Commit e4e55b47 authored by Tetsuo Handa's avatar Tetsuo Handa Committed by James Morris

LSM: Revive security_task_alloc() hook and per "struct task_struct" security blob.

We switched from "struct task_struct"->security to "struct cred"->security
in Linux 2.6.29. But not all LSM modules were happy with that change.
TOMOYO LSM module is an example which want to use per "struct task_struct"
security blob, for TOMOYO's security context is defined based on "struct
task_struct" rather than "struct cred". AppArmor LSM module is another
example which want to use it, for AppArmor is currently abusing the cred
a little bit to store the change_hat and setexeccon info. Although
security_task_free() hook was revived in Linux 3.4 because Yama LSM module
wanted to release per "struct task_struct" security blob,
security_task_alloc() hook and "struct task_struct"->security field were
not revived. Nowadays, we are getting proposals of lightweight LSM modules
which want to use per "struct task_struct" security blob.

We are already allowing multiple concurrent LSM modules (up to one fully
armored module which uses "struct cred"->security field or exclusive hooks
like security_xfrm_state_pol_flow_match(), plus unlimited number of
lightweight modules which do not use "struct cred"->security nor exclusive
hooks) as long as they are built into the kernel. But this patch does not
implement variable length "struct task_struct"->security field which will
become needed when multiple LSM modules want to use "struct task_struct"->
security field. Although it won't be difficult to implement variable length
"struct task_struct"->security field, let's think about it after we merged
this patch.
Signed-off-by: default avatarTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Acked-by: default avatarJohn Johansen <john.johansen@canonical.com>
Acked-by: default avatarSerge Hallyn <serge@hallyn.com>
Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Tested-by: default avatarDjalal Harouni <tixxdz@gmail.com>
Acked-by: default avatarJosé Bollo <jobol@nonadev.net>
Cc: Paul Moore <paul@paul-moore.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: Eric Paris <eparis@parisplace.org>
Cc: Kees Cook <keescook@chromium.org>
Cc: James Morris <james.l.morris@oracle.com>
Cc: José Bollo <jobol@nonadev.net>
Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
parent 840c91dc
...@@ -210,6 +210,12 @@ extern struct cred init_cred; ...@@ -210,6 +210,12 @@ extern struct cred init_cred;
# define INIT_TASK_TI(tsk) # define INIT_TASK_TI(tsk)
#endif #endif
#ifdef CONFIG_SECURITY
#define INIT_TASK_SECURITY .security = NULL,
#else
#define INIT_TASK_SECURITY
#endif
/* /*
* INIT_TASK is used to set up the first task table, touch at * INIT_TASK is used to set up the first task table, touch at
* your own risk!. Base=0, limit=0x1fffff (=2MB) * your own risk!. Base=0, limit=0x1fffff (=2MB)
...@@ -288,6 +294,7 @@ extern struct cred init_cred; ...@@ -288,6 +294,7 @@ extern struct cred init_cred;
INIT_VTIME(tsk) \ INIT_VTIME(tsk) \
INIT_NUMA_BALANCING(tsk) \ INIT_NUMA_BALANCING(tsk) \
INIT_KASAN(tsk) \ INIT_KASAN(tsk) \
INIT_TASK_SECURITY \
} }
......
...@@ -533,8 +533,13 @@ ...@@ -533,8 +533,13 @@
* manual page for definitions of the @clone_flags. * manual page for definitions of the @clone_flags.
* @clone_flags contains the flags indicating what should be shared. * @clone_flags contains the flags indicating what should be shared.
* Return 0 if permission is granted. * Return 0 if permission is granted.
* @task_alloc:
* @task task being allocated.
* @clone_flags contains the flags indicating what should be shared.
* Handle allocation of task-related resources.
* Returns a zero on success, negative values on failure.
* @task_free: * @task_free:
* @task task being freed * @task task about to be freed.
* Handle release of task-related resources. (Note that this can be called * Handle release of task-related resources. (Note that this can be called
* from interrupt context.) * from interrupt context.)
* @cred_alloc_blank: * @cred_alloc_blank:
...@@ -1482,6 +1487,7 @@ union security_list_options { ...@@ -1482,6 +1487,7 @@ union security_list_options {
int (*file_open)(struct file *file, const struct cred *cred); int (*file_open)(struct file *file, const struct cred *cred);
int (*task_create)(unsigned long clone_flags); int (*task_create)(unsigned long clone_flags);
int (*task_alloc)(struct task_struct *task, unsigned long clone_flags);
void (*task_free)(struct task_struct *task); void (*task_free)(struct task_struct *task);
int (*cred_alloc_blank)(struct cred *cred, gfp_t gfp); int (*cred_alloc_blank)(struct cred *cred, gfp_t gfp);
void (*cred_free)(struct cred *cred); void (*cred_free)(struct cred *cred);
...@@ -1748,6 +1754,7 @@ struct security_hook_heads { ...@@ -1748,6 +1754,7 @@ struct security_hook_heads {
struct list_head file_receive; struct list_head file_receive;
struct list_head file_open; struct list_head file_open;
struct list_head task_create; struct list_head task_create;
struct list_head task_alloc;
struct list_head task_free; struct list_head task_free;
struct list_head cred_alloc_blank; struct list_head cred_alloc_blank;
struct list_head cred_free; struct list_head cred_free;
......
...@@ -1037,6 +1037,10 @@ struct task_struct { ...@@ -1037,6 +1037,10 @@ struct task_struct {
#ifdef CONFIG_THREAD_INFO_IN_TASK #ifdef CONFIG_THREAD_INFO_IN_TASK
/* A live task holds one reference: */ /* A live task holds one reference: */
atomic_t stack_refcount; atomic_t stack_refcount;
#endif
#ifdef CONFIG_SECURITY
/* Used by LSM modules for access restriction: */
void *security;
#endif #endif
/* CPU-specific state of this task: */ /* CPU-specific state of this task: */
struct thread_struct thread; struct thread_struct thread;
......
...@@ -308,6 +308,7 @@ int security_file_send_sigiotask(struct task_struct *tsk, ...@@ -308,6 +308,7 @@ int security_file_send_sigiotask(struct task_struct *tsk,
int security_file_receive(struct file *file); int security_file_receive(struct file *file);
int security_file_open(struct file *file, const struct cred *cred); int security_file_open(struct file *file, const struct cred *cred);
int security_task_create(unsigned long clone_flags); int security_task_create(unsigned long clone_flags);
int security_task_alloc(struct task_struct *task, unsigned long clone_flags);
void security_task_free(struct task_struct *task); void security_task_free(struct task_struct *task);
int security_cred_alloc_blank(struct cred *cred, gfp_t gfp); int security_cred_alloc_blank(struct cred *cred, gfp_t gfp);
void security_cred_free(struct cred *cred); void security_cred_free(struct cred *cred);
...@@ -861,6 +862,12 @@ static inline int security_task_create(unsigned long clone_flags) ...@@ -861,6 +862,12 @@ static inline int security_task_create(unsigned long clone_flags)
return 0; return 0;
} }
static inline int security_task_alloc(struct task_struct *task,
unsigned long clone_flags)
{
return 0;
}
static inline void security_task_free(struct task_struct *task) static inline void security_task_free(struct task_struct *task)
{ } { }
......
...@@ -1679,9 +1679,12 @@ static __latent_entropy struct task_struct *copy_process( ...@@ -1679,9 +1679,12 @@ static __latent_entropy struct task_struct *copy_process(
goto bad_fork_cleanup_perf; goto bad_fork_cleanup_perf;
/* copy all the process information */ /* copy all the process information */
shm_init_task(p); shm_init_task(p);
retval = copy_semundo(clone_flags, p); retval = security_task_alloc(p, clone_flags);
if (retval) if (retval)
goto bad_fork_cleanup_audit; goto bad_fork_cleanup_audit;
retval = copy_semundo(clone_flags, p);
if (retval)
goto bad_fork_cleanup_security;
retval = copy_files(clone_flags, p); retval = copy_files(clone_flags, p);
if (retval) if (retval)
goto bad_fork_cleanup_semundo; goto bad_fork_cleanup_semundo;
...@@ -1903,6 +1906,8 @@ static __latent_entropy struct task_struct *copy_process( ...@@ -1903,6 +1906,8 @@ static __latent_entropy struct task_struct *copy_process(
exit_files(p); /* blocking */ exit_files(p); /* blocking */
bad_fork_cleanup_semundo: bad_fork_cleanup_semundo:
exit_sem(p); exit_sem(p);
bad_fork_cleanup_security:
security_task_free(p);
bad_fork_cleanup_audit: bad_fork_cleanup_audit:
audit_free(p); audit_free(p);
bad_fork_cleanup_perf: bad_fork_cleanup_perf:
......
...@@ -937,6 +937,11 @@ int security_task_create(unsigned long clone_flags) ...@@ -937,6 +937,11 @@ int security_task_create(unsigned long clone_flags)
return call_int_hook(task_create, 0, clone_flags); return call_int_hook(task_create, 0, clone_flags);
} }
int security_task_alloc(struct task_struct *task, unsigned long clone_flags)
{
return call_int_hook(task_alloc, 0, task, clone_flags);
}
void security_task_free(struct task_struct *task) void security_task_free(struct task_struct *task)
{ {
call_void_hook(task_free, task); call_void_hook(task_free, task);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment