Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3a3b7ce9 authored by David Howells's avatar David Howells Committed by James Morris
Browse files

CRED: Allow kernel services to override LSM settings for task actions 



Allow kernel services to override LSM settings appropriate to the actions
performed by a task by duplicating a set of credentials, modifying it and then
using task_struct::cred to point to it when performing operations on behalf of
a task.

This is used, for example, by CacheFiles which has to transparently access the
cache on behalf of a process that thinks it is doing, say, NFS accesses with a
potentially inappropriate (with respect to accessing the cache) set of
credentials.

This patch provides two LSM hooks for modifying a task security record:

 (*) security_kernel_act_as() which allows modification of the security datum
     with which a task acts on other objects (most notably files).

 (*) security_kernel_create_files_as() which allows modification of the
     security datum that is used to initialise the security data on a file that
     a task creates.

The patch also provides four new credentials handling functions, which wrap the
LSM functions:

 (1) prepare_kernel_cred()

     Prepare a set of credentials for a kernel service to use, based either on
     a daemon's credentials or on init_cred.  All the keyrings are cleared.

 (2) set_security_override()

     Set the LSM security ID in a set of credentials to a specific security
     context, assuming permission from the LSM policy.

 (3) set_security_override_from_ctx()

     As (2), but takes the security context as a string.

 (4) set_create_files_as()

     Set the file creation LSM security ID in a set of credentials to be the
     same as that on a particular inode.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com> [Smack changes]
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 1bfdc75a

include/linux/cred.h

+6 −0
Original line number Diff line number Diff line
@@ -18,6 +18,7 @@ 


struct user_struct;

struct cred;

struct inode;



/*

 * COW Supplementary groups list
@@ -148,6 +149,11 @@ extern int commit_creds(struct cred *); 
extern void abort_creds(struct cred *);

extern const struct cred *override_creds(const struct cred *);

extern void revert_creds(const struct cred *);

extern struct cred *prepare_kernel_cred(struct task_struct *);

extern int change_create_files_as(struct cred *, struct inode *);

extern int set_security_override(struct cred *, u32);

extern int set_security_override_from_ctx(struct cred *, const char *);

extern int set_create_files_as(struct cred *, struct inode *);

extern void __init cred_init(void);



/**

include/linux/security.h

+28 −0
Original line number Diff line number Diff line
@@ -587,6 +587,19 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts) 
 *	@new points to the new credentials.

 *	@old points to the original credentials.

 *	Install a new set of credentials.

 * @kernel_act_as:

 *	Set the credentials for a kernel service to act as (subjective context).

 *	@new points to the credentials to be modified.

 *	@secid specifies the security ID to be set

 *	The current task must be the one that nominated @secid.

 *	Return 0 if successful.

 * @kernel_create_files_as:

 *	Set the file creation context in a set of credentials to be the same as

 *	the objective context of the specified inode.

 *	@new points to the credentials to be modified.

 *	@inode points to the inode to use as a reference.

 *	The current task must be the one that nominated @inode.

 *	Return 0 if successful.

 * @task_setuid:

 *	Check permission before setting one or more of the user identity

 *	attributes of the current process.  The @flags parameter indicates
@@ -1381,6 +1394,8 @@ struct security_operations { 
	int (*cred_prepare)(struct cred *new, const struct cred *old,

			    gfp_t gfp);

	void (*cred_commit)(struct cred *new, const struct cred *old);

	int (*kernel_act_as)(struct cred *new, u32 secid);

	int (*kernel_create_files_as)(struct cred *new, struct inode *inode);

	int (*task_setuid) (uid_t id0, uid_t id1, uid_t id2, int flags);

	int (*task_fix_setuid) (struct cred *new, const struct cred *old,

				int flags);
@@ -1632,6 +1647,8 @@ int security_task_create(unsigned long clone_flags); 
void security_cred_free(struct cred *cred);

int security_prepare_creds(struct cred *new, const struct cred *old, gfp_t gfp);

void security_commit_creds(struct cred *new, const struct cred *old);

int security_kernel_act_as(struct cred *new, u32 secid);

int security_kernel_create_files_as(struct cred *new, struct inode *inode);

int security_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags);

int security_task_fix_setuid(struct cred *new, const struct cred *old,

			     int flags);
@@ -2151,6 +2168,17 @@ static inline void security_commit_creds(struct cred *new, 
{

}



static inline int security_kernel_act_as(struct cred *cred, u32 secid)

{

	return 0;

}



static inline int security_kernel_create_files_as(struct cred *cred,

						  struct inode *inode)

{

	return 0;

}



static inline int security_task_setuid(uid_t id0, uid_t id1, uid_t id2,

				       int flags)

{

kernel/cred.c

+113 −0
Original line number Diff line number Diff line
@@ -462,3 +462,116 @@ void __init cred_init(void) 
	cred_jar = kmem_cache_create("cred_jar", sizeof(struct cred),

				     0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);

}



/**

 * prepare_kernel_cred - Prepare a set of credentials for a kernel service

 * @daemon: A userspace daemon to be used as a reference

 *

 * Prepare a set of credentials for a kernel service.  This can then be used to

 * override a task's own credentials so that work can be done on behalf of that

 * task that requires a different subjective context.

 *

 * @daemon is used to provide a base for the security record, but can be NULL.

 * If @daemon is supplied, then the security data will be derived from that;

 * otherwise they'll be set to 0 and no groups, full capabilities and no keys.

 *

 * The caller may change these controls afterwards if desired.

 *

 * Returns the new credentials or NULL if out of memory.

 *

 * Does not take, and does not return holding current->cred_replace_mutex.

 */

struct cred *prepare_kernel_cred(struct task_struct *daemon)

{

	const struct cred *old;

	struct cred *new;



	new = kmem_cache_alloc(cred_jar, GFP_KERNEL);

	if (!new)

		return NULL;



	if (daemon)

		old = get_task_cred(daemon);

	else

		old = get_cred(&init_cred);



	get_uid(new->user);

	get_group_info(new->group_info);



#ifdef CONFIG_KEYS

	atomic_inc(&init_tgcred.usage);

	new->tgcred = &init_tgcred;

	new->request_key_auth = NULL;

	new->thread_keyring = NULL;

	new->jit_keyring = KEY_REQKEY_DEFL_THREAD_KEYRING;

#endif



#ifdef CONFIG_SECURITY

	new->security = NULL;

#endif

	if (security_prepare_creds(new, old, GFP_KERNEL) < 0)

		goto error;



	atomic_set(&new->usage, 1);

	put_cred(old);

	return new;



error:

	put_cred(new);

	return NULL;

}

EXPORT_SYMBOL(prepare_kernel_cred);



/**

 * set_security_override - Set the security ID in a set of credentials

 * @new: The credentials to alter

 * @secid: The LSM security ID to set

 *

 * Set the LSM security ID in a set of credentials so that the subjective

 * security is overridden when an alternative set of credentials is used.

 */

int set_security_override(struct cred *new, u32 secid)

{

	return security_kernel_act_as(new, secid);

}

EXPORT_SYMBOL(set_security_override);



/**

 * set_security_override_from_ctx - Set the security ID in a set of credentials

 * @new: The credentials to alter

 * @secctx: The LSM security context to generate the security ID from.

 *

 * Set the LSM security ID in a set of credentials so that the subjective

 * security is overridden when an alternative set of credentials is used.  The

 * security ID is specified in string form as a security context to be

 * interpreted by the LSM.

 */

int set_security_override_from_ctx(struct cred *new, const char *secctx)

{

	u32 secid;

	int ret;



	ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);

	if (ret < 0)

		return ret;



	return set_security_override(new, secid);

}

EXPORT_SYMBOL(set_security_override_from_ctx);



/**

 * set_create_files_as - Set the LSM file create context in a set of credentials

 * @new: The credentials to alter

 * @inode: The inode to take the context from

 *

 * Change the LSM file creation context in a set of credentials to be the same

 * as the object context of the specified inode, so that the new inodes have

 * the same MAC context as that inode.

 */

int set_create_files_as(struct cred *new, struct inode *inode)

{

	new->fsuid = inode->i_uid;

	new->fsgid = inode->i_gid;

	return security_kernel_create_files_as(new, inode);

}

EXPORT_SYMBOL(set_create_files_as);

security/capability.c

+12 −0
Original line number Diff line number Diff line
@@ -348,6 +348,16 @@ static void cap_cred_commit(struct cred *new, const struct cred *old) 
{

}



static int cap_kernel_act_as(struct cred *new, u32 secid)

{

	return 0;

}



static int cap_kernel_create_files_as(struct cred *new, struct inode *inode)

{

	return 0;

}



static int cap_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)

{

	return 0;
@@ -889,6 +899,8 @@ void security_fixup_ops(struct security_operations *ops) 
	set_to_cap_if_null(ops, cred_free);

	set_to_cap_if_null(ops, cred_prepare);

	set_to_cap_if_null(ops, cred_commit);

	set_to_cap_if_null(ops, kernel_act_as);

	set_to_cap_if_null(ops, kernel_create_files_as);

	set_to_cap_if_null(ops, task_setuid);

	set_to_cap_if_null(ops, task_fix_setuid);

	set_to_cap_if_null(ops, task_setgid);

security/security.c

+10 −0
Original line number Diff line number Diff line
@@ -616,6 +616,16 @@ void security_commit_creds(struct cred *new, const struct cred *old) 
	return security_ops->cred_commit(new, old);

}



int security_kernel_act_as(struct cred *new, u32 secid)

{

	return security_ops->kernel_act_as(new, secid);

}



int security_kernel_create_files_as(struct cred *new, struct inode *inode)

{

	return security_ops->kernel_create_files_as(new, inode);

}



int security_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)

{

	return security_ops->task_setuid(id0, id1, id2, flags);