Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6bb76184 authored by Andrey Markovytch's avatar Andrey Markovytch Committed by Gerrit - the friendly Code Review server
Browse files

security: switched to stackable model for PFT/PFK module 



Moved hooks from SELINUX framework to general SECURITY framework

Change-Id: I37e701b4925c4993f724c32b258c5088f4dcbe4d
Signed-off-by: default avatarAndrey Markovytch <andreym@codeaurora.org>
parent c1b67407

include/linux/security.h

+0 −7
Original line number Diff line number Diff line
@@ -1572,7 +1572,6 @@ struct security_operations { 
				    struct fown_struct *fown, int sig);

	int (*file_receive) (struct file *file);

	int (*file_open) (struct file *file, const struct cred *cred);

	int (*file_close)(struct file *file);

	bool (*allow_merge_bio)(struct bio *bio1, struct bio *bio2);



	int (*task_create) (unsigned long clone_flags);
@@ -1855,7 +1854,6 @@ int security_file_send_sigiotask(struct task_struct *tsk, 
				 struct fown_struct *fown, int sig);

int security_file_receive(struct file *file);

int security_file_open(struct file *file, const struct cred *cred);

int security_file_close(struct file *file);

bool security_allow_merge_bio(struct bio *bio1, struct bio *bio2);



int security_task_create(unsigned long clone_flags);
@@ -2381,11 +2379,6 @@ static inline int security_file_open(struct file *file, 
	return 0;

}



static inline int security_file_close(struct file *file)

{

	return 0;

}



static inline bool security_allow_merge_bio(struct bio *bio1, struct bio *bio2)

{

	return true;

security/pfe/Kconfig

+1 −0
Original line number Diff line number Diff line
@@ -16,6 +16,7 @@ config PFK 
	bool "Per-File-Key driver"

	depends on SECURITY

	depends on ECRYPT_FS

	depends on SECURITY_SELINUX

	default n

	help

		This driver is used for storing eCryptfs information

security/pfe/pfk.c

+3 −53
Original line number Diff line number Diff line
@@ -88,63 +88,13 @@ static char *inode_to_filename(struct inode *inode) 
	return filename;

}



static int pfk_inode_alloc_security(struct inode *inode)

{

	struct inode_security_struct *i_sec = NULL;



	if (inode == NULL)

		return -EINVAL;



	i_sec = kzalloc(sizeof(*i_sec), GFP_KERNEL);



	if (i_sec == NULL)

		return -ENOMEM;



	inode->i_security = i_sec;



	return 0;

}



static void pfk_inode_free_security(struct inode *inode)

{

	if (inode == NULL)

		return;



	kzfree(inode->i_security);

}



static struct security_operations pfk_security_ops = {

	.name			= "pfk",



	.inode_alloc_security	= pfk_inode_alloc_security,

	.inode_free_security	= pfk_inode_free_security,



	.allow_merge_bio	= pfk_allow_merge_bio,

};



static int __init pfk_lsm_init(void)

{

	int ret;



	/* Check if PFK is the chosen lsm via security_module_enable() */

	if (security_module_enable(&pfk_security_ops)) {

		/* replace null callbacks with empty callbacks */

		security_fixup_ops(&pfk_security_ops);

		ret = register_security(&pfk_security_ops);

		if (ret != 0) {

			pr_err("pfk lsm registeration failed, ret=%d.\n", ret);

			return ret;

		}

		pr_debug("pfk is the chosen lsm, registered successfully !\n");

	} else {

		pr_debug("pfk is not the chosen lsm.\n");

	if (!selinux_is_enabled()) {

		pr_err("se linux is not enabled.\n");

		return -ENODEV;

	}



	}



	return 0;

}

security/pfe/pft.c

+4 −3
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.

 * Copyright (c) 2014-2016, The Linux Foundation. All rights reserved.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU General Public License version 2 and
@@ -216,12 +216,13 @@ static int __init pft_lsm_init(struct pft_device *dev) 
		ret = register_security(&pft_security_ops);

		if (ret) {

			pr_err("pft lsm registeration failed, ret=%d.\n", ret);

			return 0;

			return ret;

		}

		dev->is_chosen_lsm = true;

		pr_debug("pft is the chosen lsm, registered successfully !\n");

	} else {

		pr_debug("pft is not the chosen lsm.\n");

		pr_err("pft is not the chosen lsm.\n");

		return -ENODEV;

	}



	return 0;

security/security.c

+5 −10
Original line number Diff line number Diff line
@@ -25,6 +25,7 @@ 
#include <linux/mount.h>

#include <linux/personality.h>

#include <linux/backing-dev.h>

#include <linux/pfk.h>

#include <net/flow.h>



#define MAX_LSM_EVM_XATTR	2
@@ -832,20 +833,14 @@ int security_file_open(struct file *file, const struct cred *cred) 
	return fsnotify_perm(file, MAY_OPEN);

}



int security_file_close(struct file *file)

{

	if (security_ops->file_close)

		return security_ops->file_close(file);



	return 0;

}



bool security_allow_merge_bio(struct bio *bio1, struct bio *bio2)

{

	bool ret = pfk_allow_merge_bio(bio1, bio2);



	if (security_ops->allow_merge_bio)

		return security_ops->allow_merge_bio(bio1, bio2);

		ret = ret && security_ops->allow_merge_bio(bio1, bio2);



	return true;

	return ret;

}



int security_task_create(unsigned long clone_flags)