linux-toradex.git/include/linux/lsm_hooks.h, branch v4.12

LSM: Revive security_task_alloc() hook and per "struct task_struct" security blob.

2017-03-28T00:05:14+00:00

We switched from "struct task_struct"->security to "struct cred"->security
in Linux 2.6.29. But not all LSM modules were happy with that change.
TOMOYO LSM module is an example which want to use per "struct task_struct"
security blob, for TOMOYO's security context is defined based on "struct
task_struct" rather than "struct cred". AppArmor LSM module is another
example which want to use it, for AppArmor is currently abusing the cred
a little bit to store the change_hat and setexeccon info. Although
security_task_free() hook was revived in Linux 3.4 because Yama LSM module
wanted to release per "struct task_struct" security blob,
security_task_alloc() hook and "struct task_struct"->security field were
not revived. Nowadays, we are getting proposals of lightweight LSM modules
which want to use per "struct task_struct" security blob.

We are already allowing multiple concurrent LSM modules (up to one fully
armored module which uses "struct cred"->security field or exclusive hooks
like security_xfrm_state_pol_flow_match(), plus unlimited number of
lightweight modules which do not use "struct cred"->security nor exclusive
hooks) as long as they are built into the kernel. But this patch does not
implement variable length "struct task_struct"->security field which will
become needed when multiple LSM modules want to use "struct task_struct"->
security field. Although it won't be difficult to implement variable length
"struct task_struct"->security field, let's think about it after we merged
this patch.

Signed-off-by: Tetsuo Handa 
Acked-by: John Johansen 
Acked-by: Serge Hallyn 
Acked-by: Casey Schaufler 
Tested-by: Djalal Harouni 
Acked-by: José Bollo 
Cc: Paul Moore 
Cc: Stephen Smalley 
Cc: Eric Paris 
Cc: Kees Cook 
Cc: James Morris 
Cc: José Bollo 
Signed-off-by: James Morris

security: introduce CONFIG_SECURITY_WRITABLE_HOOKS

2017-03-06T00:00:12+00:00

Subsequent patches will add RO hardening to LSM hooks, however, SELinux
still needs to be able to perform runtime disablement after init to handle
architectures where init-time disablement via boot parameters is not feasible.

Introduce a new kernel configuration parameter CONFIG_SECURITY_WRITABLE_HOOKS,
and a helper macro __lsm_ro_after_init, to handle this case.

Signed-off-by: James Morris 
Acked-by: Stephen Smalley 
Acked-by: Casey Schaufler 
Acked-by: Kees Cook

prlimit,security,selinux: add a security hook for prlimit

2017-03-05T23:43:47+00:00

When SELinux was first added to the kernel, a process could only get
and set its own resource limits via getrlimit(2) and setrlimit(2), so no
MAC checks were required for those operations, and thus no security hooks
were defined for them. Later, SELinux introduced a hook for setlimit(2)
with a check if the hard limit was being changed in order to be able to
rely on the hard limit value as a safe reset point upon context
transitions.

Later on, when prlimit(2) was added to the kernel with the ability to get
or set resource limits (hard or soft) of another process, LSM/SELinux was
not updated other than to pass the target process to the setrlimit hook.
This resulted in incomplete control over both getting and setting the
resource limits of another process.

Add a new security_task_prlimit() hook to the check_prlimit_permission()
function to provide complete mediation.  The hook is only called when
acting on another task, and only if the existing DAC/capability checks
would allow access.  Pass flags down to the hook to indicate whether the
prlimit(2) call will read, write, or both read and write the resource
limits of the target process.

The existing security_task_setrlimit() hook is left alone; it continues
to serve a purpose in supporting the ability to make decisions based on
the old and/or new resource limit values when setting limits.  This
is consistent with the DAC/capability logic, where
check_prlimit_permission() performs generic DAC/capability checks for
acting on another task, while do_prlimit() performs a capability check
based on a comparison of the old and new resource limits.  Fix the
inline documentation for the hook to match the code.

Implement the new hook for SELinux.  For setting resource limits, we
reuse the existing setrlimit permission.  Note that this does overload
the setrlimit permission to mean the ability to set the resource limit
(soft or hard) of another process or the ability to change one's own
hard limit.  For getting resource limits, a new getrlimit permission
is defined.  This was not originally defined since getrlimit(2) could
only be used to obtain a process' own limits.

Signed-off-by: Stephen Smalley 
Signed-off-by: James Morris

Merge branch 'stable-4.11' of git://git.infradead.org/users/pcmoore/selinux into next

2017-02-09T23:28:49+00:00

LSM: Add /sys/kernel/security/lsm

2017-01-19T02:18:29+00:00

I am still tired of having to find indirect ways to determine
what security modules are active on a system. I have added
/sys/kernel/security/lsm, which contains a comma separated
list of the active security modules. No more groping around
in /proc/filesystems or other clever hacks.

Unchanged from previous versions except for being updated
to the latest security next branch.

Signed-off-by: Casey Schaufler 
Acked-by: John Johansen 
Acked-by: Paul Moore 
Acked-by: Kees Cook 
Signed-off-by: James Morris

security,selinux,smack: kill security_task_wait hook

2017-01-12T16:10:57+00:00

As reported by yangshukui, a permission denial from security_task_wait()
can lead to a soft lockup in zap_pid_ns_processes() since it only expects
sys_wait4() to return 0 or -ECHILD. Further, security_task_wait() can
in general lead to zombies; in the absence of some way to automatically
reparent a child process upon a denial, the hook is not useful.  Remove
the security hook and its implementations in SELinux and Smack.  Smack
already removed its check from its hook.

Reported-by: yangshukui 
Signed-off-by: Stephen Smalley 
Acked-by: Casey Schaufler 
Acked-by: Oleg Nesterov 
Signed-off-by: Paul Moore

security: Fix inode_getattr documentation

2017-01-10T06:39:23+00:00

Replace arguments @mnt and @dentry with @path.

Signed-off-by: Mickaël Salaün 
Acked-by: Serge Hallyn 
Signed-off-by: James Morris

proc,security: move restriction on writing /proc/pid/attr nodes to proc

2017-01-09T15:07:31+00:00

Processes can only alter their own security attributes via
/proc/pid/attr nodes.  This is presently enforced by each individual
security module and is also imposed by the Linux credentials
implementation, which only allows a task to alter its own credentials.
Move the check enforcing this restriction from the individual
security modules to proc_pid_attr_write() before calling the security hook,
and drop the unnecessary task argument to the security hook since it can
only ever be the current task.

Signed-off-by: Stephen Smalley 
Acked-by: Casey Schaufler 
Acked-by: John Johansen 
Signed-off-by: Paul Moore

Merge branch 'stable-4.9' of git://git.infradead.org/users/pcmoore/selinux into next

2016-09-19T02:27:10+00:00

module: Fully remove the kernel_module_from_file hook

2016-08-09T00:58:57+00:00

Remove remaining kernel_module_from_file hook left by commit
a1db74209483 ("module: replace copy_module_from_fd with kernel version")

Signed-off-by: Mickaël Salaün 
Cc: Rusty Russell 
Acked-by: Kees Cook 
Signed-off-by: Mimi Zohar 
Signed-off-by: James Morris