bybrooklyn/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-04-18 06:44:00 -04:00
Code Issues Packages Projects Releases Wiki Activity

lsm: create new security_cred_getlsmprop LSM hook

Browse Source 
Create a new LSM hook security_cred_getlsmprop() which, like
security_cred_getsecid(), fetches LSM specific attributes from the
cred structure.  The associated data elements in the audit sub-system
are changed from a secid to a lsm_prop to accommodate multiple possible
LSM audit users.

Cc: linux-integrity@vger.kernel.org
Cc: audit@vger.kernel.org
Cc: selinux@vger.kernel.org
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
[PM: subj line tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Casey Schaufler
2024-10-09 10:32:18 -07:00
committed by Paul Moore
parent e0a8dcbd53
commit b0654ca429
6 changed files with 50 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
security/smack/smack_lsm.c
View File

@@ -2150,6 +2150,23 @@ static void smack_cred_getsecid(const struct cred *cred, u32 *secid)
rcu_read_unlock();
}
/**
* smack_cred_getlsmprop - get the Smack label for a creds structure
* @cred: the object creds
* @prop: where to put the data
*
* Sets the Smack part of the ref
*/
static void smack_cred_getlsmprop(const struct cred *cred,
struct lsm_prop *prop)
{
rcu_read_lock();
prop->smack.skp = smk_of_task(smack_cred(cred));
/* scaffolding */
prop->scaffold.secid = prop->smack.skp->smk_secid;
rcu_read_unlock();
}
/**
* smack_kernel_act_as - Set the subjective context in a set of credentials
* @new: points to the set of credentials to be modified.
@@ -5132,6 +5149,7 @@ static struct security_hook_list smack_hooks[] __ro_after_init = {
LSM_HOOK_INIT(cred_prepare, smack_cred_prepare),
LSM_HOOK_INIT(cred_transfer, smack_cred_transfer),
LSM_HOOK_INIT(cred_getsecid, smack_cred_getsecid),
LSM_HOOK_INIT(cred_getlsmprop, smack_cred_getlsmprop),
LSM_HOOK_INIT(kernel_act_as, smack_kernel_act_as),
LSM_HOOK_INIT(kernel_create_files_as, smack_kernel_create_files_as),
LSM_HOOK_INIT(task_setpgid, smack_task_setpgid),