LSM: Infrastructure management of the ipc security blob

Move management of the kern_ipc_perm->security and
msg_msg->security blobs out of the individual security
modules and into the security infrastructure. Instead
of allocating the blobs from within the modules the modules
tell the infrastructure how much space is required, and
the space is allocated there.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
[kees: adjusted for ordered init series]
Signed-off-by: Kees Cook <keescook@chromium.org>

1 files changed, 87 insertions, 4 deletions

diff --git a/security/security.c b/security/security.c
index e59a1e1514ee..953fc3ea18a9 100644
--- a/security/security.c
+++ b/security/security.c
@@ -30,6 +30,7 @@
 #include <linux/personality.h>
 #include <linux/backing-dev.h>
 #include <linux/string.h>
+#include <linux/msg.h>
 #include <net/flow.h>
 
 #define MAX_LSM_EVM_XATTR       2
@@ -169,6 +170,8 @@ static void __init lsm_set_blob_sizes(struct lsm_blob_sizes *needed)
         if (needed->lbs_inode && blob_sizes.lbs_inode == 0)
                 blob_sizes.lbs_inode = sizeof(struct rcu_head);
         lsm_set_blob_size(&needed->lbs_inode, &blob_sizes.lbs_inode);
+        lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc);
+        lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg);
         lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task);
 }
 
@@ -293,6 +296,8 @@ static void __init ordered_lsm_init(void)
         init_debug("cred blob size     = %d\n", blob_sizes.lbs_cred);
         init_debug("file blob size     = %d\n", blob_sizes.lbs_file);
         init_debug("inode blob size    = %d\n", blob_sizes.lbs_inode);
+        init_debug("ipc blob size      = %d\n", blob_sizes.lbs_ipc);
+        init_debug("msg_msg blob size  = %d\n", blob_sizes.lbs_msg_msg);
         init_debug("task blob size     = %d\n", blob_sizes.lbs_task);
 
         /*
@@ -539,6 +544,48 @@ int lsm_task_alloc(struct task_struct *task)
 }
 
 /**
+ * lsm_ipc_alloc - allocate a composite ipc blob
+ * @kip: the ipc that needs a blob
+ *
+ * Allocate the ipc blob for all the modules
+ *
+ * Returns 0, or -ENOMEM if memory can't be allocated.
+ */
+int lsm_ipc_alloc(struct kern_ipc_perm *kip)
+{
+        if (blob_sizes.lbs_ipc == 0) {
+                kip->security = NULL;
+                return 0;
+        }
+
+        kip->security = kzalloc(blob_sizes.lbs_ipc, GFP_KERNEL);
+        if (kip->security == NULL)
+                return -ENOMEM;
+        return 0;
+}
+
+/**
+ * lsm_msg_msg_alloc - allocate a composite msg_msg blob
+ * @mp: the msg_msg that needs a blob
+ *
+ * Allocate the ipc blob for all the modules
+ *
+ * Returns 0, or -ENOMEM if memory can't be allocated.
+ */
+int lsm_msg_msg_alloc(struct msg_msg *mp)
+{
+        if (blob_sizes.lbs_msg_msg == 0) {
+                mp->security = NULL;
+                return 0;
+        }
+
+        mp->security = kzalloc(blob_sizes.lbs_msg_msg, GFP_KERNEL);
+        if (mp->security == NULL)
+                return -ENOMEM;
+        return 0;
+}
+
+/**
  * lsm_early_task - during initialization allocate a composite task blob
  * @task: the task that needs a blob
  *
@@ -1631,22 +1678,40 @@ void security_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
 
 int security_msg_msg_alloc(struct msg_msg *msg)
 {
-        return call_int_hook(msg_msg_alloc_security, 0, msg);
+        int rc = lsm_msg_msg_alloc(msg);
+
+        if (unlikely(rc))
+                return rc;
+        rc = call_int_hook(msg_msg_alloc_security, 0, msg);
+        if (unlikely(rc))
+                security_msg_msg_free(msg);
+        return rc;
 }
 
 void security_msg_msg_free(struct msg_msg *msg)
 {
         call_void_hook(msg_msg_free_security, msg);
+        kfree(msg->security);
+        msg->security = NULL;
 }
 
 int security_msg_queue_alloc(struct kern_ipc_perm *msq)
 {
-        return call_int_hook(msg_queue_alloc_security, 0, msq);
+        int rc = lsm_ipc_alloc(msq);
+
+        if (unlikely(rc))
+                return rc;
+        rc = call_int_hook(msg_queue_alloc_security, 0, msq);
+        if (unlikely(rc))
+                security_msg_queue_free(msq);
+        return rc;
 }
 
 void security_msg_queue_free(struct kern_ipc_perm *msq)
 {
         call_void_hook(msg_queue_free_security, msq);
+        kfree(msq->security);
+        msq->security = NULL;
 }
 
 int security_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
@@ -1673,12 +1738,21 @@ int security_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
 
 int security_shm_alloc(struct kern_ipc_perm *shp)
 {
-        return call_int_hook(shm_alloc_security, 0, shp);
+        int rc = lsm_ipc_alloc(shp);
+
+        if (unlikely(rc))
+                return rc;
+        rc = call_int_hook(shm_alloc_security, 0, shp);
+        if (unlikely(rc))
+                security_shm_free(shp);
+        return rc;
 }
 
 void security_shm_free(struct kern_ipc_perm *shp)
 {
         call_void_hook(shm_free_security, shp);
+        kfree(shp->security);
+        shp->security = NULL;
 }
 
 int security_shm_associate(struct kern_ipc_perm *shp, int shmflg)
@@ -1698,12 +1772,21 @@ int security_shm_shmat(struct kern_ipc_perm *shp, char __user *shmaddr, int shmf
 
 int security_sem_alloc(struct kern_ipc_perm *sma)
 {
-        return call_int_hook(sem_alloc_security, 0, sma);
+        int rc = lsm_ipc_alloc(sma);
+
+        if (unlikely(rc))
+                return rc;
+        rc = call_int_hook(sem_alloc_security, 0, sma);
+        if (unlikely(rc))
+                security_sem_free(sma);
+        return rc;
 }
 
 void security_sem_free(struct kern_ipc_perm *sma)
 {
         call_void_hook(sem_free_security, sma);
+        kfree(sma->security);
+        sma->security = NULL;
 }
 
 int security_sem_associate(struct kern_ipc_perm *sma, int semflg)