct filename *name, umode_t mode,
40514050
case 0: case S_IFREG:
40524051
error = vfs_create(idmap, path.dentry->d_inode,
40534052
dentry, mode, true);
4054-
if (!error)
4055-
ima_post_path_mknod(idmap, dentry);
40564053
break;
40574054
case S_IFCHR: case S_IFBLK:
40584055
error = vfs_mknod(idmap, path.dentry->d_inode,
@@ -4063,6 +4060,11 @@ static int do_mknodat(int dfd, struct filename *name, umode_t mode,
40634060
dentry, mode, 0);
40644061
break;
40654062
}
4063+
4064+
if (error)
4065+
goto out2;
4066+
4067+
security_path_post_mknod(idmap, dentry);
40664068
out2:
40674069
done_path_create(&path, dentry);
40684070
if (retry_estale(error, lookup_flags)) {

‎fs/nfsd/vfs.c‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,6 @@
2525
#include <linux/posix_acl_xattr.h>
2626
#include <linux/xattr.h>
2727
#include <linux/jhash.h>
28-
#include <linux/ima.h>
2928
#include <linux/pagemap.h>
3029
#include <linux/slab.h>
3130
#include <linux/uaccess.h>
@@ -895,7 +894,7 @@ __nfsd_open(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type,
895894
goto out;
896895
}
897896

898-
host_err = ima_file_check(file, may_flags);
897+
host_err = security_file_post_open(file, may_flags);
899898
if (host_err) {
900899
fput(file);
901900
goto out;

‎fs/open.c‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,6 @@
2929
#include <linux/audit.h>
3030
#include <linux/falloc.h>
3131
#include <linux/fs_struct.h>
32-
#include <linux/ima.h>
3332
#include <linux/dnotify.h>
3433
#include <linux/compat.h>
3534
#include <linux/mnt_idmapping.h>

‎fs/posix_acl.c‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,6 @@
2626
#include <linux/mnt_idmapping.h>
2727
#include <linux/iversion.h>
2828
#include <linux/security.h>
29-
#include <linux/evm.h>
3029
#include <linux/fsnotify.h>
3130
#include <linux/filelock.h>
3231

@@ -1137,7 +1136,7 @@ int vfs_set_acl(struct mnt_idmap *idmap, struct dentry *dentry,
11371136
error = -EIO;
11381137
if (!error) {
11391138
fsnotify_xattr(dentry);
1140-
evm_inode_post_set_acl(dentry, acl_name, kacl);
1139+
security_inode_post_set_acl(dentry, acl_name, kacl);
11411140
}
11421141

11431142
out_inode_unlock:
@@ -1245,7 +1244,7 @@ int vfs_remove_acl(struct mnt_idmap *idmap, struct dentry *dentry,
12451244
error = -EIO;
12461245
if (!error) {
12471246
fsnotify_xattr(dentry);
1248-
evm_inode_post_remove_acl(idmap, dentry, acl_name);
1247+
security_inode_post_remove_acl(idmap, dentry, acl_name);
12491248
}
12501249

12511250
out_inode_unlock:

‎fs/xattr.c‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,6 @@
1616
#include <linux/mount.h>
1717
#include <linux/namei.h>
1818
#include <linux/security.h>
19-
#include <linux/evm.h>
2019
#include <linux/syscalls.h>
2120
#include <linux/export.h>
2221
#include <linux/fsnotify.h>
@@ -552,11 +551,11 @@ __vfs_removexattr_locked(struct mnt_idmap *idmap,
552551
goto out;
553552

554553
error = __vfs_removexattr(idmap, dentry, name);
554+
if (error)
555+
return error;
555556

556-
if (!error) {
557-
fsnotify_xattr(dentry);
558-
evm_inode_post_removexattr(dentry, name);
559-
}
557+
fsnotify_xattr(dentry);
558+
security_inode_post_removexattr(dentry, name);
560559

561560
out:
562561
return error;

‎include/linux/evm.h‎

Lines changed: 2 additions & 115 deletions
Original file line numberDiff line numberDiff line change
@@ -12,52 +12,12 @@
1212
#include <linux/integrity.h>
1313
#include <linux/xattr.h>
1414

15-
struct integrity_iint_cache;
16-
1715
#ifdef CONFIG_EVM
1816
extern int evm_set_key(void *key, size_t keylen);
1917
extern enum integrity_status evm_verifyxattr(struct dentry *dentry,
2018
const char *xattr_name,
2119
void *xattr_value,
22-
size_t xattr_value_len,
23-
struct integrity_iint_cache *iint);
24-
extern int evm_inode_setattr(struct mnt_idmap *idmap,
25-
struct dentry *dentry, struct iattr *attr);
26-
extern void evm_inode_post_setattr(struct dentry *dentry, int ia_valid);
27-
extern int evm_inode_setxattr(struct mnt_idmap *idmap,
28-
struct dentry *dentry, const char *name,
29-
const void *value, size_t size);
30-
extern void evm_inode_post_setxattr(struct dentry *dentry,
31-
const char *xattr_name,
32-
const void *xattr_value,
33-
size_t xattr_value_len);
34-
extern int evm_inode_copy_up_xattr(const char *name);
35-
extern int evm_inode_removexattr(struct mnt_idmap *idmap,
36-
struct dentry *dentry, const char *xattr_name);
37-
extern void evm_inode_post_removexattr(struct dentry *dentry,
38-
const char *xattr_name);
39-
static inline void evm_inode_post_remove_acl(struct mnt_idmap *idmap,
40-
struct dentry *dentry,
41-
const char *acl_name)
42-
{
43-
evm_inode_post_removexattr(dentry, acl_name);
44-
}
45-
extern int evm_inode_set_acl(struct mnt_idmap *idmap,
46-
struct dentry *dentry, const char *acl_name,
47-
struct posix_acl *kacl);
48-
static inline int evm_inode_remove_acl(struct mnt_idmap *idmap,
49-
struct dentry *dentry,
50-
const char *acl_name)
51-
{
52-
return evm_inode_set_acl(idmap, dentry, acl_name, NULL);
53-
}
54-
static inline void evm_inode_post_set_acl(struct dentry *dentry,
55-
const char *acl_name,
56-
struct posix_acl *kacl)
57-
{
58-
return evm_inode_post_setxattr(dentry, acl_name, NULL, 0);
59-
}
60-
20+
size_t xattr_value_len);
6121
int evm_inode_init_security(struct inode *inode, struct inode *dir,
6222
const struct qstr *qstr, struct xattr *xattrs,
6323
int *xattr_count);
@@ -85,85 +45,12 @@ static inline int evm_set_key(void *key, size_t keylen)
8545
static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,
8646
const char *xattr_name,
8747
void *xattr_value,
88-
size_t xattr_value_len,
89-
struct integrity_iint_cache *iint)
48+
size_t xattr_value_len)
9049
{
9150
return INTEGRITY_UNKNOWN;
9251
}
9352
#endif
9453

95-
static inline int evm_inode_setattr(struct mnt_idmap *idmap,
96-
struct dentry *dentry, struct iattr *attr)
97-
{
98-
return 0;
99-
}
100-
101-
static inline void evm_inode_post_setattr(struct dentry *dentry, int ia_valid)
102-
{
103-
return;
104-
}
105-
106-
static inline int evm_inode_setxattr(struct mnt_idmap *idmap,
107-
struct dentry *dentry, const char *name,
108-
const void *value, size_t size)
109-
{
110-
return 0;
111-
}
112-
113-
static inline void evm_inode_post_setxattr(struct dentry *dentry,
114-
const char *xattr_name,
115-
const void *xattr_value,
116-
size_t xattr_value_len)
117-
{
118-
return;
119-
}
120-
121-
static inline int evm_inode_copy_up_xattr(const char *name)
122-
{
123-
return 0;
124-
}
125-
126-
static inline int evm_inode_removexattr(struct mnt_idmap *idmap,
127-
struct dentry *dentry,
128-
const char *xattr_name)
129-
{
130-
return 0;
131-
}
132-
133-
static inline void evm_inode_post_removexattr(struct dentry *dentry,
134-
const char *xattr_name)
135-
{
136-
return;
137-
}
138-
139-
static inline void evm_inode_post_remove_acl(struct mnt_idmap *idmap,
140-
struct dentry *dentry,
141-
const char *acl_name)
142-
{
143-
return;
144-
}
145-
146-
static inline int evm_inode_set_acl(struct mnt_idmap *idmap,
147-
struct dentry *dentry, const char *acl_name,
148-
struct posix_acl *kacl)
149-
{
150-
return 0;
151-
}
152-
153-
static inline int evm_inode_remove_acl(struct mnt_idmap *idmap,
154-
struct dentry *dentry,
155-
const char *acl_name)
156-
{
157-
return 0;
158-
}
159-
160-
static inline void evm_inode_post_set_acl(struct dentry *dentry,
161-
const char *acl_name,
162-
struct posix_acl *kacl)
163-
{
164-
return;
165-
}
166-
16754
static inline int evm_inode_init_security(struct inode *inode, struct inode *dir,
16855
const struct qstr *qstr,
16956
struct xattr *xattrs,

0 commit comments

Comments
 (0)