History

[PATCH] selinux: add hooks for key subsystem

Introduce SELinux hooks to support the access key retention subsystem within the kernel. Incorporate new flask headers from a modified version of the SELinux reference policy, with support for the new security class representing retained keys. Extend the "key_alloc" security hook with a task parameter representing the intended ownership context for the key being allocated. Attach security information to root's default keyrings within the SELinux initialization routine. Has passed David's testsuite.

Michael LeMay committed 20 years ago

Commit d7200241 parent f893afb16 files · +155 −27Browse files

Showing the changes to security/selinux/include (5 of 16 files). Show all

Unified · Split

5 files
  1. security/selinux/include/av_perm_to_string.h +6 −0
  2. security/selinux/include/av_permissions.h +8 −0
  3. security/selinux/include/class_to_string.h +1 −0
  4. security/selinux/include/flask.h +1 −0
  5. security/selinux/include/objsec.h +5 −0
security/selinux/include/av_perm_to_string.h+6−0
@@ -242,3 +242,9 @@ · 241 unmodified lines
242 S_(SECCLASS_PACKET, PACKET__SEND, "send")242 S_(SECCLASS_PACKET, PACKET__SEND, "send")
243 S_(SECCLASS_PACKET, PACKET__RECV, "recv")243 S_(SECCLASS_PACKET, PACKET__RECV, "recv")
244 S_(SECCLASS_PACKET, PACKET__RELABELTO, "relabelto")244 S_(SECCLASS_PACKET, PACKET__RELABELTO, "relabelto")
245 S_(SECCLASS_KEY, KEY__VIEW, "view")
246 S_(SECCLASS_KEY, KEY__READ, "read")
247 S_(SECCLASS_KEY, KEY__WRITE, "write")
248 S_(SECCLASS_KEY, KEY__SEARCH, "search")
249 S_(SECCLASS_KEY, KEY__LINK, "link")
250 S_(SECCLASS_KEY, KEY__SETATTR, "setattr")
security/selinux/include/av_permissions.h+8−0
@@ -959,3 +959,11 @@ · 958 unmodified lines
959#define PACKET__SEND 0x00000001UL959#define PACKET__SEND 0x00000001UL
960#define PACKET__RECV 0x00000002UL960#define PACKET__RECV 0x00000002UL
961#define PACKET__RELABELTO 0x00000004UL961#define PACKET__RELABELTO 0x00000004UL
962
963#define KEY__VIEW 0x00000001UL
964#define KEY__READ 0x00000002UL
965#define KEY__WRITE 0x00000004UL
966#define KEY__SEARCH 0x00000008UL
967#define KEY__LINK 0x00000010UL
968#define KEY__SETATTR 0x00000020UL
969
security/selinux/include/class_to_string.h+1−0
@@ -60,3 +60,4 @@ · 59 unmodified lines
60 S_("netlink_kobject_uevent_socket")60 S_("netlink_kobject_uevent_socket")
61 S_("appletalk_socket")61 S_("appletalk_socket")
62 S_("packet")62 S_("packet")
63 S_("key")
security/selinux/include/flask.h+1−0
@@ -62,6 +62,7 @@ · 61 unmodified lines
62#define SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET 5562#define SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET 55
63#define SECCLASS_APPLETALK_SOCKET 5663#define SECCLASS_APPLETALK_SOCKET 56
64#define SECCLASS_PACKET 5764#define SECCLASS_PACKET 57
65#define SECCLASS_KEY 58
65 66
66/*67/*
67 * Security identifier indices for initial entities68 * Security identifier indices for initial entities
security/selinux/include/objsec.h+5−0
@@ -99,6 +99,11 @@ struct sk_security_struct { · 98 unmodified lines
99 u32 peer_sid; /* SID of peer */99 u32 peer_sid; /* SID of peer */
100};100};
101 101
102struct key_security_struct {
103 struct key *obj; /* back pointer */
104 u32 sid; /* SID of key */
105};
106
102extern unsigned int selinux_checkreqprot;107extern unsigned int selinux_checkreqprot;
103 108
104#endif /* _SELINUX_OBJSEC_H_ */109#endif /* _SELINUX_OBJSEC_H_ */