selinux lsm IB/core: Implement LSM notification system

Add a generic notificaiton mechanism in the LSM. Interested consumers
can register a callback with the LSM and security modules can produce
events.

Because access to Infiniband QPs are enforced in the setup phase of a
connection security should be enforced again if the policy changes.
Register infiniband devices for policy change notification and check all
QPs on that device when the notification is received.

Add a call to the notification mechanism from SELinux when the AVC
cache changes or setenforce is cleared.

Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
Acked-by: James Morris <james.l.morris@oracle.com>
Acked-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Paul Moore <paul@paul-moore.com>

1 files changed, 11 insertions, 0 deletions

diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index cfb7ce339adc..b005acbcc6e9 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -171,6 +171,14 @@ static int selinux_netcache_avc_callback(u32 event)
         return 0;
 }
 
+static int selinux_lsm_notifier_avc_callback(u32 event)
+{
+        if (event == AVC_CALLBACK_RESET)
+                call_lsm_notifier(LSM_POLICY_CHANGE, NULL);
+
+        return 0;
+}
+
 /*
  * initialise the security for the init task
  */
@@ -6387,6 +6395,9 @@ static __init int selinux_init(void)
         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
                 panic("SELinux: Unable to register AVC netcache callback\n");
 
+        if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
+                panic("SELinux: Unable to register AVC LSM notifier callback\n");
+
         if (selinux_enforcing)
                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
         else