Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit344fa64

Browse files
committed
security: Add a hook for the point of notification insertion
Add a security hook that allows an LSM to rule on whether a notificationmessage is allowed to be inserted into a particular watch queue.The hook is given the following information: (1) The credentials of the triggerer (which may be init_cred for a system notification, eg. a hardware error). (2) The credentials of the whoever set the watch. (3) The notification message.Signed-off-by: David Howells <dhowells@redhat.com>Acked-by: James Morris <jamorris@linux.microsoft.com>cc: Casey Schaufler <casey@schaufler-ca.com>cc: Stephen Smalley <sds@tycho.nsa.gov>cc: linux-security-module@vger.kernel.org
1 parent0858caa commit344fa64

File tree

4 files changed

+38
-0
lines changed

4 files changed

+38
-0
lines changed

‎include/linux/lsm_hook_defs.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,6 +253,11 @@ LSM_HOOK(int, 0, inode_setsecctx, struct dentry *dentry, void *ctx, u32 ctxlen)
253253
LSM_HOOK(int,0,inode_getsecctx,structinode*inode,void**ctx,
254254
u32*ctxlen)
255255

256+
#if defined(CONFIG_SECURITY)&& defined(CONFIG_WATCH_QUEUE)
257+
LSM_HOOK(int,0,post_notification,conststructcred*w_cred,
258+
conststructcred*cred,structwatch_notification*n)
259+
#endif/* CONFIG_SECURITY && CONFIG_KEY_NOTIFICATIONS */
260+
256261
#ifdefCONFIG_SECURITY_NETWORK
257262
LSM_HOOK(int,0,unix_stream_connect,structsock*sock,structsock*other,
258263
structsock*newsk)

‎include/linux/lsm_hooks.h‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1437,6 +1437,15 @@
14371437
*@ctx is a pointer in which to place the allocated security context.
14381438
*@ctxlen points to the place to put the length of @ctx.
14391439
*
1440+
* Security hooks for the general notification queue:
1441+
*
1442+
* @post_notification:
1443+
*Check to see if a watch notification can be posted to a particular
1444+
*queue.
1445+
*@w_cred: The credentials of the whoever set the watch.
1446+
*@cred: The event-triggerer's credentials
1447+
*@n: The notification being posted
1448+
*
14401449
* Security hooks for using the eBPF maps and programs functionalities through
14411450
* eBPF syscalls.
14421451
*

‎include/linux/security.h‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,8 @@ struct mm_struct;
5656
structfs_context;
5757
structfs_parameter;
5858
enumfs_value_type;
59+
structwatch;
60+
structwatch_notification;
5961

6062
/* Default (no) options for the capable function */
6163
#defineCAP_OPT_NONE 0x0
@@ -1275,6 +1277,19 @@ static inline int security_locked_down(enum lockdown_reason what)
12751277
}
12761278
#endif/* CONFIG_SECURITY */
12771279

1280+
#if defined(CONFIG_SECURITY)&& defined(CONFIG_WATCH_QUEUE)
1281+
intsecurity_post_notification(conststructcred*w_cred,
1282+
conststructcred*cred,
1283+
structwatch_notification*n);
1284+
#else
1285+
staticinlineintsecurity_post_notification(conststructcred*w_cred,
1286+
conststructcred*cred,
1287+
structwatch_notification*n)
1288+
{
1289+
return0;
1290+
}
1291+
#endif
1292+
12781293
#ifdefCONFIG_SECURITY_NETWORK
12791294

12801295
intsecurity_unix_stream_connect(structsock*sock,structsock*other,structsock*newsk);

‎security/security.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2007,6 +2007,15 @@ int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
20072007
}
20082008
EXPORT_SYMBOL(security_inode_getsecctx);
20092009

2010+
#ifdefCONFIG_WATCH_QUEUE
2011+
intsecurity_post_notification(conststructcred*w_cred,
2012+
conststructcred*cred,
2013+
structwatch_notification*n)
2014+
{
2015+
returncall_int_hook(post_notification,0,w_cred,cred,n);
2016+
}
2017+
#endif/* CONFIG_WATCH_QUEUE */
2018+
20102019
#ifdefCONFIG_SECURITY_NETWORK
20112020

20122021
intsecurity_unix_stream_connect(structsock*sock,structsock*other,structsock*newsk)

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp