Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d69dece5 authored by Casey Schaufler's avatar Casey Schaufler Committed by James Morris
Browse files

LSM: Add /sys/kernel/security/lsm 



I am still tired of having to find indirect ways to determine
what security modules are active on a system. I have added
/sys/kernel/security/lsm, which contains a comma separated
list of the active security modules. No more groping around
in /proc/filesystems or other clever hacks.

Unchanged from previous versions except for being updated
to the latest security next branch.

Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Acked-by: default avatarJohn Johansen <john.johansen@canonical.com>
Acked-by: default avatarPaul Moore <paul@paul-moore.com>
Acked-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
parent 3ccb76c5

Documentation/security/LSM.txt

+7 −0
Original line number Diff line number Diff line
@@ -22,6 +22,13 @@ system, building their checks on top of the defined capability hooks. 
For more details on capabilities, see capabilities(7) in the Linux

man-pages project.



A list of the active security modules can be found by reading

/sys/kernel/security/lsm. This is a comma separated list, and

will always include the capability module. The list reflects the

order in which checks are made. The capability module will always

be first, followed by any "minor" modules (e.g. Yama) and then

the one "major" module (e.g. SELinux) if there is one configured.



Based on https://lkml.org/lkml/2007/10/26/215,

a new LSM is accepted into the kernel when its intent (a description of

what it tries to protect against and in what cases one would expect to

include/linux/lsm_hooks.h

+4 −8
Original line number Diff line number Diff line
@@ -1875,6 +1875,7 @@ struct security_hook_list { 
	struct list_head		list;

	struct list_head		*head;

	union security_list_options	hook;

	char				*lsm;

};



/*
@@ -1887,15 +1888,10 @@ struct security_hook_list { 
	{ .head = &security_hook_heads.HEAD, .hook = { .HEAD = HOOK } }



extern struct security_hook_heads security_hook_heads;

extern char *lsm_names;



static inline void security_add_hooks(struct security_hook_list *hooks,

				      int count)

{

	int i;



	for (i = 0; i < count; i++)

		list_add_tail_rcu(&hooks[i].list, hooks[i].head);

}

extern void security_add_hooks(struct security_hook_list *hooks, int count,

				char *lsm);



#ifdef CONFIG_SECURITY_SELINUX_DISABLE

/*

security/apparmor/lsm.c

+2 −1
Original line number Diff line number Diff line
@@ -999,7 +999,8 @@ static int __init apparmor_init(void) 
		aa_free_root_ns();

		goto buffers_out;

	}

	security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks));

	security_add_hooks(apparmor_hooks, ARRAY_SIZE(apparmor_hooks),

				"apparmor");



	/* Report that AppArmor successfully initialized */

	apparmor_initialized = 1;

security/commoncap.c

+2 −1
Original line number Diff line number Diff line
@@ -1093,7 +1093,8 @@ struct security_hook_list capability_hooks[] = { 


void __init capability_add_hooks(void)

{

	security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks));

	security_add_hooks(capability_hooks, ARRAY_SIZE(capability_hooks),

				"capability");

}



#endif /* CONFIG_SECURITY */

security/inode.c

+24 −2
Original line number Diff line number Diff line
@@ -20,6 +20,7 @@ 
#include <linux/init.h>

#include <linux/namei.h>

#include <linux/security.h>

#include <linux/lsm_hooks.h>

#include <linux/magic.h>



static struct vfsmount *mount;
@@ -204,6 +205,21 @@ void securityfs_remove(struct dentry *dentry) 
}

EXPORT_SYMBOL_GPL(securityfs_remove);



#ifdef CONFIG_SECURITY

static struct dentry *lsm_dentry;

static ssize_t lsm_read(struct file *filp, char __user *buf, size_t count,

			loff_t *ppos)

{

	return simple_read_from_buffer(buf, count, ppos, lsm_names,

		strlen(lsm_names));

}



static const struct file_operations lsm_ops = {

	.read = lsm_read,

	.llseek = generic_file_llseek,

};

#endif



static int __init securityfs_init(void)

{

	int retval;
@@ -213,10 +229,16 @@ static int __init securityfs_init(void) 
		return retval;



	retval = register_filesystem(&fs_type);

	if (retval)

	if (retval) {

		sysfs_remove_mount_point(kernel_kobj, "security");

		return retval;

	}

#ifdef CONFIG_SECURITY

	lsm_dentry = securityfs_create_file("lsm", 0444, NULL, NULL,

						&lsm_ops);

#endif

	return 0;

}



core_initcall(securityfs_init);

MODULE_LICENSE("GPL");