aboutsummaryrefslogtreecommitdiffstats
path: root/security/selinux
diff options
context:
space:
mode:
Diffstat (limited to 'security/selinux')
-rw-r--r--security/selinux/hooks.c64
-rw-r--r--security/selinux/include/av_perm_to_string.h6
-rw-r--r--security/selinux/include/av_permissions.h8
-rw-r--r--security/selinux/include/class_to_string.h1
-rw-r--r--security/selinux/include/flask.h1
-rw-r--r--security/selinux/include/objsec.h5
6 files changed, 85 insertions, 0 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 54adc9d31e92..524915dfda64 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4252,6 +4252,57 @@ static int selinux_setprocattr(struct task_struct *p,
4252 return size; 4252 return size;
4253} 4253}
4254 4254
4255#ifdef CONFIG_KEYS
4256
4257static int selinux_key_alloc(struct key *k, struct task_struct *tsk)
4258{
4259 struct task_security_struct *tsec = tsk->security;
4260 struct key_security_struct *ksec;
4261
4262 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4263 if (!ksec)
4264 return -ENOMEM;
4265
4266 ksec->obj = k;
4267 ksec->sid = tsec->sid;
4268 k->security = ksec;
4269
4270 return 0;
4271}
4272
4273static void selinux_key_free(struct key *k)
4274{
4275 struct key_security_struct *ksec = k->security;
4276
4277 k->security = NULL;
4278 kfree(ksec);
4279}
4280
4281static int selinux_key_permission(key_ref_t key_ref,
4282 struct task_struct *ctx,
4283 key_perm_t perm)
4284{
4285 struct key *key;
4286 struct task_security_struct *tsec;
4287 struct key_security_struct *ksec;
4288
4289 key = key_ref_to_ptr(key_ref);
4290
4291 tsec = ctx->security;
4292 ksec = key->security;
4293
4294 /* if no specific permissions are requested, we skip the
4295 permission check. No serious, additional covert channels
4296 appear to be created. */
4297 if (perm == 0)
4298 return 0;
4299
4300 return avc_has_perm(tsec->sid, ksec->sid,
4301 SECCLASS_KEY, perm, NULL);
4302}
4303
4304#endif
4305
4255static struct security_operations selinux_ops = { 4306static struct security_operations selinux_ops = {
4256 .ptrace = selinux_ptrace, 4307 .ptrace = selinux_ptrace,
4257 .capget = selinux_capget, 4308 .capget = selinux_capget,
@@ -4406,6 +4457,12 @@ static struct security_operations selinux_ops = {
4406 .xfrm_state_delete_security = selinux_xfrm_state_delete, 4457 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4407 .xfrm_policy_lookup = selinux_xfrm_policy_lookup, 4458 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4408#endif 4459#endif
4460
4461#ifdef CONFIG_KEYS
4462 .key_alloc = selinux_key_alloc,
4463 .key_free = selinux_key_free,
4464 .key_permission = selinux_key_permission,
4465#endif
4409}; 4466};
4410 4467
4411static __init int selinux_init(void) 4468static __init int selinux_init(void)
@@ -4441,6 +4498,13 @@ static __init int selinux_init(void)
4441 } else { 4498 } else {
4442 printk(KERN_INFO "SELinux: Starting in permissive mode\n"); 4499 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4443 } 4500 }
4501
4502#ifdef CONFIG_KEYS
4503 /* Add security information to initial keyrings */
4504 security_key_alloc(&root_user_keyring, current);
4505 security_key_alloc(&root_session_keyring, current);
4506#endif
4507
4444 return 0; 4508 return 0;
4445} 4509}
4446 4510
diff --git a/security/selinux/include/av_perm_to_string.h b/security/selinux/include/av_perm_to_string.h
index 70ee65a58817..bc020bde6c86 100644
--- a/security/selinux/include/av_perm_to_string.h
+++ b/security/selinux/include/av_perm_to_string.h
@@ -242,3 +242,9 @@
242 S_(SECCLASS_PACKET, PACKET__SEND, "send") 242 S_(SECCLASS_PACKET, PACKET__SEND, "send")
243 S_(SECCLASS_PACKET, PACKET__RECV, "recv") 243 S_(SECCLASS_PACKET, PACKET__RECV, "recv")
244 S_(SECCLASS_PACKET, PACKET__RELABELTO, "relabelto") 244 S_(SECCLASS_PACKET, PACKET__RELABELTO, "relabelto")
245 S_(SECCLASS_KEY, KEY__VIEW, "view")
246 S_(SECCLASS_KEY, KEY__READ, "read")
247 S_(SECCLASS_KEY, KEY__WRITE, "write")
248 S_(SECCLASS_KEY, KEY__SEARCH, "search")
249 S_(SECCLASS_KEY, KEY__LINK, "link")
250 S_(SECCLASS_KEY, KEY__SETATTR, "setattr")
diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h
index 1d9cf3d306bc..1205227a3a33 100644
--- a/security/selinux/include/av_permissions.h
+++ b/security/selinux/include/av_permissions.h
@@ -959,3 +959,11 @@
959#define PACKET__SEND 0x00000001UL 959#define PACKET__SEND 0x00000001UL
960#define PACKET__RECV 0x00000002UL 960#define PACKET__RECV 0x00000002UL
961#define PACKET__RELABELTO 0x00000004UL 961#define PACKET__RELABELTO 0x00000004UL
962
963#define KEY__VIEW 0x00000001UL
964#define KEY__READ 0x00000002UL
965#define KEY__WRITE 0x00000004UL
966#define KEY__SEARCH 0x00000008UL
967#define KEY__LINK 0x00000010UL
968#define KEY__SETATTR 0x00000020UL
969
diff --git a/security/selinux/include/class_to_string.h b/security/selinux/include/class_to_string.h
index 3aec75fee4f7..24303b61309f 100644
--- a/security/selinux/include/class_to_string.h
+++ b/security/selinux/include/class_to_string.h
@@ -60,3 +60,4 @@
60 S_("netlink_kobject_uevent_socket") 60 S_("netlink_kobject_uevent_socket")
61 S_("appletalk_socket") 61 S_("appletalk_socket")
62 S_("packet") 62 S_("packet")
63 S_("key")
diff --git a/security/selinux/include/flask.h b/security/selinux/include/flask.h
index a0eb9e281d18..95887aed2a68 100644
--- a/security/selinux/include/flask.h
+++ b/security/selinux/include/flask.h
@@ -62,6 +62,7 @@
62#define SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET 55 62#define SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET 55
63#define SECCLASS_APPLETALK_SOCKET 56 63#define SECCLASS_APPLETALK_SOCKET 56
64#define SECCLASS_PACKET 57 64#define SECCLASS_PACKET 57
65#define SECCLASS_KEY 58
65 66
66/* 67/*
67 * Security identifier indices for initial entities 68 * Security identifier indices for initial entities
diff --git a/security/selinux/include/objsec.h b/security/selinux/include/objsec.h
index 54c030778882..8f5547ad1856 100644
--- a/security/selinux/include/objsec.h
+++ b/security/selinux/include/objsec.h
@@ -99,6 +99,11 @@ struct sk_security_struct {
99 u32 peer_sid; /* SID of peer */ 99 u32 peer_sid; /* SID of peer */
100}; 100};
101 101
102struct key_security_struct {
103 struct key *obj; /* back pointer */
104 u32 sid; /* SID of key */
105};
106
102extern unsigned int selinux_checkreqprot; 107extern unsigned int selinux_checkreqprot;
103 108
104#endif /* _SELINUX_OBJSEC_H_ */ 109#endif /* _SELINUX_OBJSEC_H_ */