UBUNTU: SAUCE: LSM: Use lsmblob in security_audit_rule_match

Change the secid parameter of security_audit_rule_match
to a lsmblob structure pointer. Pass the entry from the
lsmblob structure for the approprite slot to the LSM hook.

Change the users of security_audit_rule_match to use the
lsmblob instead of a u32. The scaffolding function lsmblob_init()
fills the blob with the value of the old secid, ensuring that
it is available to the appropriate module hook. The sources of
the secid, security_task_getsecid() and security_inode_getsecid(),
will be converted to use the blob structure later in the series.
At the point the use of lsmblob_init() is dropped.

Reviewed-by: Kees Cook <keescook@chromium.org>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Acked-by: Stephen Smalley <sds@tycho.nsa.gov>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: Andrea Righi <andrea.righi@canonical.com>
[ saf: resolve conflicts ]
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/include/linux/security.h b/include/linux/security.h
index 50f0328989d3f7d26bf6ad11b981385f95291671..00267626df9cc46da23553de9feb3814b3fc5c1f 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1941,7 +1941,8 @@ static inline int security_key_getsecurity(struct key *key, char **_buffer)
 #ifdef CONFIG_SECURITY
 int security_audit_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule);
 int security_audit_rule_known(struct audit_krule *krule);
-int security_audit_rule_match(u32 secid, u32 field, u32 op, void **lsmrule);
+int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
+                             void **lsmrule);
 void security_audit_rule_free(void **lsmrule);
 
 #else
@@ -1957,8 +1958,8 @@ static inline int security_audit_rule_known(struct audit_krule *krule)
        return 0;
 }
 
-static inline int security_audit_rule_match(u32 secid, u32 field, u32 op,
-                                           void **lsmrule)
+static inline int security_audit_rule_match(struct lsmblob *blob, u32 field,
+                                           u32 op, void **lsmrule)
 {
        return 0;
 }

diff --git a/kernel/auditfilter.c b/kernel/auditfilter.c
index a2340e81cfa747a684d4cb39f9fa9b02a33e74c9..6a04d762d2726dffc144c102588f12e286489eed 100644 (file)
--- a/kernel/auditfilter.c
+++ b/kernel/auditfilter.c
@@ -1331,6 +1331,7 @@ int audit_filter(int msgtype, unsigned int listtype)
                        struct audit_field *f = &e->rule.fields[i];
                        pid_t pid;
                        u32 sid;
+                       struct lsmblob blob;
 
                        switch (f->type) {
                        case AUDIT_PID:
@@ -1362,8 +1363,9 @@ int audit_filter(int msgtype, unsigned int listtype)
                                if (f->lsm_isset) {
                                        security_task_getsecid_subj(current,
                                                                    &sid);
-                                       result = security_audit_rule_match(sid,
-                                                  f->type, f->op,
+                                       lsmblob_init(&blob, sid);
+                                       result = security_audit_rule_match(
+                                                  &blob, f->type, f->op,
                                                   f->lsm_rules);
                                }
                                break;

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 3e2c2e3747a329f8c242b583a16bc451c9406bfe..1f9056f17dee837e30af0639fd78e8d1c2fea7c7 100644 (file)
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -478,6 +478,7 @@ static int audit_filter_rules(struct task_struct *tsk,
        const struct cred *cred;
        int i, need_sid = 1;
        u32 sid;
+       struct lsmblob blob;
        unsigned int sessionid;
 
        cred = rcu_dereference_check(tsk->cred, tsk == current || task_creation);
@@ -676,7 +677,9 @@ static int audit_filter_rules(struct task_struct *tsk,
                                        security_task_getsecid_subj(tsk, &sid);
                                        need_sid = 0;
                                }
-                               result = security_audit_rule_match(sid, f->type,
+                               lsmblob_init(&blob, sid);
+                               result = security_audit_rule_match(&blob,
+                                                                  f->type,
                                                                   f->op,
                                                                   f->lsm_rules);
                        }
@@ -691,15 +694,17 @@ static int audit_filter_rules(struct task_struct *tsk,
                        if (f->lsm_isset) {
                                /* Find files that match */
                                if (name) {
+                                       lsmblob_init(&blob, name->osid);
                                        result = security_audit_rule_match(
-                                                               name->osid,
+                                                               &blob,
                                                                f->type,
                                                                f->op,
                                                                f->lsm_rules);
                                } else if (ctx) {
                                        list_for_each_entry(n, &ctx->names_list, list) {
+                                               lsmblob_init(&blob, name->osid);
                                                if (security_audit_rule_match(
-                                                               n->osid,
+                                                               &blob,
                                                                f->type,
                                                                f->op,
                                                                f->lsm_rules)) {
@@ -711,7 +716,8 @@ static int audit_filter_rules(struct task_struct *tsk,
                                /* Find ipc objects that match */
                                if (!ctx || ctx->type != AUDIT_IPC)
                                        break;
-                               if (security_audit_rule_match(ctx->ipc.osid,
+                               lsmblob_init(&blob, ctx->ipc.osid);
+                               if (security_audit_rule_match(&blob,
                                                              f->type, f->op,
                                                              f->lsm_rules))
                                        ++result;

diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index be965a8715e4e2404120b408ab168fc17a81a5a0..6c2e35375dc8a411d29d46c12fbe45e91ef3bbab 100644 (file)
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -437,7 +437,7 @@ static inline void ima_filter_rule_free(void *lsmrule)
 {
 }
 
-static inline int ima_filter_rule_match(u32 secid, u32 field, u32 op,
+static inline int ima_filter_rule_match(strcut lsmblob *blob, u32 field, u32 op,
                                        void *lsmrule)
 {
        return -EINVAL;

diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index d85f2cf48e2c9fb694d2ec47ac1b5810cb87a060..918ac2959dfaa1be3eb86b43ac81c3c421a9485c 100644 (file)
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -607,6 +607,7 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
        for (i = 0; i < MAX_LSM_RULES; i++) {
                int rc = 0;
                u32 osid;
+               struct lsmblob lsmdata;
 
                if (!ima_lsm_isset(rule->lsm[i].rules)) {
                        if (!rule->lsm[i].args_p)
@@ -619,14 +620,16 @@ static bool ima_match_rules(struct ima_rule_entry *rule,
                case LSM_OBJ_ROLE:
                case LSM_OBJ_TYPE:
                        security_inode_getsecid(inode, &osid);
-                       rc = ima_filter_rule_match(osid, rule->lsm[i].type,
+                       lsmblob_init(&lsmdata, osid);
+                       rc = ima_filter_rule_match(&lsmdata, rule->lsm[i].type,
                                                   Audit_equal,
                                                   rule->lsm[i].rules);
                        break;
                case LSM_SUBJ_USER:
                case LSM_SUBJ_ROLE:
                case LSM_SUBJ_TYPE:
-                       rc = ima_filter_rule_match(secid, rule->lsm[i].type,
+                       lsmblob_init(&lsmdata, secid);
+                       rc = ima_filter_rule_match(&lsmdata, rule->lsm[i].type,
                                                   Audit_equal,
                                                   rule->lsm[i].rules);
                        break;

diff --git a/security/security.c b/security/security.c
index de841cfe99bfab371c549592fe9cf194b29c15a3..673dd6536ce7bdb1cebaf24cf9ea792e079d49f8 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -2629,11 +2629,14 @@ void security_audit_rule_free(void **lsmrule)
        hlist_for_each_entry(hp, &security_hook_heads.audit_rule_free, list) {
                if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot))
                        continue;
+               if (lsmrule[hp->lsmid->slot] == NULL)
+                       continue;
                hp->hook.audit_rule_free(lsmrule[hp->lsmid->slot]);
        }
 }
 
-int security_audit_rule_match(u32 secid, u32 field, u32 op, void **lsmrule)
+int security_audit_rule_match(struct lsmblob *blob, u32 field, u32 op,
+                             void **lsmrule)
 {
        struct security_hook_list *hp;
        int rc;
@@ -2641,7 +2644,10 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void **lsmrule)
        hlist_for_each_entry(hp, &security_hook_heads.audit_rule_match, list) {
                if (WARN_ON(hp->lsmid->slot < 0 || hp->lsmid->slot >= lsm_slot))
                        continue;
-               rc = hp->hook.audit_rule_match(secid, field, op,
+               if (lsmrule[hp->lsmid->slot] == NULL)
+                       continue;
+               rc = hp->hook.audit_rule_match(blob->secid[hp->lsmid->slot],
+                                              field, op,
                                               &lsmrule[hp->lsmid->slot]);
                if (rc)
                        return rc;