lkml.org 
[lkml]   [2007]   [Jul]   [31]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 12/14] CacheFiles: Get the SID under which the CacheFiles module should operate
    Date
    Get the SID under which the CacheFiles module should operate so that the
    SELinux security system can control the accesses it makes.

    Signed-Off-By: David Howells <dhowells@redhat.com>
    ---

    include/linux/security.h | 20 ++++++++++++++++++++
    security/dummy.c | 7 +++++++
    security/selinux/hooks.c | 7 +++++++
    3 files changed, 34 insertions(+), 0 deletions(-)

    diff --git a/include/linux/security.h b/include/linux/security.h
    index 21cadea..9cb417e 100644
    --- a/include/linux/security.h
    +++ b/include/linux/security.h
    @@ -1164,6 +1164,14 @@ struct request_sock;
    * owning security ID, and return the security ID as which the process was
    * previously acting.
    *
    + * @cachefiles_get_secid:
    + * Determine the security ID for the CacheFiles module to use when
    + * accessing the filesystem containing the cache.
    + * @secid contains the security ID under which cachefiles daemon is
    + * running.
    + * @modsecid contains the pointer to where the security ID for the module
    + * is to be stored.
    + *
    * This is the main security structure.
    */
    struct security_operations {
    @@ -1352,6 +1360,7 @@ struct security_operations {
    u32 (*set_fscreate_secid)(u32 secid);
    u32 (*act_as_secid)(u32 secid);
    u32 (*act_as_self)(void);
    + int (*cachefiles_get_secid)(u32 secid, u32 *modsecid);

    #ifdef CONFIG_SECURITY_NETWORK
    int (*unix_stream_connect) (struct socket * sock,
    @@ -2176,6 +2185,11 @@ static inline u32 security_act_as_self(void)
    return security_ops->act_as_self();
    }

    +static inline int security_cachefiles_get_secid(u32 secid, u32 *modsecid)
    +{
    + return security_ops->cachefiles_get_secid(secid, modsecid);
    +}
    +
    /* prototypes */
    extern int security_init (void);
    extern int register_security (struct security_operations *ops);
    @@ -2883,6 +2897,12 @@ static inline u32 security_act_as_self(void)
    return 0;
    }

    +static inline int security_cachefiles_get_secid(u32 secid, u32 *modsecid)
    +{
    + *modsecid = 0;
    + return 0;
    +}
    +
    #endif /* CONFIG_SECURITY */

    #ifdef CONFIG_SECURITY_NETWORK
    diff --git a/security/dummy.c b/security/dummy.c
    index 6a7a317..2c1fd16 100644
    --- a/security/dummy.c
    +++ b/security/dummy.c
    @@ -955,6 +955,12 @@ static u32 dummy_act_as_self(void)
    return 0;
    }

    +static int dummy_cachefiles_get_secid(u32 secid, u32 *modsecid)
    +{
    + *modsecid = 0;
    + return 0;
    +}
    +
    #ifdef CONFIG_KEYS
    static inline int dummy_key_alloc(struct key *key, struct task_struct *ctx,
    unsigned long flags)
    @@ -1114,6 +1120,7 @@ void security_fixup_ops (struct security_operations *ops)
    set_to_dummy_if_null(ops, set_fscreate_secid);
    set_to_dummy_if_null(ops, act_as_secid);
    set_to_dummy_if_null(ops, act_as_self);
    + set_to_dummy_if_null(ops, cachefiles_get_secid);
    #ifdef CONFIG_SECURITY_NETWORK
    set_to_dummy_if_null(ops, unix_stream_connect);
    set_to_dummy_if_null(ops, unix_may_send);
    diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
    index ffe5c02..76650cb 100644
    --- a/security/selinux/hooks.c
    +++ b/security/selinux/hooks.c
    @@ -4719,6 +4719,12 @@ static u32 selinux_act_as_self(void)
    return oldactor_sid;
    }

    +static int selinux_cachefiles_get_secid(u32 secid, u32 *modsecid)
    +{
    + return security_transition_sid(secid, SECINITSID_KERNEL,
    + SECCLASS_PROCESS, modsecid);
    +}
    +
    #ifdef CONFIG_KEYS

    static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
    @@ -4906,6 +4912,7 @@ static struct security_operations selinux_ops = {
    .set_fscreate_secid = selinux_set_fscreate_secid,
    .act_as_secid = selinux_act_as_secid,
    .act_as_self = selinux_act_as_self,
    + .cachefiles_get_secid = selinux_cachefiles_get_secid,

    .unix_stream_connect = selinux_socket_unix_stream_connect,
    .unix_may_send = selinux_socket_unix_may_send,
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2007-07-31 22:33    [W:5.973 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site