procfs: add smack subdir to attrs

Back in 2007 I made what turned out to be a rather serious
mistake in the implementation of the Smack security module.
The SELinux module used an interface in /proc to manipulate
the security context on processes. Rather than use a similar
interface, I used the same interface. The AppArmor team did
likewise. Now /proc/.../attr/current will tell you the
security "context" of the process, but it will be different
depending on the security module you're using.

This patch provides a subdirectory in /proc/.../attr for
Smack. Smack user space can use the "current" file in
this subdirectory and never have to worry about getting
SELinux attributes by mistake. Programs that use the
old interface will continue to work (or fail, as the case
may be) as before.

The proposed S.A.R.A security module is dependent on
the mechanism to create its own attr subdirectory.

The original implementation is by Kees Cook.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kees Cook <keescook@chromium.org>

2 files changed, 56 insertions, 9 deletions

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 633a63462573..c9d775fd24ef 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -140,9 +140,13 @@ struct pid_entry {
 #define REG(NAME, MODE, fops)                           \
         NOD(NAME, (S_IFREG|(MODE)), NULL, &fops, {})
 #define ONE(NAME, MODE, show)                           \
-        NOD(NAME, (S_IFREG|(MODE)),                     \
+        NOD(NAME, (S_IFREG|(MODE)),                     \
                 NULL, &proc_single_file_operations,     \
                 { .proc_show = show } )
+#define ATTR(LSM, NAME, MODE)                           \
+        NOD(NAME, (S_IFREG|(MODE)),                     \
+                NULL, &proc_pid_attr_operations,        \
+                { .lsm = LSM })
 
 /*
  * Count the number of hardlinks for the pid_entry table, excluding the .
@@ -2525,7 +2529,7 @@ static ssize_t proc_pid_attr_read(struct file * file, char __user * buf,
         if (!task)
                 return -ESRCH;
 
-        length = security_getprocattr(task,
+        length = security_getprocattr(task, PROC_I(inode)->op.lsm,
                                       (char*)file->f_path.dentry->d_name.name,
                                       &p);
         put_task_struct(task);
@@ -2574,7 +2578,9 @@ static ssize_t proc_pid_attr_write(struct file * file, const char __user * buf,
         if (rv < 0)
                 goto out_free;
 
-        rv = security_setprocattr(file->f_path.dentry->d_name.name, page, count);
+        rv = security_setprocattr(PROC_I(inode)->op.lsm,
+                                  file->f_path.dentry->d_name.name, page,
+                                  count);
         mutex_unlock(&current->signal->cred_guard_mutex);
 out_free:
         kfree(page);
@@ -2588,13 +2594,53 @@ static const struct file_operations proc_pid_attr_operations = {
         .llseek         = generic_file_llseek,
 };
 
+#define LSM_DIR_OPS(LSM) \
+static int proc_##LSM##_attr_dir_iterate(struct file *filp, \
+                             struct dir_context *ctx) \
+{ \
+        return proc_pident_readdir(filp, ctx, \
+                                   LSM##_attr_dir_stuff, \
+                                   ARRAY_SIZE(LSM##_attr_dir_stuff)); \
+} \
+\
+static const struct file_operations proc_##LSM##_attr_dir_ops = { \
+        .read           = generic_read_dir, \
+        .iterate        = proc_##LSM##_attr_dir_iterate, \
+        .llseek         = default_llseek, \
+}; \
+\
+static struct dentry *proc_##LSM##_attr_dir_lookup(struct inode *dir, \
+                                struct dentry *dentry, unsigned int flags) \
+{ \
+        return proc_pident_lookup(dir, dentry, \
+                                  LSM##_attr_dir_stuff, \
+                                  ARRAY_SIZE(LSM##_attr_dir_stuff)); \
+} \
+\
+static const struct inode_operations proc_##LSM##_attr_dir_inode_ops = { \
+        .lookup         = proc_##LSM##_attr_dir_lookup, \
+        .getattr        = pid_getattr, \
+        .setattr        = proc_setattr, \
+}
+
+#ifdef CONFIG_SECURITY_SMACK
+static const struct pid_entry smack_attr_dir_stuff[] = {
+        ATTR("smack", "current",        0666),
+};
+LSM_DIR_OPS(smack);
+#endif
+
 static const struct pid_entry attr_dir_stuff[] = {
-        REG("current",    S_IRUGO|S_IWUGO, proc_pid_attr_operations),
-        REG("prev",       S_IRUGO,         proc_pid_attr_operations),
-        REG("exec",       S_IRUGO|S_IWUGO, proc_pid_attr_operations),
-        REG("fscreate",   S_IRUGO|S_IWUGO, proc_pid_attr_operations),
-        REG("keycreate",  S_IRUGO|S_IWUGO, proc_pid_attr_operations),
-        REG("sockcreate", S_IRUGO|S_IWUGO, proc_pid_attr_operations),
+        ATTR(NULL, "current",           0666),
+        ATTR(NULL, "prev",              0444),
+        ATTR(NULL, "exec",              0666),
+        ATTR(NULL, "fscreate",          0666),
+        ATTR(NULL, "keycreate",         0666),
+        ATTR(NULL, "sockcreate",        0666),
+#ifdef CONFIG_SECURITY_SMACK
+        DIR("smack",                    0555,
+            proc_smack_attr_dir_inode_ops, proc_smack_attr_dir_ops),
+#endif
 };
 
 static int proc_attr_dir_readdir(struct file *file, struct dir_context *ctx)
diff --git a/fs/proc/internal.h b/fs/proc/internal.h
index 5185d7f6a51e..d4f9989063d0 100644
--- a/fs/proc/internal.h
+++ b/fs/proc/internal.h
@@ -81,6 +81,7 @@ union proc_op {
         int (*proc_show)(struct seq_file *m,
                 struct pid_namespace *ns, struct pid *pid,
                 struct task_struct *task);
+        const char *lsm;
 };
 
 struct proc_inode {