Return-Path: linux-nfs-owner@vger.kernel.org Received: from mx1.redhat.com ([209.132.183.28]:7423 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755750Ab3C3UxV (ORCPT ); Sat, 30 Mar 2013 16:53:21 -0400 Message-ID: <51575074.7020401@RedHat.com> Date: Sat, 30 Mar 2013 16:52:04 -0400 From: Steve Dickson MIME-Version: 1.0 To: Mimi Zohar CC: Trond Myklebust , "J. Bruce Fields" , "David P. Quigley" , Linux NFS list Subject: Re: [PATCH 02/14] Security: Add Hook to test if the particular xattr is part of a MAC model. References: <1364478845-29796-1-git-send-email-SteveD@redhat.com> <1364478845-29796-3-git-send-email-SteveD@redhat.com> <1364557380.2580.189.camel@falcor1.watson.ibm.com> In-Reply-To: <1364557380.2580.189.camel@falcor1.watson.ibm.com> Content-Type: text/plain; charset=UTF-8 Sender: linux-nfs-owner@vger.kernel.org List-ID: On 29/03/13 07:43, Mimi Zohar wrote: > On Thu, 2013-03-28 at 09:53 -0400, Steve Dickson wrote: >> From: David Quigley >> >> The interface to request security labels from user space is the xattr >> interface. When requesting the security label from an NFS server it is >> important to make sure the requested xattr actually is a MAC label. This allows >> us to make sure that we get the desired semantics from the attribute instead of >> something else such as capabilities or a time based LSM. >> >> Signed-off-by: Matthew N. Dodd >> Signed-off-by: Miguel Rodel Felipe >> Signed-off-by: Phua Eu Gene >> Signed-off-by: Khin Mi Mi Aung >> --- >> include/linux/security.h | 14 ++++++++++++++ >> security/capability.c | 6 ++++++ >> security/security.c | 6 ++++++ >> security/selinux/hooks.c | 6 ++++++ >> security/smack/smack_lsm.c | 11 +++++++++++ >> 5 files changed, 43 insertions(+) >> >> diff --git a/include/linux/security.h b/include/linux/security.h >> index a957e7a..8a6faff 100644 >> --- a/include/linux/security.h >> +++ b/include/linux/security.h >> @@ -1319,6 +1319,13 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) >> * @pages contains the number of pages. >> * Return 0 if permission is granted. >> * >> + * @ismaclabel: >> + * Check if the extended attribute specified by @name >> + * represents a MAC label. Returns 0 if name is a MAC >> + * attribute otherwise returns non-zero. > > Sorry, the comment doesn't match the code. Nice catch! thanks! steved. > > Mimi > >> + * @name full extended attribute name to check against >> + * LSM as a MAC label. >> + * > > >> * @secid_to_secctx: >> * Convert secid to security context. If secdata is NULL the length of >> * the result will be returned in seclen, but no secdata will be returned. >> @@ -1600,6 +1607,7 @@ struct security_operations { >> >> int (*getprocattr) (struct task_struct *p, char *name, char **value); >> int (*setprocattr) (struct task_struct *p, char *name, void *value, size_t size); >> + int (*ismaclabel) (const char *name); >> int (*secid_to_secctx) (u32 secid, char **secdata, u32 *seclen); >> int (*secctx_to_secid) (const char *secdata, u32 seclen, u32 *secid); >> void (*release_secctx) (char *secdata, u32 seclen); >> @@ -1852,6 +1860,7 @@ void security_d_instantiate(struct dentry *dentry, struct inode *inode); >> int security_getprocattr(struct task_struct *p, char *name, char **value); >> int security_setprocattr(struct task_struct *p, char *name, void *value, size_t size); >> int security_netlink_send(struct sock *sk, struct sk_buff *skb); >> +int security_ismaclabel(const char *name); >> int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen); >> int security_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid); >> void security_release_secctx(char *secdata, u32 seclen); >> @@ -2540,6 +2549,11 @@ static inline int security_netlink_send(struct sock *sk, struct sk_buff *skb) >> return cap_netlink_send(sk, skb); >> } >> >> +static inline int security_ismaclabel(const char *name) >> +{ >> + return 0; >> +} >> + >> static inline int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) >> { >> return -EOPNOTSUPP; >> diff --git a/security/capability.c b/security/capability.c >> index 456bd9d..07a6484 100644 >> --- a/security/capability.c >> +++ b/security/capability.c >> @@ -817,6 +817,11 @@ static int cap_setprocattr(struct task_struct *p, char *name, void *value, >> return -EINVAL; >> } >> >> +static int cap_ismaclabel(const char *name) >> +{ >> + return 0; >> +} >> + >> static int cap_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) >> { >> return -EOPNOTSUPP; >> @@ -1036,6 +1041,7 @@ void __init security_fixup_ops(struct security_operations *ops) >> set_to_cap_if_null(ops, d_instantiate); >> set_to_cap_if_null(ops, getprocattr); >> set_to_cap_if_null(ops, setprocattr); >> + set_to_cap_if_null(ops, ismaclabel); >> set_to_cap_if_null(ops, secid_to_secctx); >> set_to_cap_if_null(ops, secctx_to_secid); >> set_to_cap_if_null(ops, release_secctx); >> diff --git a/security/security.c b/security/security.c >> index 723a10c..6d7389c 100644 >> --- a/security/security.c >> +++ b/security/security.c >> @@ -1057,6 +1057,12 @@ int security_netlink_send(struct sock *sk, struct sk_buff *skb) >> return security_ops->netlink_send(sk, skb); >> } >> >> +int security_ismaclabel(const char *name) >> +{ >> + return security_ops->ismaclabel(name); >> +} >> +EXPORT_SYMBOL(security_ismaclabel); >> + >> int security_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) >> { >> return security_ops->secid_to_secctx(secid, secdata, seclen); >> diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c >> index c7f1905..97231a0 100644 >> --- a/security/selinux/hooks.c >> +++ b/security/selinux/hooks.c >> @@ -5417,6 +5417,11 @@ abort_change: >> return error; >> } >> >> +static int selinux_ismaclabel(const char *name) >> +{ >> + return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0); >> +} >> + >> static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) >> { >> return security_sid_to_context(secid, secdata, seclen); >> @@ -5655,6 +5660,7 @@ static struct security_operations selinux_ops = { >> .getprocattr = selinux_getprocattr, >> .setprocattr = selinux_setprocattr, >> >> + .ismaclabel = selinux_ismaclabel, >> .secid_to_secctx = selinux_secid_to_secctx, >> .secctx_to_secid = selinux_secctx_to_secid, >> .release_secctx = selinux_release_secctx, >> diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c >> index fa64740..ca01d71 100644 >> --- a/security/smack/smack_lsm.c >> +++ b/security/smack/smack_lsm.c >> @@ -3329,6 +3329,16 @@ static void smack_audit_rule_free(void *vrule) >> #endif /* CONFIG_AUDIT */ >> >> /** >> + * smack_ismaclabel - check if xattr @name references a smack MAC label >> + * @name: Full xattr name to check. >> + */ >> +static int smack_ismaclabel(const char *name) >> +{ >> + return (strcmp(name, XATTR_SMACK_SUFFIX) == 0); >> +} >> + >> + >> +/** >> * smack_secid_to_secctx - return the smack label for a secid >> * @secid: incoming integer >> * @secdata: destination >> @@ -3524,6 +3534,7 @@ struct security_operations smack_ops = { >> .audit_rule_free = smack_audit_rule_free, >> #endif /* CONFIG_AUDIT */ >> >> + .ismaclabel = smack_ismaclabel, >> .secid_to_secctx = smack_secid_to_secctx, >> .secctx_to_secid = smack_secctx_to_secid, >> .release_secctx = smack_release_secctx, > > >