summaryrefslogtreecommitdiffstats
path: root/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0006-Security-Add-Hook-to-test-if-the-particular-xattr-is.patch
diff options
context:
space:
mode:
authorYannick GICQUEL <yannick.gicquel@iot.bzh>2015-10-19 15:57:07 +0200
committerGerrit Code Review <gerrit@172.30.200.200>2015-11-06 15:23:36 +0000
commitede19ea0c47fb23f3fc779833d1e57cf76f3371e (patch)
tree47d6fae2283c54def1871aaf2a73828ac68b1b34 /meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0006-Security-Add-Hook-to-test-if-the-particular-xattr-is.patch
parent1cd8ab18abca96e4ee108f80225058d875b28347 (diff)
kernel: smack security backport from kernel 4
Here is the backport of all patches relating to smack support on kernel side. For more details, see file: meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/README Please note that patches are applied only if "smack" is in the ditro features. Here are the 2 lines to add in the local.conf OVERRIDES .= ":smack" DISTRO_FEATURES_append = " smack" Change-Id: I147a3532aec531f977d6ec34c576261835711f1e Signed-off-by: Yannick GICQUEL <yannick.gicquel@iot.bzh> Signed-off-by: José Bollo <jose.bollo@iot.bzh>
Diffstat (limited to 'meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0006-Security-Add-Hook-to-test-if-the-particular-xattr-is.patch')
-rw-r--r--meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0006-Security-Add-Hook-to-test-if-the-particular-xattr-is.patch170
1 files changed, 170 insertions, 0 deletions
diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0006-Security-Add-Hook-to-test-if-the-particular-xattr-is.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0006-Security-Add-Hook-to-test-if-the-particular-xattr-is.patch
new file mode 100644
index 0000000..2539ff6
--- /dev/null
+++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0006-Security-Add-Hook-to-test-if-the-particular-xattr-is.patch
@@ -0,0 +1,170 @@
+From 2a47b333efc3a2cb768eaba9d35e1467b3bc6211 Mon Sep 17 00:00:00 2001
+From: David Quigley <dpquigl@davequigley.com>
+Date: Wed, 22 May 2013 12:50:35 -0400
+Subject: [PATCH 06/54] Security: Add Hook to test if the particular xattr is
+ part of a MAC model.
+
+The interface to request security labels from user space is the xattr
+interface. When requesting the security label from an NFS server it is
+important to make sure the requested xattr actually is a MAC label. This allows
+us to make sure that we get the desired semantics from the attribute instead of
+something else such as capabilities or a time based LSM.
+
+Acked-by: Eric Paris <eparis@redhat.com>
+Acked-by: James Morris <james.l.morris@oracle.com>
+Signed-off-by: Matthew N. Dodd <Matthew.Dodd@sparta.com>
+Signed-off-by: Miguel Rodel Felipe <Rodel_FM@dsi.a-star.edu.sg>
+Signed-off-by: Phua Eu Gene <PHUA_Eu_Gene@dsi.a-star.edu.sg>
+Signed-off-by: Khin Mi Mi Aung <Mi_Mi_AUNG@dsi.a-star.edu.sg>
+Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>
+---
+ include/linux/security.h | 14 ++++++++++++++
+ security/capability.c | 6 ++++++
+ security/security.c | 6 ++++++
+ security/selinux/hooks.c | 6 ++++++
+ security/smack/smack_lsm.c | 11 +++++++++++
+ 5 files changed, 43 insertions(+)
+
+diff --git a/include/linux/security.h b/include/linux/security.h
+index 4686491..1d8fe3c 100644
+--- a/include/linux/security.h
++++ b/include/linux/security.h
+@@ -1313,6 +1313,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
+ * @pages contains the number of pages.
+ * Return 0 if permission is granted.
+ *
++ * @ismaclabel:
++ * Check if the extended attribute specified by @name
++ * represents a MAC label. Returns 1 if name is a MAC
++ * attribute otherwise returns 0.
++ * @name full extended attribute name to check against
++ * LSM as a MAC label.
++ *
+ * @secid_to_secctx:
+ * Convert secid to security context. If secdata is NULL the length of
+ * the result will be returned in seclen, but no secdata will be returned.
+@@ -1590,6 +1597,7 @@ struct security_operations {
+
+ int (*getprocattr) (struct task_struct *p, char *name, char **value);
+ int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t size);
++ int (*ismaclabel) (const char *name);
+ int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen);
+ int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid);
+ void (*release_secctx) (char *secdata, u32 seclen);
+@@ -1840,6 +1848,7 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode);
+ int security_getprocattr(struct task_struct *p, char *name, char **value);
+ int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size);
+ int security_netlink_send(struct sock *sk, struct sk_buff *skb);
++int security_ismaclabel(const char *name);
+ int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen);
+ int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid);
+ void security_release_secctx(char *secdata, u32 seclen);
+@@ -2520,6 +2529,11 @@ static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb)
+ return cap_netlink_send(sk, skb);
+ }
+
++static inline int security_ismaclabel(const char *name)
++{
++ return 0;
++}
++
+ static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+ {
+ return -EOPNOTSUPP;
+diff --git a/security/capability.c b/security/capability.c
+index 1728d4e..26e0d3d 100644
+--- a/security/capability.c
++++ b/security/capability.c
+@@ -816,6 +816,11 @@ static int cap_setprocattr(struct task_struct *p, char *name, void *value,
+ return -EINVAL;
+ }
+
++static int cap_ismaclabel(const char *name)
++{
++ return 0;
++}
++
+ static int cap_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+ {
+ return -EOPNOTSUPP;
+@@ -1034,6 +1039,7 @@ void __init security_fixup_ops(struct security_operations *ops)
+ set_to_cap_if_null(ops, d_instantiate);
+ set_to_cap_if_null(ops, getprocattr);
+ set_to_cap_if_null(ops, setprocattr);
++ set_to_cap_if_null(ops, ismaclabel);
+ set_to_cap_if_null(ops, secid_to_secctx);
+ set_to_cap_if_null(ops, secctx_to_secid);
+ set_to_cap_if_null(ops, release_secctx);
+diff --git a/security/security.c b/security/security.c
+index a3dce87..bf919ce 100644
+--- a/security/security.c
++++ b/security/security.c
+@@ -1047,6 +1047,12 @@ int security_netlink_send(struct sock *sk, struct sk_buff *skb)
+ return security_ops->netlink_send(sk, skb);
+ }
+
++int security_ismaclabel(const char *name)
++{
++ return security_ops->ismaclabel(name);
++}
++EXPORT_SYMBOL(security_ismaclabel);
++
+ int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+ {
+ return security_ops->secid_to_secctx(secid, secdata, seclen);
+diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
+index a7096e1..d2f4381 100644
+--- a/security/selinux/hooks.c
++++ b/security/selinux/hooks.c
+@@ -5526,6 +5526,11 @@ abort_change:
+ return error;
+ }
+
++static int selinux_ismaclabel(const char *name)
++{
++ return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
++}
++
+ static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
+ {
+ return security_sid_to_context(secid, secdata, seclen);
+@@ -5763,6 +5768,7 @@ static struct security_operations selinux_ops = {
+ .getprocattr = selinux_getprocattr,
+ .setprocattr = selinux_setprocattr,
+
++ .ismaclabel = selinux_ismaclabel,
+ .secid_to_secctx = selinux_secid_to_secctx,
+ .secctx_to_secid = selinux_secctx_to_secid,
+ .release_secctx = selinux_release_secctx,
+diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
+index 6a08330..3f7682a 100644
+--- a/security/smack/smack_lsm.c
++++ b/security/smack/smack_lsm.c
+@@ -3640,6 +3640,16 @@ static void smack_audit_rule_free(void *vrule)
+ #endif /* CONFIG_AUDIT */
+
+ /**
++ * smack_ismaclabel - check if xattr @name references a smack MAC label
++ * @name: Full xattr name to check.
++ */
++static int smack_ismaclabel(const char *name)
++{
++ return (strcmp(name, XATTR_SMACK_SUFFIX) == 0);
++}
++
++
++/**
+ * smack_secid_to_secctx - return the smack label for a secid
+ * @secid: incoming integer
+ * @secdata: destination
+@@ -3836,6 +3846,7 @@ struct security_operations smack_ops = {
+ .audit_rule_free = smack_audit_rule_free,
+ #endif /* CONFIG_AUDIT */
+
++ .ismaclabel = smack_ismaclabel,
+ .secid_to_secctx = smack_secid_to_secctx,
+ .secctx_to_secid = smack_secctx_to_secid,
+ .release_secctx = smack_release_secctx,
+--
+2.1.4
+