aboutsummaryrefslogtreecommitdiffstats
path: root/include/linux/cred.h
diff options
context:
space:
mode:
authorDavid Howells <dhowells@redhat.com>2008-11-13 18:39:28 -0500
committerJames Morris <jmorris@namei.org>2008-11-13 18:39:28 -0500
commit3a3b7ce9336952ea7b9564d976d068a238976c9d (patch)
tree3f0a3be33022492161f534636a20a4b1059f8236 /include/linux/cred.h
parent1bfdc75ae077d60a01572a7781ec6264d55ab1b9 (diff)
CRED: Allow kernel services to override LSM settings for task actions
Allow kernel services to override LSM settings appropriate to the actions performed by a task by duplicating a set of credentials, modifying it and then using task_struct::cred to point to it when performing operations on behalf of a task. This is used, for example, by CacheFiles which has to transparently access the cache on behalf of a process that thinks it is doing, say, NFS accesses with a potentially inappropriate (with respect to accessing the cache) set of credentials. This patch provides two LSM hooks for modifying a task security record: (*) security_kernel_act_as() which allows modification of the security datum with which a task acts on other objects (most notably files). (*) security_kernel_create_files_as() which allows modification of the security datum that is used to initialise the security data on a file that a task creates. The patch also provides four new credentials handling functions, which wrap the LSM functions: (1) prepare_kernel_cred() Prepare a set of credentials for a kernel service to use, based either on a daemon's credentials or on init_cred. All the keyrings are cleared. (2) set_security_override() Set the LSM security ID in a set of credentials to a specific security context, assuming permission from the LSM policy. (3) set_security_override_from_ctx() As (2), but takes the security context as a string. (4) set_create_files_as() Set the file creation LSM security ID in a set of credentials to be the same as that on a particular inode. Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> [Smack changes] Signed-off-by: David Howells <dhowells@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>
Diffstat (limited to 'include/linux/cred.h')
-rw-r--r--include/linux/cred.h6
1 files changed, 6 insertions, 0 deletions
diff --git a/include/linux/cred.h b/include/linux/cred.h
index 55a9c995d694..26c1ab179946 100644
--- a/include/linux/cred.h
+++ b/include/linux/cred.h
@@ -18,6 +18,7 @@
18 18
19struct user_struct; 19struct user_struct;
20struct cred; 20struct cred;
21struct inode;
21 22
22/* 23/*
23 * COW Supplementary groups list 24 * COW Supplementary groups list
@@ -148,6 +149,11 @@ extern int commit_creds(struct cred *);
148extern void abort_creds(struct cred *); 149extern void abort_creds(struct cred *);
149extern const struct cred *override_creds(const struct cred *); 150extern const struct cred *override_creds(const struct cred *);
150extern void revert_creds(const struct cred *); 151extern void revert_creds(const struct cred *);
152extern struct cred *prepare_kernel_cred(struct task_struct *);
153extern int change_create_files_as(struct cred *, struct inode *);
154extern int set_security_override(struct cred *, u32);
155extern int set_security_override_from_ctx(struct cred *, const char *);
156extern int set_create_files_as(struct cred *, struct inode *);
151extern void __init cred_init(void); 157extern void __init cred_init(void);
152 158
153/** 159/**