UBUNTU: SAUCE: LSM stacking: add /proc/<pid>/attr/display_lsm

Add /proc/<pid>/attr/display_lsm so that scripts can easily introspect
the display lsm of a give task.

Signed-off-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Seth Forshee <seth.forshee@canonical.com>

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 92f5e201c298616d6a2cd83c09d55ad975963d61..84ab5c4dd250dcaaadf33bc8a9aa8ee7df0e2daf 100644 (file)
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -2638,6 +2638,8 @@ static const struct pid_entry attr_dir_stuff[] = {
        ATTR(NULL, "keycreate",         0666),
        ATTR(NULL, "sockcreate",        0666),
        ATTR(NULL, "context",           0666),
+       ATTR(NULL, "display_lsm",       0666),
+
 #ifdef CONFIG_SECURITY_SELINUX
        DIR("selinux",                  0555,
            proc_selinux_attr_dir_inode_ops, proc_selinux_attr_dir_ops),

diff --git a/security/security.c b/security/security.c
index 96504c4477ba909ba31ef6108a2669c0446a0e73..17feb81e5089d8d1157edd0dd65759bf780ab0ca 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -1678,6 +1678,33 @@ int security_task_kill(struct task_struct *p, struct siginfo *info,
 static char *nolsm = "-default";
 #define NOLSMLEN       9
 
+static bool is_registered_lsm(const char *str, size_t size)
+{
+       struct security_hook_list *hp;
+
+       list_for_each_entry(hp, &security_hook_heads.getprocattr, list) {
+               if (size == strlen(hp->lsm) && !strncmp(str, hp->lsm, size))
+                       return true;
+       }
+
+       return false;
+}
+
+static bool set_lsm_of_current(const char *str, size_t size)
+{
+       char *lsm = lsm_of_task(current);
+
+       if (is_registered_lsm(str, size)) {
+               strncpy(lsm, str, size);
+               lsm[size] = '\0';
+       } else if (size == NOLSMLEN && !strncmp(str, nolsm, size)) {
+               lsm[0] = '\0';
+       } else {
+               return false;
+       }
+       return true;
+}
+
 static int lsm_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                                unsigned long arg4, unsigned long arg5)
 {
@@ -1685,7 +1712,6 @@ static int lsm_task_prctl(int option, unsigned long arg2, unsigned long arg3,
        char buffer[SECURITY_NAME_MAX + 1];
        __user char *optval = (__user char *)arg2;
        __user int *optlen = (__user int *)arg3;
-       struct security_hook_list *hp;
        int dlen;
        int len;
 
@@ -1712,21 +1738,12 @@ static int lsm_task_prctl(int option, unsigned long arg2, unsigned long arg3,
                        return -EFAULT;
                buffer[len] = '\0';
                /* verify the requested LSM is registered */
-               list_for_each_entry(hp, &security_hook_heads.getprocattr, list) {
-                       if (!strcmp(buffer, hp->lsm)) {
-                               strcpy(lsm, hp->lsm);
-                               goto out;
-                       }
-               }
-               if (!strncmp(buffer, nolsm, NOLSMLEN))
-                       lsm[0] = '\0';
-               else
+               if (!set_lsm_of_current(buffer, len))
                        return -ENOENT;
                break;
        default:
                return -ENOSYS;
        }
-out:
        return 0;
 }
 #endif
@@ -1950,6 +1967,11 @@ int security_getprocattr(struct task_struct *p, const char *lsm, char *name,
                if (rc > 0)
                        return strlen(*value);
                return rc;
+       } else if (strcmp(name, "display_lsm") == 0) {
+               *value = kstrdup(current->security, GFP_KERNEL);
+               if (*value == NULL)
+                       return -ENOMEM;
+               return strlen(*value);
        }
 
        list_for_each_entry(hp, &security_hook_heads.getprocattr, list) {
@@ -2052,6 +2074,12 @@ free_out:
                if (rc >= 0)
                        return size;
                return rc;
+       } else if (strcmp(name, "display_lsm") == 0) {
+#ifdef CONFIG_SECURITY_STACKING
+               if (set_lsm_of_current(value, size))
+                       return size;
+#endif
+               return -EINVAL;
        }
 
        list_for_each_entry(hp, &security_hook_heads.setprocattr, list) {