History

[PATCH] selinux: add hooks for key subsystem

Introduce SELinux hooks to support the access key retention subsystem within the kernel. Incorporate new flask headers from a modified version of the SELinux reference policy, with support for the new security class representing retained keys. Extend the "key_alloc" security hook with a task parameter representing the intended ownership context for the key being allocated. Attach security information to root's default keyrings within the SELinux initialization routine. Has passed David's testsuite.

Michael LeMay committed 20 years ago

Commit d7200241 parent f893afb16 files · +155 −27Browse files

Unified · Split

16 files
  1. Documentation/keys.txt +29 −0
  2. include/linux/key.h +13 −5
  3. include/linux/security.h +6 −4
  4. kernel/user.c +1 −1
  5. security/dummy.c +1 −1
  6. security/keys/key.c +4 −4
  7. security/keys/keyring.c +3 −2
  8. security/keys/process_keys.c +8 −7
  9. security/keys/request_key.c +4 −2
  10. security/keys/request_key_auth.c +1 −1
  11. security/selinux/hooks.c +64 −0
  12. security/selinux/include/av_perm_to_string.h +6 −0
  13. security/selinux/include/av_permissions.h +8 −0
  14. security/selinux/include/class_to_string.h +1 −0
  15. security/selinux/include/flask.h +1 −0
  16. security/selinux/include/objsec.h +5 −0
Documentation/keys.txt+29−0
@@ -19,6 +19,7 @@ This document has the following sections: · 18 unmodified lines
1919 - Key overview
2020 - Key service overview
2121 - Key access permissions
22+ - SELinux support
2223 - New procfs files
2324 - Userspace system call interface
2425 - Kernel services
@@ -232,6 +233,34 @@ For changing the ownership, group ID or permissions mask, being the owner of · 207 unmodified lines
232233 the key or having the sysadmin capability is sufficient.
233234
234235
236+===============
237+SELINUX SUPPORT
238+===============
239+
240+The security class "key" has been added to SELinux so that mandatory access
241+controls can be applied to keys created within various contexts. This support
242+is preliminary, and is likely to change quite significantly in the near future.
243+Currently, all of the basic permissions explained above are provided in SELinux
244+as well; SE Linux is simply invoked after all basic permission checks have been
245+performed.
246+
247+Each key is labeled with the same context as the task to which it belongs.
248+Typically, this is the same task that was running when the key was created.
249+The default keyrings are handled differently, but in a way that is very
250+intuitive:
251+
252+ (*) The user and user session keyrings that are created when the user logs in
253+ are currently labeled with the context of the login manager.
254+
255+ (*) The keyrings associated with new threads are each labeled with the context
256+ of their associated thread, and both session and process keyrings are
257+ handled similarly.
258+
259+Note, however, that the default keyrings associated with the root user are
260+labeled with the default kernel context, since they are created early in the
261+boot process, before root has a chance to log in.
262+
263+
235264 ================
236265 NEW PROCFS FILES
237266 ================
include/linux/key.h+13−5
@@ -241,8 +241,9 @@ extern void unregister_key_type(struct key_type *ktype); · 240 unmodified lines
241241
242242 extern struct key *key_alloc(struct key_type *type,
243243 const char *desc,
244− uid_t uid, gid_t gid, key_perm_t perm,
245− int not_in_quota);
244+ uid_t uid, gid_t gid,
245+ struct task_struct *ctx,
246+ key_perm_t perm, int not_in_quota);
246247 extern int key_payload_reserve(struct key *key, size_t datalen);
247248 extern int key_instantiate_and_link(struct key *key,
248249 const void *data,
@@ -292,7 +293,9 @@ extern int key_unlink(struct key *keyring, · 43 unmodified lines
292293 struct key *key);
293294
294295 extern struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
295− int not_in_quota, struct key *dest);
296+ struct task_struct *ctx,
297+ int not_in_quota,
298+ struct key *dest);
296299
297300 extern int keyring_clear(struct key *keyring);
298301
@@ -313,7 +316,8 @@ extern void keyring_replace_payload(struct key *key, void *replacement); · 14 unmodified lines
313316 * the userspace interface
314317 */
315318 extern struct key root_user_keyring, root_session_keyring;
316−extern int alloc_uid_keyring(struct user_struct *user);
319+extern int alloc_uid_keyring(struct user_struct *user,
320+ struct task_struct *ctx);
317321 extern void switch_uid_keyring(struct user_struct *new_user);
318322 extern int copy_keys(unsigned long clone_flags, struct task_struct *tsk);
319323 extern int copy_thread_group_keys(struct task_struct *tsk);
@@ -342,7 +346,7 @@ extern void key_init(void); · 22 unmodified lines
342346 #define make_key_ref(k) ({ NULL; })
343347 #define key_ref_to_ptr(k) ({ NULL; })
344348 #define is_key_possessed(k) 0
345−#define alloc_uid_keyring(u) 0
349+#define alloc_uid_keyring(u,c) 0
346350 #define switch_uid_keyring(u) do { } while(0)
347351 #define __install_session_keyring(t, k) ({ NULL; })
348352 #define copy_keys(f,t) 0
@@ -355,6 +359,10 @@ extern void key_init(void); · 6 unmodified lines
355359 #define key_fsgid_changed(t) do { } while(0)
356360 #define key_init() do { } while(0)
357361
362+/* Initial keyrings */
363+extern struct key root_user_keyring;
364+extern struct key root_session_keyring;
365+
358366 #endif /* CONFIG_KEYS */
359367 #endif /* __KERNEL__ */
360368 #endif /* _LINUX_KEY_H */
include/linux/security.h+6−4
@@ -1313,7 +1313,7 @@ struct security_operations { · 1312 unmodified lines
13131313
13141314 /* key management security hooks */
13151315 #ifdef CONFIG_KEYS
1316− int (*key_alloc)(struct key *key);
1316+ int (*key_alloc)(struct key *key, struct task_struct *tsk);
13171317 void (*key_free)(struct key *key);
13181318 int (*key_permission)(key_ref_t key_ref,
13191319 struct task_struct *context,
@@ -3008,9 +3008,10 @@ static inline int security_xfrm_policy_lookup(struct xfrm_policy *xp, u32 sk_sid · 1688 unmodified lines
30083008
30093009 #ifdef CONFIG_KEYS
30103010 #ifdef CONFIG_SECURITY
3011−static inline int security_key_alloc(struct key *key)
3011+static inline int security_key_alloc(struct key *key,
3012+ struct task_struct *tsk)
30123013 {
3013− return security_ops->key_alloc(key);
3014+ return security_ops->key_alloc(key, tsk);
30143015 }
30153016
30163017 static inline void security_key_free(struct key *key)
@@ -3027,7 +3028,8 @@ static inline int security_key_permission(key_ref_t key_ref, · 10 unmodified lines
30273028
30283029 #else
30293030
3030−static inline int security_key_alloc(struct key *key)
3031+static inline int security_key_alloc(struct key *key,
3032+ struct task_struct *tsk)
30313033 {
30323034 return 0;
30333035 }
kernel/user.c+1−1
@@ -148,7 +148,7 @@ struct user_struct * alloc_uid(uid_t uid) · 147 unmodified lines
148148 new->mq_bytes = 0;
149149 new->locked_shm = 0;
150150
151− if (alloc_uid_keyring(new) < 0) {
151+ if (alloc_uid_keyring(new, current) < 0) {
152152 kmem_cache_free(uid_cachep, new);
153153 return NULL;
154154 }
security/dummy.c+1−1
@@ -860,7 +860,7 @@ static int dummy_setprocattr(struct task_struct *p, char *name, void *value, siz · 859 unmodified lines
860860 }
861861
862862 #ifdef CONFIG_KEYS
863−static inline int dummy_key_alloc(struct key *key)
863+static inline int dummy_key_alloc(struct key *key, struct task_struct *ctx)
864864 {
865865 return 0;
866866 }
security/keys/key.c+4−4
@@ -247,8 +247,8 @@ static inline void key_alloc_serial(struct key *key) · 246 unmodified lines
247247 * instantiate the key or discard it before returning
248248 */
249249 struct key *key_alloc(struct key_type *type, const char *desc,
250− uid_t uid, gid_t gid, key_perm_t perm,
251− int not_in_quota)
250+ uid_t uid, gid_t gid, struct task_struct *ctx,
251+ key_perm_t perm, int not_in_quota)
252252 {
253253 struct key_user *user = NULL;
254254 struct key *key;
@@ -318,7 +318,7 @@ struct key *key_alloc(struct key_type *type, const char *desc, · 63 unmodified lines
318318 #endif
319319
320320 /* let the security module know about the key */
321− ret = security_key_alloc(key);
321+ ret = security_key_alloc(key, ctx);
322322 if (ret < 0)
323323 goto security_error;
324324
@@ -822,7 +822,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref, · 497 unmodified lines
822822
823823 /* allocate a new key */
824824 key = key_alloc(ktype, description, current->fsuid, current->fsgid,
825− perm, not_in_quota);
825+ current, perm, not_in_quota);
826826 if (IS_ERR(key)) {
827827 key_ref = ERR_PTR(PTR_ERR(key));
828828 goto error_3;
security/keys/keyring.c+3−2
@@ -240,13 +240,14 @@ static long keyring_read(const struct key *keyring, · 239 unmodified lines
240240 * allocate a keyring and link into the destination keyring
241241 */
242242 struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
243− int not_in_quota, struct key *dest)
243+ struct task_struct *ctx, int not_in_quota,
244+ struct key *dest)
244245 {
245246 struct key *keyring;
246247 int ret;
247248
248249 keyring = key_alloc(&key_type_keyring, description,
249− uid, gid,
250+ uid, gid, ctx,
250251 (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL,
251252 not_in_quota);
252253
security/keys/process_keys.c+8−7
@@ -67,7 +67,8 @@ struct key root_session_keyring = { · 66 unmodified lines
6767 /*
6868 * allocate the keyrings to be associated with a UID
6969 */
70−int alloc_uid_keyring(struct user_struct *user)
70+int alloc_uid_keyring(struct user_struct *user,
71+ struct task_struct *ctx)
7172 {
7273 struct key *uid_keyring, *session_keyring;
7374 char buf[20];
@@ -76,7 +77,7 @@ int alloc_uid_keyring(struct user_struct *user) · 2 unmodified lines
7677 /* concoct a default session keyring */
7778 sprintf(buf, "_uid_ses.%u", user->uid);
7879
79− session_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, 0, NULL);
80+ session_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, ctx, 0, NULL);
8081 if (IS_ERR(session_keyring)) {
8182 ret = PTR_ERR(session_keyring);
8283 goto error;
@@ -86,7 +87,7 @@ int alloc_uid_keyring(struct user_struct *user) · 3 unmodified lines
8687 * keyring */
8788 sprintf(buf, "_uid.%u", user->uid);
8889
89− uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, 0,
90+ uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, ctx, 0,
9091 session_keyring);
9192 if (IS_ERR(uid_keyring)) {
9293 key_put(session_keyring);
@@ -143,7 +144,7 @@ int install_thread_keyring(struct task_struct *tsk) · 50 unmodified lines
143144
144145 sprintf(buf, "_tid.%u", tsk->pid);
145146
146− keyring = keyring_alloc(buf, tsk->uid, tsk->gid, 1, NULL);
147+ keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk, 1, NULL);
147148 if (IS_ERR(keyring)) {
148149 ret = PTR_ERR(keyring);
149150 goto error;
@@ -177,7 +178,7 @@ int install_process_keyring(struct task_struct *tsk) · 27 unmodified lines
177178 if (!tsk->signal->process_keyring) {
178179 sprintf(buf, "_pid.%u", tsk->tgid);
179180
180− keyring = keyring_alloc(buf, tsk->uid, tsk->gid, 1, NULL);
181+ keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk, 1, NULL);
181182 if (IS_ERR(keyring)) {
182183 ret = PTR_ERR(keyring);
183184 goto error;
@@ -217,7 +218,7 @@ static int install_session_keyring(struct task_struct *tsk, · 33 unmodified lines
217218 if (!keyring) {
218219 sprintf(buf, "_ses.%u", tsk->tgid);
219220
220− keyring = keyring_alloc(buf, tsk->uid, tsk->gid, 1, NULL);
221+ keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk, 1, NULL);
221222 if (IS_ERR(keyring))
222223 return PTR_ERR(keyring);
223224 }
@@ -717,7 +718,7 @@ long join_session_keyring(const char *name) · 493 unmodified lines
717718 keyring = find_keyring_by_name(name, 0);
718719 if (PTR_ERR(keyring) == -ENOKEY) {
719720 /* not found - try and create a new one */
720− keyring = keyring_alloc(name, tsk->uid, tsk->gid, 0, NULL);
721+ keyring = keyring_alloc(name, tsk->uid, tsk->gid, tsk, 0, NULL);
721722 if (IS_ERR(keyring)) {
722723 ret = PTR_ERR(keyring);
723724 goto error2;
security/keys/request_key.c+4−2
@@ -48,7 +48,8 @@ static int call_sbin_request_key(struct key *key, · 47 unmodified lines
4848 /* allocate a new session keyring */
4949 sprintf(desc, "_req.%u", key->serial);
5050
51− keyring = keyring_alloc(desc, current->fsuid, current->fsgid, 1, NULL);
51+ keyring = keyring_alloc(desc, current->fsuid, current->fsgid,
52+ current, 1, NULL);
5253 if (IS_ERR(keyring)) {
5354 ret = PTR_ERR(keyring);
5455 goto error_alloc;
@@ -137,7 +138,8 @@ static struct key *__request_key_construction(struct key_type *type, · 82 unmodified lines
137138
138139 /* create a key and add it to the queue */
139140 key = key_alloc(type, description,
140− current->fsuid, current->fsgid, KEY_POS_ALL, 0);
141+ current->fsuid, current->fsgid,
142+ current, KEY_POS_ALL, 0);
141143 if (IS_ERR(key))
142144 goto alloc_failed;
143145
security/keys/request_key_auth.c+1−1
@@ -148,7 +148,7 @@ struct key *request_key_auth_new(struct key *target, const char *callout_info) · 147 unmodified lines
148148 sprintf(desc, "%x", target->serial);
149149
150150 authkey = key_alloc(&key_type_request_key_auth, desc,
151− current->fsuid, current->fsgid,
151+ current->fsuid, current->fsgid, current,
152152 KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
153153 KEY_USR_VIEW, 1);
154154 if (IS_ERR(authkey)) {
security/selinux/hooks.c+64−0
@@ -4252,6 +4252,57 @@ static int selinux_setprocattr(struct task_struct *p, · 4251 unmodified lines
42524252 return size;
42534253 }
42544254
4255+#ifdef CONFIG_KEYS
4256+
4257+static int selinux_key_alloc(struct key *k, struct task_struct *tsk)
4258+{
4259+ struct task_security_struct *tsec = tsk->security;
4260+ struct key_security_struct *ksec;
4261+
4262+ ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4263+ if (!ksec)
4264+ return -ENOMEM;
4265+
4266+ ksec->obj = k;
4267+ ksec->sid = tsec->sid;
4268+ k->security = ksec;
4269+
4270+ return 0;
4271+}
4272+
4273+static void selinux_key_free(struct key *k)
4274+{
4275+ struct key_security_struct *ksec = k->security;
4276+
4277+ k->security = NULL;
4278+ kfree(ksec);
4279+}
4280+
4281+static int selinux_key_permission(key_ref_t key_ref,
4282+ struct task_struct *ctx,
4283+ key_perm_t perm)
4284+{
4285+ struct key *key;
4286+ struct task_security_struct *tsec;
4287+ struct key_security_struct *ksec;
4288+
4289+ key = key_ref_to_ptr(key_ref);
4290+
4291+ tsec = ctx->security;
4292+ ksec = key->security;
4293+
4294+ /* if no specific permissions are requested, we skip the
4295+ permission check. No serious, additional covert channels
4296+ appear to be created. */
4297+ if (perm == 0)
4298+ return 0;
4299+
4300+ return avc_has_perm(tsec->sid, ksec->sid,
4301+ SECCLASS_KEY, perm, NULL);
4302+}
4303+
4304+#endif
4305+
42554306 static struct security_operations selinux_ops = {
42564307 .ptrace = selinux_ptrace,
42574308 .capget = selinux_capget,
@@ -4406,6 +4457,12 @@ static struct security_operations selinux_ops = { · 148 unmodified lines
44064457 .xfrm_state_delete_security = selinux_xfrm_state_delete,
44074458 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
44084459 #endif
4460+
4461+#ifdef CONFIG_KEYS
4462+ .key_alloc = selinux_key_alloc,
4463+ .key_free = selinux_key_free,
4464+ .key_permission = selinux_key_permission,
4465+#endif
44094466 };
44104467
44114468 static __init int selinux_init(void)
@@ -4441,6 +4498,13 @@ static __init int selinux_init(void) · 29 unmodified lines
44414498 } else {
44424499 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
44434500 }
4501+
4502+#ifdef CONFIG_KEYS
4503+ /* Add security information to initial keyrings */
4504+ security_key_alloc(&root_user_keyring, current);
4505+ security_key_alloc(&root_session_keyring, current);
4506+#endif
4507+
44444508 return 0;
44454509 }
44464510
security/selinux/include/av_perm_to_string.h+6−0
@@ -242,3 +242,9 @@ · 241 unmodified lines
242242 S_(SECCLASS_PACKET, PACKET__SEND, "send")
243243 S_(SECCLASS_PACKET, PACKET__RECV, "recv")
244244 S_(SECCLASS_PACKET, PACKET__RELABELTO, "relabelto")
245+ S_(SECCLASS_KEY, KEY__VIEW, "view")
246+ S_(SECCLASS_KEY, KEY__READ, "read")
247+ S_(SECCLASS_KEY, KEY__WRITE, "write")
248+ S_(SECCLASS_KEY, KEY__SEARCH, "search")
249+ S_(SECCLASS_KEY, KEY__LINK, "link")
250+ S_(SECCLASS_KEY, KEY__SETATTR, "setattr")
security/selinux/include/av_permissions.h+8−0
@@ -959,3 +959,11 @@ · 958 unmodified lines
959959 #define PACKET__SEND 0x00000001UL
960960 #define PACKET__RECV 0x00000002UL
961961 #define PACKET__RELABELTO 0x00000004UL
962+
963+#define KEY__VIEW 0x00000001UL
964+#define KEY__READ 0x00000002UL
965+#define KEY__WRITE 0x00000004UL
966+#define KEY__SEARCH 0x00000008UL
967+#define KEY__LINK 0x00000010UL
968+#define KEY__SETATTR 0x00000020UL
969+
security/selinux/include/class_to_string.h+1−0
@@ -60,3 +60,4 @@ · 59 unmodified lines
6060 S_("netlink_kobject_uevent_socket")
6161 S_("appletalk_socket")
6262 S_("packet")
63+ S_("key")
security/selinux/include/flask.h+1−0
@@ -62,6 +62,7 @@ · 61 unmodified lines
6262 #define SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET 55
6363 #define SECCLASS_APPLETALK_SOCKET 56
6464 #define SECCLASS_PACKET 57
65+#define SECCLASS_KEY 58
6566
6667 /*
6768 * Security identifier indices for initial entities
security/selinux/include/objsec.h+5−0
@@ -99,6 +99,11 @@ struct sk_security_struct { · 98 unmodified lines
9999 u32 peer_sid; /* SID of peer */
100100 };
101101
102+struct key_security_struct {
103+ struct key *obj; /* back pointer */
104+ u32 sid; /* SID of key */
105+};
106+
102107 extern unsigned int selinux_checkreqprot;
103108
104109 #endif /* _SELINUX_OBJSEC_H_ */