History

security: Add hooks to rule on setting a watch

Add security hooks that will allow an LSM to rule on whether or not a watch may be set. More than one hook is required as the watches watch different types of object.

David Howells committed 6 years ago

Commit 998f5041 parent c73be614 files · +25 −0Browse files

Unified · Split

4 files
  1. include/linux/lsm_hook_defs.h +4 −0
  2. include/linux/lsm_hooks.h +5 −0
  3. include/linux/security.h +9 −0
  4. security/security.c +7 −0
include/linux/lsm_hook_defs.h+4−0
@@ -256,6 +256,10 @@ LSM_HOOK(int, 0, inode_getsecctx, struct inode *inode, void **ctx, · 255 unmodified lines
256#if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)256#if defined(CONFIG_SECURITY) && defined(CONFIG_WATCH_QUEUE)
257LSM_HOOK(int, 0, post_notification, const struct cred *w_cred,257LSM_HOOK(int, 0, post_notification, const struct cred *w_cred,
258 const struct cred *cred, struct watch_notification *n)258 const struct cred *cred, struct watch_notification *n)
259#endif /* CONFIG_SECURITY && CONFIG_WATCH_QUEUE */
260
261#if defined(CONFIG_SECURITY) && defined(CONFIG_KEY_NOTIFICATIONS)
262LSM_HOOK(int, 0, watch_key, struct key *key)
259#endif /* CONFIG_SECURITY && CONFIG_KEY_NOTIFICATIONS */263#endif /* CONFIG_SECURITY && CONFIG_KEY_NOTIFICATIONS */
260 264
261#ifdef CONFIG_SECURITY_NETWORK265#ifdef CONFIG_SECURITY_NETWORK
include/linux/lsm_hooks.h+5−0
@@ -1446,6 +1446,11 @@ · 1445 unmodified lines
1446 * @cred: The event-triggerer's credentials1446 * @cred: The event-triggerer's credentials
1447 * @n: The notification being posted1447 * @n: The notification being posted
1448 *1448 *
1449 * @watch_key:
1450 * Check to see if a process is allowed to watch for event notifications
1451 * from a key or keyring.
1452 * @key: The key to watch.
1453 *
1449 * Security hooks for using the eBPF maps and programs functionalities through1454 * Security hooks for using the eBPF maps and programs functionalities through
1450 * eBPF syscalls.1455 * eBPF syscalls.
1451 *1456 *
include/linux/security.h+9−0
@@ -1290,6 +1290,15 @@ static inline int security_post_notification(const struct cred *w_cred, · 1289 unmodified lines
1290}1290}
1291#endif1291#endif
1292 1292
1293#if defined(CONFIG_SECURITY) && defined(CONFIG_KEY_NOTIFICATIONS)
1294int security_watch_key(struct key *key);
1295#else
1296static inline int security_watch_key(struct key *key)
1297{
1298 return 0;
1299}
1300#endif
1301
1293#ifdef CONFIG_SECURITY_NETWORK1302#ifdef CONFIG_SECURITY_NETWORK
1294 1303
1295int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);1304int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk);
security/security.c+7−0
@@ -2016,6 +2016,13 @@ int security_post_notification(const struct cred *w_cred, · 2015 unmodified lines
2016}2016}
2017#endif /* CONFIG_WATCH_QUEUE */2017#endif /* CONFIG_WATCH_QUEUE */
2018 2018
2019#ifdef CONFIG_KEY_NOTIFICATIONS
2020int security_watch_key(struct key *key)
2021{
2022 return call_int_hook(watch_key, 0, key);
2023}
2024#endif
2025
2019#ifdef CONFIG_SECURITY_NETWORK2026#ifdef CONFIG_SECURITY_NETWORK
2020 2027
2021int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)2028int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)