History

[PATCH] selinux: add hooks for key subsystem

Introduce SELinux hooks to support the access key retention subsystem within the kernel. Incorporate new flask headers from a modified version of the SELinux reference policy, with support for the new security class representing retained keys. Extend the "key_alloc" security hook with a task parameter representing the intended ownership context for the key being allocated. Attach security information to root's default keyrings within the SELinux initialization routine. Has passed David's testsuite.

Michael LeMay committed 20 years ago

Commit d7200241 parent f893afb16 files · +155 −27Browse files

Showing the changes to security/keys/process_keys.c (1 of 16 files). Show all

Unified · Split

security/keys/process_keys.c+8−7
@@ -67,7 +67,8 @@ struct key root_session_keyring = { · 66 unmodified lines
67/*67/*
68 * allocate the keyrings to be associated with a UID68 * allocate the keyrings to be associated with a UID
69 */69 */
70int alloc_uid_keyring(struct user_struct *user)70int alloc_uid_keyring(struct user_struct *user,
71 struct task_struct *ctx)
71{72{
72 struct key *uid_keyring, *session_keyring;73 struct key *uid_keyring, *session_keyring;
73 char buf[20];74 char buf[20];
@@ -76,7 +77,7 @@ int alloc_uid_keyring(struct user_struct *user) · 2 unmodified lines
76 /* concoct a default session keyring */77 /* concoct a default session keyring */
77 sprintf(buf, "_uid_ses.%u", user->uid);78 sprintf(buf, "_uid_ses.%u", user->uid);
78 79
79 session_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, 0, NULL);80 session_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, ctx, 0, NULL);
80 if (IS_ERR(session_keyring)) {81 if (IS_ERR(session_keyring)) {
81 ret = PTR_ERR(session_keyring);82 ret = PTR_ERR(session_keyring);
82 goto error;83 goto error;
@@ -86,7 +87,7 @@ int alloc_uid_keyring(struct user_struct *user) · 3 unmodified lines
86 * keyring */87 * keyring */
87 sprintf(buf, "_uid.%u", user->uid);88 sprintf(buf, "_uid.%u", user->uid);
88 89
89 uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, 0,90 uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, ctx, 0,
90 session_keyring);91 session_keyring);
91 if (IS_ERR(uid_keyring)) {92 if (IS_ERR(uid_keyring)) {
92 key_put(session_keyring);93 key_put(session_keyring);
@@ -143,7 +144,7 @@ int install_thread_keyring(struct task_struct *tsk) · 50 unmodified lines
143 144
144 sprintf(buf, "_tid.%u", tsk->pid);145 sprintf(buf, "_tid.%u", tsk->pid);
145 146
146 keyring = keyring_alloc(buf, tsk->uid, tsk->gid, 1, NULL);147 keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk, 1, NULL);
147 if (IS_ERR(keyring)) {148 if (IS_ERR(keyring)) {
148 ret = PTR_ERR(keyring);149 ret = PTR_ERR(keyring);
149 goto error;150 goto error;
@@ -177,7 +178,7 @@ int install_process_keyring(struct task_struct *tsk) · 27 unmodified lines
177 if (!tsk->signal->process_keyring) {178 if (!tsk->signal->process_keyring) {
178 sprintf(buf, "_pid.%u", tsk->tgid);179 sprintf(buf, "_pid.%u", tsk->tgid);
179 180
180 keyring = keyring_alloc(buf, tsk->uid, tsk->gid, 1, NULL);181 keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk, 1, NULL);
181 if (IS_ERR(keyring)) {182 if (IS_ERR(keyring)) {
182 ret = PTR_ERR(keyring);183 ret = PTR_ERR(keyring);
183 goto error;184 goto error;
@@ -217,7 +218,7 @@ static int install_session_keyring(struct task_struct *tsk, · 33 unmodified lines
217 if (!keyring) {218 if (!keyring) {
218 sprintf(buf, "_ses.%u", tsk->tgid);219 sprintf(buf, "_ses.%u", tsk->tgid);
219 220
220 keyring = keyring_alloc(buf, tsk->uid, tsk->gid, 1, NULL);221 keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk, 1, NULL);
221 if (IS_ERR(keyring))222 if (IS_ERR(keyring))
222 return PTR_ERR(keyring);223 return PTR_ERR(keyring);
223 }224 }
@@ -717,7 +718,7 @@ long join_session_keyring(const char *name) · 493 unmodified lines
717 keyring = find_keyring_by_name(name, 0);718 keyring = find_keyring_by_name(name, 0);
718 if (PTR_ERR(keyring) == -ENOKEY) {719 if (PTR_ERR(keyring) == -ENOKEY) {
719 /* not found - try and create a new one */720 /* not found - try and create a new one */
720 keyring = keyring_alloc(name, tsk->uid, tsk->gid, 0, NULL);721 keyring = keyring_alloc(name, tsk->uid, tsk->gid, tsk, 0, NULL);
721 if (IS_ERR(keyring)) {722 if (IS_ERR(keyring)) {
722 ret = PTR_ERR(keyring);723 ret = PTR_ERR(keyring);
723 goto error2;724 goto error2;