Skip to content

Commit a04a119

Browse files
cschauflerpcmoore
cschaufler
authored and
pcmoore
committed
LSM: syscalls for current process attributes
Create a system call lsm_get_self_attr() to provide the security module maintained attributes of the current process. Create a system call lsm_set_self_attr() to set a security module maintained attribute of the current process. Historically these attributes have been exposed to user space via entries in procfs under /proc/self/attr. The attribute value is provided in a lsm_ctx structure. The structure identifies the size of the attribute, and the attribute value. The format of the attribute value is defined by the security module. A flags field is included for LSM specific information. It is currently unused and must be 0. The total size of the data, including the lsm_ctx structure and any padding, is maintained as well. struct lsm_ctx { __u64 id; __u64 flags; __u64 len; __u64 ctx_len; __u8 ctx[]; }; Two new LSM hooks are used to interface with the LSMs. security_getselfattr() collects the lsm_ctx values from the LSMs that support the hook, accounting for space requirements. security_setselfattr() identifies which LSM the attribute is intended for and passes it along. Signed-off-by: Casey Schaufler <[email protected]> Reviewed-by: Kees Cook <[email protected]> Reviewed-by: Serge Hallyn <[email protected]> Reviewed-by: John Johansen <[email protected]> Signed-off-by: Paul Moore <[email protected]>
1 parent 267c068 commit a04a119

10 files changed

Lines changed: 347 additions & 0 deletions

File tree

‎Documentation/userspace-api/lsm.rst‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
.. SPDX-License-Identifier: GPL-2.0
2+
.. Copyright (C) 2022 Casey Schaufler <[email protected]>
3+
.. Copyright (C) 2022 Intel Corporation
4+
5+
=====================================
6+
Linux Security Modules
7+
=====================================
8+
9+
:Author: Casey Schaufler
10+
:Date: July 2023
11+
12+
Linux security modules (LSM) provide a mechanism to implement
13+
additional access controls to the Linux security policies.
14+
15+
The various security modules may support any of these attributes:
16+
17+
``LSM_ATTR_CURRENT`` is the current, active security context of the
18+
process.
19+
The proc filesystem provides this value in ``/proc/self/attr/current``.
20+
This is supported by the SELinux, Smack and AppArmor security modules.
21+
Smack also provides this value in ``/proc/self/attr/smack/current``.
22+
AppArmor also provides this value in ``/proc/self/attr/apparmor/current``.
23+
24+
``LSM_ATTR_EXEC`` is the security context of the process at the time the
25+
current image was executed.
26+
The proc filesystem provides this value in ``/proc/self/attr/exec``.
27+
This is supported by the SELinux and AppArmor security modules.
28+
AppArmor also provides this value in ``/proc/self/attr/apparmor/exec``.
29+
30+
``LSM_ATTR_FSCREATE`` is the security context of the process used when
31+
creating file system objects.
32+
The proc filesystem provides this value in ``/proc/self/attr/fscreate``.
33+
This is supported by the SELinux security module.
34+
35+
``LSM_ATTR_KEYCREATE`` is the security context of the process used when
36+
creating key objects.
37+
The proc filesystem provides this value in ``/proc/self/attr/keycreate``.
38+
This is supported by the SELinux security module.
39+
40+
``LSM_ATTR_PREV`` is the security context of the process at the time the
41+
current security context was set.
42+
The proc filesystem provides this value in ``/proc/self/attr/prev``.
43+
This is supported by the SELinux and AppArmor security modules.
44+
AppArmor also provides this value in ``/proc/self/attr/apparmor/prev``.
45+
46+
``LSM_ATTR_SOCKCREATE`` is the security context of the process used when
47+
creating socket objects.
48+
The proc filesystem provides this value in ``/proc/self/attr/sockcreate``.
49+
This is supported by the SELinux security module.
50+
51+
Kernel interface
52+
================
53+
54+
Set a security attribute of the current process
55+
-----------------------------------------------
56+
57+
.. kernel-doc:: security/lsm_syscalls.c
58+
:identifiers: sys_lsm_set_self_attr
59+
60+
Get the specified security attributes of the current process
61+
------------------------------------------------------------
62+
63+
.. kernel-doc:: security/lsm_syscalls.c
64+
:identifiers: sys_lsm_get_self_attr
65+
66+
Additional documentation
67+
========================
68+
69+
* Documentation/security/lsm.rst
70+
* Documentation/security/lsm-development.rst

‎include/linux/lsm_hook_defs.h‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -262,6 +262,10 @@ LSM_HOOK(int, 0, sem_semop, struct kern_ipc_perm *perm, struct sembuf *sops,
262262
LSM_HOOK(int, 0, netlink_send, struct sock *sk, struct sk_buff *skb)
263263
LSM_HOOK(void, LSM_RET_VOID, d_instantiate, struct dentry *dentry,
264264
struct inode *inode)
265+
LSM_HOOK(int, -EOPNOTSUPP, getselfattr, unsigned int attr,
266+
struct lsm_ctx __user *ctx, size_t *size, u32 flags)
267+
LSM_HOOK(int, -EOPNOTSUPP, setselfattr, unsigned int attr,
268+
struct lsm_ctx *ctx, size_t size, u32 flags)
265269
LSM_HOOK(int, -EINVAL, getprocattr, struct task_struct *p, const char *name,
266270
char **value)
267271
LSM_HOOK(int, -EINVAL, setprocattr, const char *name, void *value, size_t size)

‎include/linux/lsm_hooks.h‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
#ifndef __LINUX_LSM_HOOKS_H
2626
#define __LINUX_LSM_HOOKS_H
2727

28+
#include <uapi/linux/lsm.h>
2829
#include <linux/security.h>
2930
#include <linux/init.h>
3031
#include <linux/rculist.h>

‎include/linux/security.h‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ struct fs_parameter;
6060
enum fs_value_type;
6161
struct watch;
6262
struct watch_notification;
63+
struct lsm_ctx;
6364

6465
/* Default (no) options for the capable function */
6566
#define CAP_OPT_NONE 0x0
@@ -472,6 +473,10 @@ int security_sem_semctl(struct kern_ipc_perm *sma, int cmd);
472473
int security_sem_semop(struct kern_ipc_perm *sma, struct sembuf *sops,
473474
unsigned nsops, int alter);
474475
void security_d_instantiate(struct dentry *dentry, struct inode *inode);
476+
int security_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
477+
size_t __user *size, u32 flags);
478+
int security_setselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
479+
size_t size, u32 flags);
475480
int security_getprocattr(struct task_struct *p, int lsmid, const char *name,
476481
char **value);
477482
int security_setprocattr(int lsmid, const char *name, void *value, size_t size);
@@ -1338,6 +1343,20 @@ static inline void security_d_instantiate(struct dentry *dentry,
13381343
struct inode *inode)
13391344
{ }
13401345

1346+
static inline int security_getselfattr(unsigned int attr,
1347+
struct lsm_ctx __user *ctx,
1348+
size_t __user *size, u32 flags)
1349+
{
1350+
return -EOPNOTSUPP;
1351+
}
1352+
1353+
static inline int security_setselfattr(unsigned int attr,
1354+
struct lsm_ctx __user *ctx,
1355+
size_t size, u32 flags)
1356+
{
1357+
return -EOPNOTSUPP;
1358+
}
1359+
13411360
static inline int security_getprocattr(struct task_struct *p, int lsmid,
13421361
const char *name, char **value)
13431362
{

‎include/linux/syscalls.h‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,7 @@ struct clone_args;
7171
struct open_how;
7272
struct mount_attr;
7373
struct landlock_ruleset_attr;
74+
struct lsm_ctx;
7475
enum landlock_rule_type;
7576
struct cachestat_range;
7677
struct cachestat;
@@ -949,6 +950,10 @@ asmlinkage long sys_cachestat(unsigned int fd,
949950
struct cachestat_range __user *cstat_range,
950951
struct cachestat __user *cstat, unsigned int flags);
951952
asmlinkage long sys_map_shadow_stack(unsigned long addr, unsigned long size, unsigned int flags);
953+
asmlinkage long sys_lsm_get_self_attr(unsigned int attr, struct lsm_ctx *ctx,
954+
size_t *size, __u32 flags);
955+
asmlinkage long sys_lsm_set_self_attr(unsigned int attr, struct lsm_ctx *ctx,
956+
size_t size, __u32 flags);
952957

953958
/*
954959
* Architecture-specific system calls

‎include/uapi/linux/lsm.h‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,36 @@
99
#ifndef _UAPI_LINUX_LSM_H
1010
#define _UAPI_LINUX_LSM_H
1111

12+
#include <linux/types.h>
13+
#include <linux/unistd.h>
14+
15+
/**
16+
* struct lsm_ctx - LSM context information
17+
* @id: the LSM id number, see LSM_ID_XXX
18+
* @flags: LSM specific flags
19+
* @len: length of the lsm_ctx struct, @ctx and any other data or padding
20+
* @ctx_len: the size of @ctx
21+
* @ctx: the LSM context value
22+
*
23+
* The @len field MUST be equal to the size of the lsm_ctx struct
24+
* plus any additional padding and/or data placed after @ctx.
25+
*
26+
* In all cases @ctx_len MUST be equal to the length of @ctx.
27+
* If @ctx is a string value it should be nul terminated with
28+
* @ctx_len equal to `strlen(@ctx) + 1`. Binary values are
29+
* supported.
30+
*
31+
* The @flags and @ctx fields SHOULD only be interpreted by the
32+
* LSM specified by @id; they MUST be set to zero/0 when not used.
33+
*/
34+
struct lsm_ctx {
35+
__u64 id;
36+
__u64 flags;
37+
__u64 len;
38+
__u64 ctx_len;
39+
__u8 ctx[];
40+
};
41+
1242
/*
1343
* ID tokens to identify Linux Security Modules (LSMs)
1444
*
@@ -51,4 +81,10 @@
5181
#define LSM_ATTR_PREV 104
5282
#define LSM_ATTR_SOCKCREATE 105
5383

84+
/*
85+
* LSM_FLAG_XXX definitions identify special handling instructions
86+
* for the API.
87+
*/
88+
#define LSM_FLAG_SINGLE 0x0001
89+
5490
#endif /* _UAPI_LINUX_LSM_H */

‎kernel/sys_ni.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -171,6 +171,8 @@ COND_SYSCALL(landlock_add_rule);
171171
COND_SYSCALL(landlock_restrict_self);
172172
COND_SYSCALL(fadvise64_64);
173173
COND_SYSCALL_COMPAT(fadvise64_64);
174+
COND_SYSCALL(lsm_get_self_attr);
175+
COND_SYSCALL(lsm_set_self_attr);
174176

175177
/* CONFIG_MMU only */
176178
COND_SYSCALL(swapon);

‎security/Makefile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ obj-$(CONFIG_KEYS) += keys/
77

88
# always enable default capabilities
99
obj-y += commoncap.o
10+
obj-$(CONFIG_SECURITY) += lsm_syscalls.o
1011
obj-$(CONFIG_MMU) += min_addr.o
1112

1213
# Object file lists

‎security/lsm_syscalls.c‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
// SPDX-License-Identifier: GPL-2.0-only
2+
/*
3+
* System calls implementing the Linux Security Module API.
4+
*
5+
* Copyright (C) 2022 Casey Schaufler <[email protected]>
6+
* Copyright (C) 2022 Intel Corporation
7+
*/
8+
9+
#include <asm/current.h>
10+
#include <linux/compiler_types.h>
11+
#include <linux/err.h>
12+
#include <linux/errno.h>
13+
#include <linux/security.h>
14+
#include <linux/stddef.h>
15+
#include <linux/syscalls.h>
16+
#include <linux/types.h>
17+
#include <linux/lsm_hooks.h>
18+
#include <uapi/linux/lsm.h>
19+
20+
/**
21+
* sys_lsm_set_self_attr - Set current task's security module attribute
22+
* @attr: which attribute to set
23+
* @ctx: the LSM contexts
24+
* @size: size of @ctx
25+
* @flags: reserved for future use
26+
*
27+
* Sets the calling task's LSM context. On success this function
28+
* returns 0. If the attribute specified cannot be set a negative
29+
* value indicating the reason for the error is returned.
30+
*/
31+
SYSCALL_DEFINE4(lsm_set_self_attr, unsigned int, attr, struct lsm_ctx __user *,
32+
ctx, size_t, size, u32, flags)
33+
{
34+
return security_setselfattr(attr, ctx, size, flags);
35+
}
36+
37+
/**
38+
* sys_lsm_get_self_attr - Return current task's security module attributes
39+
* @attr: which attribute to return
40+
* @ctx: the user-space destination for the information, or NULL
41+
* @size: pointer to the size of space available to receive the data
42+
* @flags: special handling options. LSM_FLAG_SINGLE indicates that only
43+
* attributes associated with the LSM identified in the passed @ctx be
44+
* reported.
45+
*
46+
* Returns the calling task's LSM contexts. On success this
47+
* function returns the number of @ctx array elements. This value
48+
* may be zero if there are no LSM contexts assigned. If @size is
49+
* insufficient to contain the return data -E2BIG is returned and
50+
* @size is set to the minimum required size. In all other cases
51+
* a negative value indicating the error is returned.
52+
*/
53+
SYSCALL_DEFINE4(lsm_get_self_attr, unsigned int, attr, struct lsm_ctx __user *,
54+
ctx, size_t __user *, size, u32, flags)
55+
{
56+
return security_getselfattr(attr, ctx, size, flags);
57+
}

0 commit comments

Comments
 (0)