diff options
Diffstat (limited to 'meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0006-Security-Add-Hook-to-test-if-the-particular-xattr-is.patch')
| -rw-r--r-- | meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0006-Security-Add-Hook-to-test-if-the-particular-xattr-is.patch | 170 |
1 files changed, 170 insertions, 0 deletions
diff --git a/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0006-Security-Add-Hook-to-test-if-the-particular-xattr-is.patch b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0006-Security-Add-Hook-to-test-if-the-particular-xattr-is.patch new file mode 100644 index 0000000..2539ff6 --- /dev/null +++ b/meta-rcar-gen2/recipes-kernel/linux/linux-renesas/smack/0006-Security-Add-Hook-to-test-if-the-particular-xattr-is.patch @@ -0,0 +1,170 @@ +From 2a47b333efc3a2cb768eaba9d35e1467b3bc6211 Mon Sep 17 00:00:00 2001 +From: David Quigley <dpquigl@davequigley.com> +Date: Wed, 22 May 2013 12:50:35 -0400 +Subject: [PATCH 06/54] Security: Add Hook to test if the particular xattr is + part of a MAC model. + +The interface to request security labels from user space is the xattr +interface. When requesting the security label from an NFS server it is +important to make sure the requested xattr actually is a MAC label. This allows +us to make sure that we get the desired semantics from the attribute instead of +something else such as capabilities or a time based LSM. + +Acked-by: Eric Paris <eparis@redhat.com> +Acked-by: James Morris <james.l.morris@oracle.com> +Signed-off-by: Matthew N. Dodd <Matthew.Dodd@sparta.com> +Signed-off-by: Miguel Rodel Felipe <Rodel_FM@dsi.a-star.edu.sg> +Signed-off-by: Phua Eu Gene <PHUA_Eu_Gene@dsi.a-star.edu.sg> +Signed-off-by: Khin Mi Mi Aung <Mi_Mi_AUNG@dsi.a-star.edu.sg> +Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com> +--- + include/linux/security.h | 14 ++++++++++++++ + security/capability.c | 6 ++++++ + security/security.c | 6 ++++++ + security/selinux/hooks.c | 6 ++++++ + security/smack/smack_lsm.c | 11 +++++++++++ + 5 files changed, 43 insertions(+) + +diff --git a/include/linux/security.h b/include/linux/security.h +index 4686491..1d8fe3c 100644 +--- a/include/linux/security.h ++++ b/include/linux/security.h +@@ -1313,6 +1313,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) + * @pages contains the number of pages. + * Return 0 if permission is granted. + * ++ * @ismaclabel: ++ * Check if the extended attribute specified by @name ++ * represents a MAC label. Returns 1 if name is a MAC ++ * attribute otherwise returns 0. ++ * @name full extended attribute name to check against ++ * LSM as a MAC label. ++ * + * @secid_to_secctx: + * Convert secid to security context. If secdata is NULL the length of + * the result will be returned in seclen, but no secdata will be returned. +@@ -1590,6 +1597,7 @@ struct security_operations { + + int (*getprocattr) (struct task_struct *p, char *name, char **value); + int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t size); ++ int (*ismaclabel) (const char *name); + int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen); + int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid); + void (*release_secctx) (char *secdata, u32 seclen); +@@ -1840,6 +1848,7 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode); + int security_getprocattr(struct task_struct *p, char *name, char **value); + int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size); + int security_netlink_send(struct sock *sk, struct sk_buff *skb); ++int security_ismaclabel(const char *name); + int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen); + int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); + void security_release_secctx(char *secdata, u32 seclen); +@@ -2520,6 +2529,11 @@ static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb) + return cap_netlink_send(sk, skb); + } + ++static inline int security_ismaclabel(const char *name) ++{ ++ return 0; ++} ++ + static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) + { + return -EOPNOTSUPP; +diff --git a/security/capability.c b/security/capability.c +index 1728d4e..26e0d3d 100644 +--- a/security/capability.c ++++ b/security/capability.c +@@ -816,6 +816,11 @@ static int cap_setprocattr(struct task_struct *p, char *name, void *value, + return -EINVAL; + } + ++static int cap_ismaclabel(const char *name) ++{ ++ return 0; ++} ++ + static int cap_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) + { + return -EOPNOTSUPP; +@@ -1034,6 +1039,7 @@ void __init security_fixup_ops(struct security_operations *ops) + set_to_cap_if_null(ops, d_instantiate); + set_to_cap_if_null(ops, getprocattr); + set_to_cap_if_null(ops, setprocattr); ++ set_to_cap_if_null(ops, ismaclabel); + set_to_cap_if_null(ops, secid_to_secctx); + set_to_cap_if_null(ops, secctx_to_secid); + set_to_cap_if_null(ops, release_secctx); +diff --git a/security/security.c b/security/security.c +index a3dce87..bf919ce 100644 +--- a/security/security.c ++++ b/security/security.c +@@ -1047,6 +1047,12 @@ int security_netlink_send(struct sock *sk, struct sk_buff *skb) + return security_ops->netlink_send(sk, skb); + } + ++int security_ismaclabel(const char *name) ++{ ++ return security_ops->ismaclabel(name); ++} ++EXPORT_SYMBOL(security_ismaclabel); ++ + int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) + { + return security_ops->secid_to_secctx(secid, secdata, seclen); +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index a7096e1..d2f4381 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -5526,6 +5526,11 @@ abort_change: + return error; + } + ++static int selinux_ismaclabel(const char *name) ++{ ++ return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0); ++} ++ + static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) + { + return security_sid_to_context(secid, secdata, seclen); +@@ -5763,6 +5768,7 @@ static struct security_operations selinux_ops = { + .getprocattr = selinux_getprocattr, + .setprocattr = selinux_setprocattr, + ++ .ismaclabel = selinux_ismaclabel, + .secid_to_secctx = selinux_secid_to_secctx, + .secctx_to_secid = selinux_secctx_to_secid, + .release_secctx = selinux_release_secctx, +diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c +index 6a08330..3f7682a 100644 +--- a/security/smack/smack_lsm.c ++++ b/security/smack/smack_lsm.c +@@ -3640,6 +3640,16 @@ static void smack_audit_rule_free(void *vrule) + #endif /* CONFIG_AUDIT */ + + /** ++ * smack_ismaclabel - check if xattr @name references a smack MAC label ++ * @name: Full xattr name to check. ++ */ ++static int smack_ismaclabel(const char *name) ++{ ++ return (strcmp(name, XATTR_SMACK_SUFFIX) == 0); ++} ++ ++ ++/** + * smack_secid_to_secctx - return the smack label for a secid + * @secid: incoming integer + * @secdata: destination +@@ -3836,6 +3846,7 @@ struct security_operations smack_ops = { + .audit_rule_free = smack_audit_rule_free, + #endif /* CONFIG_AUDIT */ + ++ .ismaclabel = smack_ismaclabel, + .secid_to_secctx = smack_secid_to_secctx, + .secctx_to_secid = smack_secctx_to_secid, + .release_secctx = smack_release_secctx, +-- +2.1.4 + |