History

binder: create node flag to request sender's security context

To allow servers to verify client identity, allow a node flag to be set that causes the sender's security context to be delivered with the transaction. The BR_TRANSACTION command is extended in BR_TRANSACTION_SEC_CTX to contain a pointer to the security context string.

Todd Kjos committed 7 years ago

Commit ec741361 parent 8fdf9062 files · +102 −23Browse files

Showing the changes to include/uapi/linux/android (1 of 2 files). Show all

Unified · Split

include/uapi/linux/android/binder.h+19−0
@@ -41,6 +41,14 @@ enum { · 40 unmodified lines
41enum {41enum {
42 FLAT_BINDER_FLAG_PRIORITY_MASK = 0xff,42 FLAT_BINDER_FLAG_PRIORITY_MASK = 0xff,
43 FLAT_BINDER_FLAG_ACCEPTS_FDS = 0x100,43 FLAT_BINDER_FLAG_ACCEPTS_FDS = 0x100,
44
45 /**
46 * @FLAT_BINDER_FLAG_TXN_SECURITY_CTX: request security contexts
47 *
48 * Only when set, causes senders to include their security
49 * context
50 */
51 FLAT_BINDER_FLAG_TXN_SECURITY_CTX = 0x1000,
44};52};
45 53
46#ifdef BINDER_IPC_32BIT54#ifdef BINDER_IPC_32BIT
@@ -218,6 +226,7 @@ struct binder_node_info_for_ref { · 171 unmodified lines
218#define BINDER_VERSION _IOWR('b', 9, struct binder_version)226#define BINDER_VERSION _IOWR('b', 9, struct binder_version)
219#define BINDER_GET_NODE_DEBUG_INFO _IOWR('b', 11, struct binder_node_debug_info)227#define BINDER_GET_NODE_DEBUG_INFO _IOWR('b', 11, struct binder_node_debug_info)
220#define BINDER_GET_NODE_INFO_FOR_REF _IOWR('b', 12, struct binder_node_info_for_ref)228#define BINDER_GET_NODE_INFO_FOR_REF _IOWR('b', 12, struct binder_node_info_for_ref)
229#define BINDER_SET_CONTEXT_MGR_EXT _IOW('b', 13, struct flat_binder_object)
221 230
222/*231/*
223 * NOTE: Two special error codes you should check for when calling232 * NOTE: Two special error codes you should check for when calling
@@ -276,6 +285,11 @@ struct binder_transaction_data { · 52 unmodified lines
276 } data;285 } data;
277};286};
278 287
288struct binder_transaction_data_secctx {
289 struct binder_transaction_data transaction_data;
290 binder_uintptr_t secctx;
291};
292
279struct binder_transaction_data_sg {293struct binder_transaction_data_sg {
280 struct binder_transaction_data transaction_data;294 struct binder_transaction_data transaction_data;
281 binder_size_t buffers_size;295 binder_size_t buffers_size;
@@ -311,6 +325,11 @@ enum binder_driver_return_protocol { · 29 unmodified lines
311 BR_OK = _IO('r', 1),325 BR_OK = _IO('r', 1),
312 /* No parameters! */326 /* No parameters! */
313 327
328 BR_TRANSACTION_SEC_CTX = _IOR('r', 2,
329 struct binder_transaction_data_secctx),
330 /*
331 * binder_transaction_data_secctx: the received command.
332 */
314 BR_TRANSACTION = _IOR('r', 2, struct binder_transaction_data),333 BR_TRANSACTION = _IOR('r', 2, struct binder_transaction_data),
315 BR_REPLY = _IOR('r', 3, struct binder_transaction_data),334 BR_REPLY = _IOR('r', 3, struct binder_transaction_data),
316 /*335 /*