Messages in this thread Patch in this message | | | Date | Thu, 30 Jun 2005 14:51:50 -0500 | From | serue@us ... | Subject | [patch 6/12] lsm stacking v0.2: stackable capability lsm |
| |
This patch adds a version of the capability module which is safe to stack with SELinux. It notably does not define the inode_setxattr and inode_removexattr hooks, as these otherwise prevent selinux from saving file types to disk.
Signed-off-by: Serge Hallyn <serue@us.ibm.com> --- Kconfig | 21 +++++++++++ Makefile | 1 cap_stack.c | 101 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ selinux/Kconfig | 2 + 4 files changed, 124 insertions(+), 1 deletion(-)
Index: linux-2.6.13-rc1/security/Kconfig =================================================================== --- linux-2.6.13-rc1.orig/security/Kconfig 2005-06-30 15:32:43.000000000 -0500 +++ linux-2.6.13-rc1/security/Kconfig 2005-06-30 15:33:43.000000000 -0500 @@ -56,10 +56,29 @@ config SECURITY_NETWORK config SECURITY_CAPABILITIES tristate "Default Linux Capabilities" depends on SECURITY + depends on SECURITY_SELINUX=n && SECURITY_CAP_STACK=n help - This enables the "default" Linux capabilities functionality. + This enables the default Linux capabilities functionality. + This module may not be used in conjunction with the stackable + capabilities or SELinux modules. + If you are unsure how to answer this question, answer Y. + If you are using SELinux, answer N here and look at the + Stackable Linux Capabilities instead. + +config SECURITY_CAP_STACK + tristate "Stackable Linux Capabilities" + depends on SECURITY + help + This enables the "stackable" Linux capabilities functionality. + + If you are using SELinux, this option will be automatically + enabled. + + If you are not using any other LSMs, answer N here and see above + for the Default Linux Capabilities. + config SECURITY_ROOTPLUG tristate "Root Plug Support" depends on USB && SECURITY Index: linux-2.6.13-rc1/security/Makefile =================================================================== --- linux-2.6.13-rc1.orig/security/Makefile 2005-06-30 15:32:43.000000000 -0500 +++ linux-2.6.13-rc1/security/Makefile 2005-06-30 15:32:47.000000000 -0500 @@ -16,5 +16,6 @@ obj-$(CONFIG_SECURITY) += security.o d # Must precede capability.o in order to stack properly. obj-$(CONFIG_SECURITY_SELINUX) += selinux/built-in.o obj-$(CONFIG_SECURITY_CAPABILITIES) += commoncap.o capability.o +obj-$(CONFIG_SECURITY_CAP_STACK) += commoncap.o cap_stack.o obj-$(CONFIG_SECURITY_ROOTPLUG) += commoncap.o root_plug.o obj-$(CONFIG_SECURITY_SECLVL) += seclvl.o Index: linux-2.6.13-rc1/security/cap_stack.c =================================================================== --- /dev/null 1970-01-01 00:00:00.000000000 +0000 +++ linux-2.6.13-rc1/security/cap_stack.c 2005-06-30 15:32:47.000000000 -0500 @@ -0,0 +1,101 @@ +/* + * Capabilities Linux Security Module + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + */ + +#include <linux/config.h> +#include <linux/module.h> +#include <linux/init.h> +#include <linux/kernel.h> +#include <linux/security.h> +#include <linux/file.h> +#include <linux/mm.h> +#include <linux/mman.h> +#include <linux/pagemap.h> +#include <linux/swap.h> +#include <linux/smp_lock.h> +#include <linux/skbuff.h> +#include <linux/netlink.h> +#include <linux/ptrace.h> +#include <linux/moduleparam.h> + +static struct security_operations capability_ops = { + .ptrace = cap_ptrace, + .capget = cap_capget, + .capset_check = cap_capset_check, + .capset_set = cap_capset_set, + .capable = cap_capable, + .settime = cap_settime, + .netlink_send = cap_netlink_send, + .netlink_recv = cap_netlink_recv, + + .bprm_apply_creds = cap_bprm_apply_creds, + .bprm_set_security = cap_bprm_set_security, + .bprm_secureexec = cap_bprm_secureexec, + + .task_post_setuid = cap_task_post_setuid, + .task_reparent_to_init = cap_task_reparent_to_init, + + .syslog = cap_syslog, + + .vm_enough_memory = cap_vm_enough_memory, +}; + +#define MY_NAME __stringify(KBUILD_MODNAME) + +/* flag to keep track of how we were registered */ +static int secondary; + +static int capability_disable; +module_param_named(disable, capability_disable, int, 0); +MODULE_PARM_DESC(disable, "To disable capabilities module set disable = 1"); + +static int __init capability_init (void) +{ + if (capability_disable) { + printk(KERN_INFO "Capabilities disabled at initialization\n"); + return 0; + } + /* register ourselves with the security framework */ + if (register_security (&capability_ops)) { + /* try registering with primary module */ + if (mod_reg_security (MY_NAME, &capability_ops)) { + printk (KERN_INFO "Failure registering capabilities " + "with primary security module.\n"); + return -EINVAL; + } + secondary = 1; + } + printk (KERN_INFO "Capability LSM initialized%s\n", + secondary ? " as secondary" : ""); + return 0; +} + +static void __exit capability_exit (void) +{ + if (capability_disable) + return; + /* remove ourselves from the security framework */ + if (secondary) { + if (mod_unreg_security (MY_NAME, &capability_ops)) + printk (KERN_INFO "Failure unregistering capabilities " + "with primary module.\n"); + return; + } + + if (unregister_security (&capability_ops)) { + printk (KERN_INFO + "Failure unregistering capabilities with the kernel\n"); + } +} + +security_initcall (capability_init); +module_exit (capability_exit); + +MODULE_DESCRIPTION("Standard Linux Capabilities Security Module"); +MODULE_LICENSE("GPL"); Index: linux-2.6.13-rc1/security/selinux/Kconfig =================================================================== --- linux-2.6.13-rc1.orig/security/selinux/Kconfig 2005-06-30 14:15:01.000000000 -0500 +++ linux-2.6.13-rc1/security/selinux/Kconfig 2005-06-30 15:32:47.000000000 -0500 @@ -2,6 +2,8 @@ config SECURITY_SELINUX bool "NSA SELinux Support" depends on SECURITY && NET && INET default n + select SECURITY_CAP_STACK + select SECURITY_STACKER help This selects NSA Security-Enhanced Linux (SELinux). You will also need a policy configuration and a labeled filesystem. - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |