]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
UBUNTU: SAUCE: LSM: Create and manage the lsmblob data structure.
authorCasey Schaufler <casey@schaufler-ca.com>
Mon, 17 Aug 2020 23:02:56 +0000 (16:02 -0700)
committerPaolo Pisati <paolo.pisati@canonical.com>
Tue, 2 Nov 2021 07:24:51 +0000 (08:24 +0100)
commitf17b27a2790e72198d2aaf45242453e5a9043049
treef0b780b75f45d29643bcf42d02abfa873780c7da
parent12ddb08a15f131ddabe2e0703a1f4901179755eb
UBUNTU: SAUCE: LSM: Create and manage the lsmblob data structure.

When more than one security module is exporting data to
audit and networking sub-systems a single 32 bit integer
is no longer sufficient to represent the data. Add a
structure to be used instead.

The lsmblob structure is currently an array of
u32 "secids". There is an entry for each of the
security modules built into the system that would
use secids if active. The system assigns the module
a "slot" when it registers hooks. If modules are
compiled in but not registered there will be unused
slots.

A new lsm_id structure, which contains the name
of the LSM and its slot number, is created. There
is an instance for each LSM, which assigns the name
and passes it to the infrastructure to set the slot.

The audit rules data is expanded to use an array of
security module data rather than a single instance.
Because IMA uses the audit rule functions it is
affected as well.

Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Paul Moore <paul@paul-moore.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Andrea Righi <andrea.righi@canonical.com>
[ saf: resolve conflicts ]
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
[ update to support landlock ]
Signed-off-by: Andrea Righi <andrea.righi@canonical.com>
20 files changed:
include/linux/audit.h
include/linux/lsm_hooks.h
include/linux/security.h
kernel/auditfilter.c
kernel/auditsc.c
security/apparmor/lsm.c
security/bpf/hooks.c
security/commoncap.c
security/integrity/ima/ima_policy.c
security/landlock/cred.c
security/landlock/fs.c
security/landlock/ptrace.c
security/loadpin/loadpin.c
security/lockdown/lockdown.c
security/safesetid/lsm.c
security/security.c
security/selinux/hooks.c
security/smack/smack_lsm.c
security/tomoyo/tomoyo.c
security/yama/yama_lsm.c