lkml.org 
[lkml]   [2010]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH v3 05/15] security: imbed evm calls in security hooks
    Date
    Imbed the evm calls evm_inode_setxattr(), evm_inode_post_setxattr(),
    evm_inode_removexattr() in the security hooks. evm_inode_setxattr()
    protects security.evm xattr. evm_inode_post_setxattr() and
    evm_inode_removexattr() updates the hmac associated with an inode.

    (Assumes an LSM module protects the setting/removing of xattr.)

    Changelog:
    - Don't define evm_verifyxattr(), unless CONFIG_INTEGRITY is enabled.
    - xattr_name is a 'const', value is 'void *'

    Signed-off-by: Mimi Zohar <zohar@us.ibm.com>
    Acked-by: Serge Hallyn <serue@us.ibm.com>
    ---
    include/linux/evm.h | 56 +++++++++++++++++++++++++++++++++++++
    security/integrity/evm/evm_main.c | 1 +
    security/security.c | 16 +++++++++-
    3 files changed, 71 insertions(+), 2 deletions(-)
    create mode 100644 include/linux/evm.h

    diff --git a/include/linux/evm.h b/include/linux/evm.h
    new file mode 100644
    index 0000000..8b4e9e3
    --- /dev/null
    +++ b/include/linux/evm.h
    @@ -0,0 +1,56 @@
    +/*
    + * evm.h
    + *
    + * Copyright (c) 2009 IBM Corporation
    + * Author: Mimi Zohar <zohar@us.ibm.com>
    + */
    +
    +#ifndef _LINUX_EVM_H
    +#define _LINUX_EVM_H
    +
    +#include <linux/integrity.h>
    +
    +#ifdef CONFIG_EVM
    +extern enum integrity_status evm_verifyxattr(struct dentry *dentry,
    + const char *xattr_name,
    + void *xattr_value,
    + size_t xattr_value_len);
    +extern int evm_inode_setxattr(struct dentry *dentry, const char *name,
    + const void *value, size_t size);
    +extern void evm_inode_post_setxattr(struct dentry *dentry,
    + const char *xattr_name,
    + const void *xattr_value,
    + size_t xattr_value_len);
    +extern int evm_inode_removexattr(struct dentry *dentry, const char *xattr_name);
    +#else
    +#ifdef CONFIG_INTEGRITY
    +static inline enum integrity_status evm_verifyxattr(struct dentry *dentry,
    + const char *xattr_name,
    + void *xattr_value,
    + size_t xattr_value_len)
    +{
    + return INTEGRITY_UNKNOWN;
    +}
    +#endif
    +
    +static inline int evm_inode_setxattr(struct dentry *dentry, const char *name,
    + const void *value, size_t size)
    +{
    + return 0;
    +}
    +
    +static inline void evm_inode_post_setxattr(struct dentry *dentry,
    + const char *xattr_name,
    + const void *xattr_value,
    + size_t xattr_value_len)
    +{
    + return;
    +}
    +
    +static inline int evm_inode_removexattr(struct dentry *dentry,
    + const char *xattr_name)
    +{
    + return 0;
    +}
    +#endif /* CONFIG_EVM_H */
    +#endif /* LINUX_EVM_H */
    diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
    index 6ee52f1..ae9dbea 100644
    --- a/security/integrity/evm/evm_main.c
    +++ b/security/integrity/evm/evm_main.c
    @@ -18,6 +18,7 @@
    #include <linux/crypto.h>
    #include <linux/xattr.h>
    #include <linux/integrity.h>
    +#include <linux/evm.h>
    #include "evm.h"

    int evm_initialized;
    diff --git a/security/security.c b/security/security.c
    index 36a0de3..c373c5f 100644
    --- a/security/security.c
    +++ b/security/security.c
    @@ -18,6 +18,7 @@
    #include <linux/security.h>
    #include <linux/integrity.h>
    #include <linux/ima.h>
    +#include <linux/evm.h>

    /* Boot-time LSM user choice */
    static __initdata char chosen_lsm[SECURITY_NAME_MAX + 1] =
    @@ -548,9 +549,14 @@ int security_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
    int security_inode_setxattr(struct dentry *dentry, const char *name,
    const void *value, size_t size, int flags)
    {
    + int ret;
    +
    if (unlikely(IS_PRIVATE(dentry->d_inode)))
    return 0;
    - return security_ops->inode_setxattr(dentry, name, value, size, flags);
    + ret = security_ops->inode_setxattr(dentry, name, value, size, flags);
    + if (ret)
    + return ret;
    + return evm_inode_setxattr(dentry, name, value, size);
    }

    void security_inode_post_setxattr(struct dentry *dentry, const char *name,
    @@ -559,6 +565,7 @@ void security_inode_post_setxattr(struct dentry *dentry, const char *name,
    if (unlikely(IS_PRIVATE(dentry->d_inode)))
    return;
    security_ops->inode_post_setxattr(dentry, name, value, size, flags);
    + evm_inode_post_setxattr(dentry, name, value, size);
    }

    int security_inode_getxattr(struct dentry *dentry, const char *name)
    @@ -577,9 +584,14 @@ int security_inode_listxattr(struct dentry *dentry)

    int security_inode_removexattr(struct dentry *dentry, const char *name)
    {
    + int ret;
    +
    if (unlikely(IS_PRIVATE(dentry->d_inode)))
    return 0;
    - return security_ops->inode_removexattr(dentry, name);
    + ret = security_ops->inode_removexattr(dentry, name);
    + if (ret)
    + return ret;
    + return evm_inode_removexattr(dentry, name);
    }

    int security_inode_need_killpriv(struct dentry *dentry)
    --
    1.7.1.1


    \
     
     \ /
      Last update: 2010-07-30 17:51    [W:0.033 / U:59.932 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site