brain-hackers_pepepper-mirror
/
linux-brain
mirror of https://github.com/brain-hackers/linux-brain.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

selinux: implement the kernfs_init_security hook 

The hook applies the same logic as selinux_determine_inode_label(), with
the exception of the super_block handling, which will be enforced on the
actual inodes later by other hooks.

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
[PM: minor merge fixes]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Ondrej Mosnacek 2019-02-22 15:57:17 +01:00 committed by Paul Moore
parent b230d5aba2
commit ec882da5cd
1 changed files with 66 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

66
security/selinux/hooks.c
View File

@ -89,6 +89,8 @@
#include <linux/msg.h>
#include <linux/shm.h>
#include <linux/bpf.h>
#include <linux/kernfs.h>
#include <linux/stringhash.h> /* for hashlen_string() */
#include <uapi/linux/mount.h>
#include "avc.h"
@ -3382,6 +3384,68 @@ static int selinux_inode_copy_up_xattr(const char *name)
return -EOPNOTSUPP;
}
/* kernfs node operations */
int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
struct kernfs_node *kn)
{
const struct task_security_struct *tsec = current_security();
u32 parent_sid, newsid, clen;
int rc;
char *context;
rc = kernfs_security_xattr_get(kn_dir, XATTR_SELINUX_SUFFIX, NULL, 0);
if (rc == -ENODATA)
return 0;
else if (rc < 0)
return rc;
clen = (u32)rc;
context = kmalloc(clen, GFP_KERNEL);
if (!context)
return -ENOMEM;
rc = kernfs_security_xattr_get(kn_dir, XATTR_SELINUX_SUFFIX, context,
clen);
if (rc < 0) {
kfree(context);
return rc;
}
rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
GFP_KERNEL);
kfree(context);
if (rc)
return rc;
if (tsec->create_sid) {
newsid = tsec->create_sid;
} else {
u16 secclass = inode_mode_to_security_class(kn->mode);
struct qstr q;
q.name = kn->name;
q.hash_len = hashlen_string(kn_dir, kn->name);
rc = security_transition_sid(&selinux_state, tsec->sid,
parent_sid, secclass, &q,
&newsid);
if (rc)
return rc;
}
rc = security_sid_to_context_force(&selinux_state, newsid,
&context, &clen);
if (rc)
return rc;
rc = kernfs_security_xattr_set(kn, XATTR_SELINUX_SUFFIX, context, clen,
XATTR_CREATE);
kfree(context);
return rc;
}
/* file security operations */
static int selinux_revalidate_file_permission(struct file *file, int mask)
@ -6730,6 +6794,8 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
LSM_HOOK_INIT(file_permission, selinux_file_permission),
LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),