[PATCH] selinux: add hooks for key subsystem

Introduce SELinux hooks to support the access key retention subsystem within the kernel. Incorporate new flask headers from a modified version of the SELinux reference policy, with support for the new security class representing retained keys. Extend the "key_alloc" security hook with a task parameter representing the intended ownership context for the key being allocated. Attach security information to root's default keyrings within the SELinux initialization routine. Has passed David's testsuite.

Michael LeMay committed 20 years ago

Commit d7200241 parent f893afb16 files · +155 −27Browse files

Showing the changes to security/selinux/include (5 of 16 files). Show all

Unified · Split

5 files

security/selinux/include/av_perm_to_string.h +6 −0
security/selinux/include/av_permissions.h +8 −0
security/selinux/include/class_to_string.h +1 −0
security/selinux/include/flask.h +1 −0
security/selinux/include/objsec.h +5 −0

security/selinux/include/av_perm_to_string.h+6−0

@@ -242,3 +242,9 @@ · 241 unmodified lines
242	242	S_(SECCLASS_PACKET, PACKET__SEND, "send")
243	243	S_(SECCLASS_PACKET, PACKET__RECV, "recv")
244	244	S_(SECCLASS_PACKET, PACKET__RELABELTO, "relabelto")
	245	+ S_(SECCLASS_KEY, KEY__VIEW, "view")
	246	+ S_(SECCLASS_KEY, KEY__READ, "read")
	247	+ S_(SECCLASS_KEY, KEY__WRITE, "write")
	248	+ S_(SECCLASS_KEY, KEY__SEARCH, "search")
	249	+ S_(SECCLASS_KEY, KEY__LINK, "link")
	250	+ S_(SECCLASS_KEY, KEY__SETATTR, "setattr")

security/selinux/include/av_permissions.h+8−0

@@ -959,3 +959,11 @@ · 958 unmodified lines
959	959	#define PACKET__SEND 0x00000001UL
960	960	#define PACKET__RECV 0x00000002UL
961	961	#define PACKET__RELABELTO 0x00000004UL
	962	+
	963	+#define KEY__VIEW 0x00000001UL
	964	+#define KEY__READ 0x00000002UL
	965	+#define KEY__WRITE 0x00000004UL
	966	+#define KEY__SEARCH 0x00000008UL
	967	+#define KEY__LINK 0x00000010UL
	968	+#define KEY__SETATTR 0x00000020UL
	969	+

security/selinux/include/class_to_string.h+1−0

@@ -60,3 +60,4 @@ · 59 unmodified lines
60	60	S_("netlink_kobject_uevent_socket")
61	61	S_("appletalk_socket")
62	62	S_("packet")
	63	+ S_("key")

security/selinux/include/flask.h+1−0

@@ -62,6 +62,7 @@ · 61 unmodified lines
62	62	#define SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET 55
63	63	#define SECCLASS_APPLETALK_SOCKET 56
64	64	#define SECCLASS_PACKET 57
	65	+#define SECCLASS_KEY 58
65	66
66	67	/*
67	68	* Security identifier indices for initial entities

security/selinux/include/objsec.h+5−0

@@ -99,6 +99,11 @@ struct sk_security_struct { · 98 unmodified lines
99	99	u32 peer_sid; /* SID of peer */
100	100	};
101	101
	102	+struct key_security_struct {
	103	+ struct key obj; / back pointer */
	104	+ u32 sid; /* SID of key */
	105	+};
	106	+
102	107	extern unsigned int selinux_checkreqprot;
103	108
104	109	#endif /* _SELINUX_OBJSEC_H_ */