Messages in this thread Patch in this message | | | From | Jarkko Sakkinen <> | Subject | [PATCH] Smack: Use secureexec with SMACK64EXEC | Date | Tue, 20 Sep 2011 15:37:34 +0300 |
| |
SMACK64EXEC extended attribute allows switching to another security context when executing a file.
This patch enables secureexec bit in ELF auxiliary vector so that code cannot be injected from executers security context.
Signed-off-by: Jarkko Sakkinen <jarkko.sakkinen@intel.com> --- security/smack/smack.h | 5 +++++ security/smack/smack_lsm.c | 15 ++++++++++++++- 2 files changed, 19 insertions(+), 1 deletions(-)
diff --git a/security/smack/smack.h b/security/smack/smack.h index 2b6c6a5..e41fb07 100644 --- a/security/smack/smack.h +++ b/security/smack/smack.h @@ -181,6 +181,11 @@ struct smack_known { #define SMK_NUM_ACCESS_TYPE 4 /* + * Passed in the bprm->unsafe field + */ +#define SMK_SECUREEXEC_NEEDED 0x8000 + +/* * Smack audit data; is empty if CONFIG_AUDIT not set * to save some stack */ diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c index b9c5e14..3ea018d 100644 --- a/security/smack/smack_lsm.c +++ b/security/smack/smack_lsm.c @@ -465,12 +465,24 @@ static int smack_bprm_set_creds(struct linux_binprm *bprm) isp = dp->d_inode->i_security; - if (isp->smk_task != NULL) + if (isp->smk_task != NULL) { tsp->smk_task = isp->smk_task; + bprm->unsafe = SMK_SECUREEXEC_NEEDED; + } return 0; } +int smack_bprm_secureexec(struct linux_binprm *bprm) +{ + int ret = cap_bprm_secureexec(bprm); + + if (!ret && (bprm->unsafe & SMK_SECUREEXEC_NEEDED)) + ret = 1; + + return ret; +} + /* * Inode hooks */ @@ -3409,6 +3421,7 @@ struct security_operations smack_ops = { .sb_umount = smack_sb_umount, .bprm_set_creds = smack_bprm_set_creds, + .bprm_secureexec = smack_bprm_secureexec, .inode_alloc_security = smack_inode_alloc_security, .inode_free_security = smack_inode_free_security, -- 1.7.4.1
| |