History

[PATCH] selinux: add hooks for key subsystem

Introduce SELinux hooks to support the access key retention subsystem within the kernel. Incorporate new flask headers from a modified version of the SELinux reference policy, with support for the new security class representing retained keys. Extend the "key_alloc" security hook with a task parameter representing the intended ownership context for the key being allocated. Attach security information to root's default keyrings within the SELinux initialization routine. Has passed David's testsuite.

Michael LeMay committed 20 years ago

Commit d7200241 parent f893afb16 files · +155 −27Browse files

Showing the changes to security/keys (5 of 16 files). Show all

Unified · Split

5 files
  1. security/keys/key.c +4 −4
  2. security/keys/keyring.c +3 −2
  3. security/keys/process_keys.c +8 −7
  4. security/keys/request_key.c +4 −2
  5. security/keys/request_key_auth.c +1 −1
security/keys/key.c+4−4
@@ -247,8 +247,8 @@ static inline void key_alloc_serial(struct key *key) · 246 unmodified lines
247247 * instantiate the key or discard it before returning
248248 */
249249 struct key *key_alloc(struct key_type *type, const char *desc,
250− uid_t uid, gid_t gid, key_perm_t perm,
251− int not_in_quota)
250+ uid_t uid, gid_t gid, struct task_struct *ctx,
251+ key_perm_t perm, int not_in_quota)
252252 {
253253 struct key_user *user = NULL;
254254 struct key *key;
@@ -318,7 +318,7 @@ struct key *key_alloc(struct key_type *type, const char *desc, · 63 unmodified lines
318318 #endif
319319
320320 /* let the security module know about the key */
321− ret = security_key_alloc(key);
321+ ret = security_key_alloc(key, ctx);
322322 if (ret < 0)
323323 goto security_error;
324324
@@ -822,7 +822,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref, · 497 unmodified lines
822822
823823 /* allocate a new key */
824824 key = key_alloc(ktype, description, current->fsuid, current->fsgid,
825− perm, not_in_quota);
825+ current, perm, not_in_quota);
826826 if (IS_ERR(key)) {
827827 key_ref = ERR_PTR(PTR_ERR(key));
828828 goto error_3;
security/keys/keyring.c+3−2
@@ -240,13 +240,14 @@ static long keyring_read(const struct key *keyring, · 239 unmodified lines
240240 * allocate a keyring and link into the destination keyring
241241 */
242242 struct key *keyring_alloc(const char *description, uid_t uid, gid_t gid,
243− int not_in_quota, struct key *dest)
243+ struct task_struct *ctx, int not_in_quota,
244+ struct key *dest)
244245 {
245246 struct key *keyring;
246247 int ret;
247248
248249 keyring = key_alloc(&key_type_keyring, description,
249− uid, gid,
250+ uid, gid, ctx,
250251 (KEY_POS_ALL & ~KEY_POS_SETATTR) | KEY_USR_ALL,
251252 not_in_quota);
252253
security/keys/process_keys.c+8−7
@@ -67,7 +67,8 @@ struct key root_session_keyring = { · 66 unmodified lines
6767 /*
6868 * allocate the keyrings to be associated with a UID
6969 */
70−int alloc_uid_keyring(struct user_struct *user)
70+int alloc_uid_keyring(struct user_struct *user,
71+ struct task_struct *ctx)
7172 {
7273 struct key *uid_keyring, *session_keyring;
7374 char buf[20];
@@ -76,7 +77,7 @@ int alloc_uid_keyring(struct user_struct *user) · 2 unmodified lines
7677 /* concoct a default session keyring */
7778 sprintf(buf, "_uid_ses.%u", user->uid);
7879
79− session_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, 0, NULL);
80+ session_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, ctx, 0, NULL);
8081 if (IS_ERR(session_keyring)) {
8182 ret = PTR_ERR(session_keyring);
8283 goto error;
@@ -86,7 +87,7 @@ int alloc_uid_keyring(struct user_struct *user) · 3 unmodified lines
8687 * keyring */
8788 sprintf(buf, "_uid.%u", user->uid);
8889
89− uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, 0,
90+ uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1, ctx, 0,
9091 session_keyring);
9192 if (IS_ERR(uid_keyring)) {
9293 key_put(session_keyring);
@@ -143,7 +144,7 @@ int install_thread_keyring(struct task_struct *tsk) · 50 unmodified lines
143144
144145 sprintf(buf, "_tid.%u", tsk->pid);
145146
146− keyring = keyring_alloc(buf, tsk->uid, tsk->gid, 1, NULL);
147+ keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk, 1, NULL);
147148 if (IS_ERR(keyring)) {
148149 ret = PTR_ERR(keyring);
149150 goto error;
@@ -177,7 +178,7 @@ int install_process_keyring(struct task_struct *tsk) · 27 unmodified lines
177178 if (!tsk->signal->process_keyring) {
178179 sprintf(buf, "_pid.%u", tsk->tgid);
179180
180− keyring = keyring_alloc(buf, tsk->uid, tsk->gid, 1, NULL);
181+ keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk, 1, NULL);
181182 if (IS_ERR(keyring)) {
182183 ret = PTR_ERR(keyring);
183184 goto error;
@@ -217,7 +218,7 @@ static int install_session_keyring(struct task_struct *tsk, · 33 unmodified lines
217218 if (!keyring) {
218219 sprintf(buf, "_ses.%u", tsk->tgid);
219220
220− keyring = keyring_alloc(buf, tsk->uid, tsk->gid, 1, NULL);
221+ keyring = keyring_alloc(buf, tsk->uid, tsk->gid, tsk, 1, NULL);
221222 if (IS_ERR(keyring))
222223 return PTR_ERR(keyring);
223224 }
@@ -717,7 +718,7 @@ long join_session_keyring(const char *name) · 493 unmodified lines
717718 keyring = find_keyring_by_name(name, 0);
718719 if (PTR_ERR(keyring) == -ENOKEY) {
719720 /* not found - try and create a new one */
720− keyring = keyring_alloc(name, tsk->uid, tsk->gid, 0, NULL);
721+ keyring = keyring_alloc(name, tsk->uid, tsk->gid, tsk, 0, NULL);
721722 if (IS_ERR(keyring)) {
722723 ret = PTR_ERR(keyring);
723724 goto error2;
security/keys/request_key.c+4−2
@@ -48,7 +48,8 @@ static int call_sbin_request_key(struct key *key, · 47 unmodified lines
4848 /* allocate a new session keyring */
4949 sprintf(desc, "_req.%u", key->serial);
5050
51− keyring = keyring_alloc(desc, current->fsuid, current->fsgid, 1, NULL);
51+ keyring = keyring_alloc(desc, current->fsuid, current->fsgid,
52+ current, 1, NULL);
5253 if (IS_ERR(keyring)) {
5354 ret = PTR_ERR(keyring);
5455 goto error_alloc;
@@ -137,7 +138,8 @@ static struct key *__request_key_construction(struct key_type *type, · 82 unmodified lines
137138
138139 /* create a key and add it to the queue */
139140 key = key_alloc(type, description,
140− current->fsuid, current->fsgid, KEY_POS_ALL, 0);
141+ current->fsuid, current->fsgid,
142+ current, KEY_POS_ALL, 0);
141143 if (IS_ERR(key))
142144 goto alloc_failed;
143145
security/keys/request_key_auth.c+1−1
@@ -148,7 +148,7 @@ struct key *request_key_auth_new(struct key *target, const char *callout_info) · 147 unmodified lines
148148 sprintf(desc, "%x", target->serial);
149149
150150 authkey = key_alloc(&key_type_request_key_auth, desc,
151− current->fsuid, current->fsgid,
151+ current->fsuid, current->fsgid, current,
152152 KEY_POS_VIEW | KEY_POS_READ | KEY_POS_SEARCH |
153153 KEY_USR_VIEW, 1);
154154 if (IS_ERR(authkey)) {