forked from torvalds/linux
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
LSM: syscalls for current process attributes
Create a system call lsm_get_self_attr() to provide the security module maintained attributes of the current process. Create a system call lsm_set_self_attr() to set a security module maintained attribute of the current process. Historically these attributes have been exposed to user space via entries in procfs under /proc/self/attr. The attribute value is provided in a lsm_ctx structure. The structure identifys the size of the attribute, and the attribute value. The format of the attribute value is defined by the security module. A flags field is included for LSM specific information. It is currently unused and must be 0. The total size of the data, including the lsm_ctx structure and any padding, is maintained as well. struct lsm_ctx { __u64 id; __u64 flags; __u64 len; __u64 ctx_len; __u8 ctx[]; }; Two new LSM hooks are used to interface with the LSMs. security_getselfattr() collects the lsm_ctx values from the LSMs that support the hook, accounting for space requirements. security_setselfattr() identifies which LSM the attribute is intended for and passes it along. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
- Loading branch information
1 parent
e14c8e7
commit 0883a93
Showing
10 changed files
with
242 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,55 @@ | ||
// SPDX-License-Identifier: GPL-2.0-only | ||
/* | ||
* System calls implementing the Linux Security Module API. | ||
* | ||
* Copyright (C) 2022 Casey Schaufler <casey@schaufler-ca.com> | ||
* Copyright (C) 2022 Intel Corporation | ||
*/ | ||
|
||
#include <asm/current.h> | ||
#include <linux/compiler_types.h> | ||
#include <linux/err.h> | ||
#include <linux/errno.h> | ||
#include <linux/security.h> | ||
#include <linux/stddef.h> | ||
#include <linux/syscalls.h> | ||
#include <linux/types.h> | ||
#include <linux/lsm_hooks.h> | ||
#include <uapi/linux/lsm.h> | ||
|
||
/** | ||
* sys_lsm_set_self_attr - Set current task's security module attribute | ||
* @attr: which attribute to set | ||
* @ctx: the LSM contexts | ||
* @size: size of @ctx | ||
* @flags: reserved for future use | ||
* | ||
* Sets the calling task's LSM context. On success this function | ||
* returns 0. If the attribute specified cannot be set a negative | ||
* value indicating the reason for the error is returned. | ||
*/ | ||
SYSCALL_DEFINE4(lsm_set_self_attr, unsigned int, attr, struct lsm_ctx __user *, | ||
ctx, size_t __user, size, u32, flags) | ||
{ | ||
return security_setselfattr(attr, ctx, size, flags); | ||
} | ||
|
||
/** | ||
* sys_lsm_get_self_attr - Return current task's security module attributes | ||
* @attr: which attribute to set | ||
* @ctx: the LSM contexts | ||
* @size: size of @ctx, updated on return | ||
* @flags: reserved for future use | ||
* | ||
* Returns the calling task's LSM contexts. On success this | ||
* function returns the number of @ctx array elements. This value | ||
* may be zero if there are no LSM contexts assigned. If @size is | ||
* insufficient to contain the return data -E2BIG is returned and | ||
* @size is set to the minimum required size. In all other cases | ||
* a negative value indicating the error is returned. | ||
*/ | ||
SYSCALL_DEFINE4(lsm_get_self_attr, unsigned int, attr, struct lsm_ctx __user *, | ||
ctx, size_t __user *, size, u32, flags) | ||
{ | ||
return security_getselfattr(attr, ctx, size, flags); | ||
} |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters