Skip to content

Commit

Permalink
LSM: Add security module hook list heads
Browse files Browse the repository at this point in the history 
Add a list header for each security hook. They aren't used until
later in the patch series. They are grouped together in a structure
so that there doesn't need to be an external address for each.

Macro-ize the initialization of the security_operations
for each security module in anticipation of changing out
the security_operations structure.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Acked-by: John Johansen <john.johansen@canonical.com>
Acked-by: Kees Cook <keescook@chromium.org>
Acked-by: Paul Moore <paul@paul-moore.com>
Acked-by:  Stephen Smalley <sds@tycho.nsa.gov>
Acked-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Signed-off-by: James Morris <james.l.morris@oracle.com>
  • Loading branch information
@cschaufler
cschaufler authored and James Morris committed May 12, 2015
1 parent f25fce3 commit e20b043
Show file tree
Hide file tree
Showing 6 changed files with 626 additions and 402 deletions.
220 changes: 220 additions & 0 deletions include/linux/lsm_hooks.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1626,6 +1626,226 @@ struct security_operations {
#endif /* CONFIG_AUDIT */
};

struct security_hook_heads {
struct list_head binder_set_context_mgr;
struct list_head binder_transaction;
struct list_head binder_transfer_binder;
struct list_head binder_transfer_file;
struct list_head ptrace_access_check;
struct list_head ptrace_traceme;
struct list_head capget;
struct list_head capset;
struct list_head capable;
struct list_head quotactl;
struct list_head quota_on;
struct list_head syslog;
struct list_head settime;
struct list_head vm_enough_memory;
struct list_head bprm_set_creds;
struct list_head bprm_check_security;
struct list_head bprm_secureexec;
struct list_head bprm_committing_creds;
struct list_head bprm_committed_creds;
struct list_head sb_alloc_security;
struct list_head sb_free_security;
struct list_head sb_copy_data;
struct list_head sb_remount;
struct list_head sb_kern_mount;
struct list_head sb_show_options;
struct list_head sb_statfs;
struct list_head sb_mount;
struct list_head sb_umount;
struct list_head sb_pivotroot;
struct list_head sb_set_mnt_opts;
struct list_head sb_clone_mnt_opts;
struct list_head sb_parse_opts_str;
struct list_head dentry_init_security;
#ifdef CONFIG_SECURITY_PATH
struct list_head path_unlink;
struct list_head path_mkdir;
struct list_head path_rmdir;
struct list_head path_mknod;
struct list_head path_truncate;
struct list_head path_symlink;
struct list_head path_link;
struct list_head path_rename;
struct list_head path_chmod;
struct list_head path_chown;
struct list_head path_chroot;
#endif
struct list_head inode_alloc_security;
struct list_head inode_free_security;
struct list_head inode_init_security;
struct list_head inode_create;
struct list_head inode_link;
struct list_head inode_unlink;
struct list_head inode_symlink;
struct list_head inode_mkdir;
struct list_head inode_rmdir;
struct list_head inode_mknod;
struct list_head inode_rename;
struct list_head inode_readlink;
struct list_head inode_follow_link;
struct list_head inode_permission;
struct list_head inode_setattr;
struct list_head inode_getattr;
struct list_head inode_setxattr;
struct list_head inode_post_setxattr;
struct list_head inode_getxattr;
struct list_head inode_listxattr;
struct list_head inode_removexattr;
struct list_head inode_need_killpriv;
struct list_head inode_killpriv;
struct list_head inode_getsecurity;
struct list_head inode_setsecurity;
struct list_head inode_listsecurity;
struct list_head inode_getsecid;
struct list_head file_permission;
struct list_head file_alloc_security;
struct list_head file_free_security;
struct list_head file_ioctl;
struct list_head mmap_addr;
struct list_head mmap_file;
struct list_head file_mprotect;
struct list_head file_lock;
struct list_head file_fcntl;
struct list_head file_set_fowner;
struct list_head file_send_sigiotask;
struct list_head file_receive;
struct list_head file_open;
struct list_head task_create;
struct list_head task_free;
struct list_head cred_alloc_blank;
struct list_head cred_free;
struct list_head cred_prepare;
struct list_head cred_transfer;
struct list_head kernel_act_as;
struct list_head kernel_create_files_as;
struct list_head kernel_fw_from_file;
struct list_head kernel_module_request;
struct list_head kernel_module_from_file;
struct list_head task_fix_setuid;
struct list_head task_setpgid;
struct list_head task_getpgid;
struct list_head task_getsid;
struct list_head task_getsecid;
struct list_head task_setnice;
struct list_head task_setioprio;
struct list_head task_getioprio;
struct list_head task_setrlimit;
struct list_head task_setscheduler;
struct list_head task_getscheduler;
struct list_head task_movememory;
struct list_head task_kill;
struct list_head task_wait;
struct list_head task_prctl;
struct list_head task_to_inode;
struct list_head ipc_permission;
struct list_head ipc_getsecid;
struct list_head msg_msg_alloc_security;
struct list_head msg_msg_free_security;
struct list_head msg_queue_alloc_security;
struct list_head msg_queue_free_security;
struct list_head msg_queue_associate;
struct list_head msg_queue_msgctl;
struct list_head msg_queue_msgsnd;
struct list_head msg_queue_msgrcv;
struct list_head shm_alloc_security;
struct list_head shm_free_security;
struct list_head shm_associate;
struct list_head shm_shmctl;
struct list_head shm_shmat;
struct list_head sem_alloc_security;
struct list_head sem_free_security;
struct list_head sem_associate;
struct list_head sem_semctl;
struct list_head sem_semop;
struct list_head netlink_send;
struct list_head d_instantiate;
struct list_head getprocattr;
struct list_head setprocattr;
struct list_head ismaclabel;
struct list_head secid_to_secctx;
struct list_head secctx_to_secid;
struct list_head release_secctx;
struct list_head inode_notifysecctx;
struct list_head inode_setsecctx;
struct list_head inode_getsecctx;
#ifdef CONFIG_SECURITY_NETWORK
struct list_head unix_stream_connect;
struct list_head unix_may_send;
struct list_head socket_create;
struct list_head socket_post_create;
struct list_head socket_bind;
struct list_head socket_connect;
struct list_head socket_listen;
struct list_head socket_accept;
struct list_head socket_sendmsg;
struct list_head socket_recvmsg;
struct list_head socket_getsockname;
struct list_head socket_getpeername;
struct list_head socket_getsockopt;
struct list_head socket_setsockopt;
struct list_head socket_shutdown;
struct list_head socket_sock_rcv_skb;
struct list_head socket_getpeersec_stream;
struct list_head socket_getpeersec_dgram;
struct list_head sk_alloc_security;
struct list_head sk_free_security;
struct list_head sk_clone_security;
struct list_head sk_getsecid;
struct list_head sock_graft;
struct list_head inet_conn_request;
struct list_head inet_csk_clone;
struct list_head inet_conn_established;
struct list_head secmark_relabel_packet;
struct list_head secmark_refcount_inc;
struct list_head secmark_refcount_dec;
struct list_head req_classify_flow;
struct list_head tun_dev_alloc_security;
struct list_head tun_dev_free_security;
struct list_head tun_dev_create;
struct list_head tun_dev_attach_queue;
struct list_head tun_dev_attach;
struct list_head tun_dev_open;
struct list_head skb_owned_by;
#endif /* CONFIG_SECURITY_NETWORK */
#ifdef CONFIG_SECURITY_NETWORK_XFRM
struct list_head xfrm_policy_alloc_security;
struct list_head xfrm_policy_clone_security;
struct list_head xfrm_policy_free_security;
struct list_head xfrm_policy_delete_security;
struct list_head xfrm_state_alloc;
struct list_head xfrm_state_alloc_acquire;
struct list_head xfrm_state_free_security;
struct list_head xfrm_state_delete_security;
struct list_head xfrm_policy_lookup;
struct list_head xfrm_state_pol_flow_match;
struct list_head xfrm_decode_session;
#endif /* CONFIG_SECURITY_NETWORK_XFRM */
#ifdef CONFIG_KEYS
struct list_head key_alloc;
struct list_head key_free;
struct list_head key_permission;
struct list_head key_getsecurity;
#endif /* CONFIG_KEYS */
#ifdef CONFIG_AUDIT
struct list_head audit_rule_init;
struct list_head audit_rule_known;
struct list_head audit_rule_match;
struct list_head audit_rule_free;
#endif /* CONFIG_AUDIT */
};

/*
* Initializing a security_hook_list structure takes
* up a lot of space in a source file. This macro takes
* care of the common case and reduces the amount of
* text involved.
* Casey says: Comment is true in the next patch.
*/
#define LSM_HOOK_INIT(HEAD, HOOK) .HEAD = HOOK

/* prototypes */
extern int security_module_enable(struct security_operations *ops);
extern int register_security(struct security_operations *ops);
Expand Down
84 changes: 42 additions & 42 deletions security/apparmor/lsm.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -616,48 +616,48 @@ static int apparmor_task_setrlimit(struct task_struct *task,
}

static struct security_operations apparmor_ops = {
.name = "apparmor",

.ptrace_access_check = apparmor_ptrace_access_check,
.ptrace_traceme = apparmor_ptrace_traceme,
.capget = apparmor_capget,
.capable = apparmor_capable,

.path_link = apparmor_path_link,
.path_unlink = apparmor_path_unlink,
.path_symlink = apparmor_path_symlink,
.path_mkdir = apparmor_path_mkdir,
.path_rmdir = apparmor_path_rmdir,
.path_mknod = apparmor_path_mknod,
.path_rename = apparmor_path_rename,
.path_chmod = apparmor_path_chmod,
.path_chown = apparmor_path_chown,
.path_truncate = apparmor_path_truncate,
.inode_getattr = apparmor_inode_getattr,

.file_open = apparmor_file_open,
.file_permission = apparmor_file_permission,
.file_alloc_security = apparmor_file_alloc_security,
.file_free_security = apparmor_file_free_security,
.mmap_file = apparmor_mmap_file,
.mmap_addr = cap_mmap_addr,
.file_mprotect = apparmor_file_mprotect,
.file_lock = apparmor_file_lock,

.getprocattr = apparmor_getprocattr,
.setprocattr = apparmor_setprocattr,

.cred_alloc_blank = apparmor_cred_alloc_blank,
.cred_free = apparmor_cred_free,
.cred_prepare = apparmor_cred_prepare,
.cred_transfer = apparmor_cred_transfer,

.bprm_set_creds = apparmor_bprm_set_creds,
.bprm_committing_creds = apparmor_bprm_committing_creds,
.bprm_committed_creds = apparmor_bprm_committed_creds,
.bprm_secureexec = apparmor_bprm_secureexec,

.task_setrlimit = apparmor_task_setrlimit,
LSM_HOOK_INIT(name, "apparmor"),

LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
LSM_HOOK_INIT(capget, apparmor_capget),
LSM_HOOK_INIT(capable, apparmor_capable),

LSM_HOOK_INIT(path_link, apparmor_path_link),
LSM_HOOK_INIT(path_unlink, apparmor_path_unlink),
LSM_HOOK_INIT(path_symlink, apparmor_path_symlink),
LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir),
LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir),
LSM_HOOK_INIT(path_mknod, apparmor_path_mknod),
LSM_HOOK_INIT(path_rename, apparmor_path_rename),
LSM_HOOK_INIT(path_chmod, apparmor_path_chmod),
LSM_HOOK_INIT(path_chown, apparmor_path_chown),
LSM_HOOK_INIT(path_truncate, apparmor_path_truncate),
LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr),

LSM_HOOK_INIT(file_open, apparmor_file_open),
LSM_HOOK_INIT(file_permission, apparmor_file_permission),
LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security),
LSM_HOOK_INIT(file_free_security, apparmor_file_free_security),
LSM_HOOK_INIT(mmap_file, apparmor_mmap_file),
LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),
LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect),
LSM_HOOK_INIT(file_lock, apparmor_file_lock),

LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),

LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),
LSM_HOOK_INIT(cred_free, apparmor_cred_free),
LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),
LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer),

LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds),
LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds),
LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds),
LSM_HOOK_INIT(bprm_secureexec, apparmor_bprm_secureexec),

LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
};

/*
Expand Down
Loading

0 comments on commit e20b043

Please sign in to comment.