lsm: kdbus security hooks

This is combination of work by Karol Lewandowski and Paul Moore
on LSM hooks for kdbus.

Originates from:

git://git.infradead.org/users/pcmoore/selinux (branch: working-kdbus)
commit: 7050f206a79564886938d0edc4e1e9da5972c72d

https://github.com/lmctl/linux.git (branch: kdbus-lsm-v4.for-systemd-v212)
commit: a9fe4c33b6e5ab25a243e0590df406aabb6add12

Change-Id: Ie55cd3eb6427542856d15ded7ba986712c2b9453
Signed-off-by: Karol Lewandowski <k.lewandowsk@samsung.com>
Signed-off-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Paul Osmialowski <p.osmialowsk@samsung.com>

diff --git a/include/linux/security.h b/include/linux/security.h
index a1b7dbd127ffc73c1c07f3935ed9cd9118cfec52..96fcf21c02efa99a08367c30f1545f40174f791b 100644 (file)
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -53,6 +53,10 @@ struct msg_queue;
 struct xattr;
 struct xfrm_sec_ctx;
 struct mm_struct;
+struct kdbus_ep;
+struct kdbus_bus;
+struct kdbus_conn;
+struct kdbus_domain;
 
 /* Maximum number of letters for an LSM name string */
 #define SECURITY_NAME_MAX      10
@@ -1455,6 +1459,36 @@ static inline void security_free_mnt_opts(struct security_mnt_opts *opts)
  *     @inode we wish to get the security context of.
  *     @ctx is a pointer in which to place the allocated security context.
  *     @ctxlen points to the place to put the length of @ctx.
+ *
+ * @kdbus_domain_alloc:
+ *     Allocate kdbus domain.
+ * @kdbus_domain_free:
+ *     Deallocate kdbus domain.
+ * @kdbus_bus_alloc:
+ *     Allocate kdbus bus.
+ * @kdbus_bus_free:
+ *     Deallocate kdbus bus.
+ * @kdbus_send:
+ *     Send message.
+ * @kdbus_recv:
+ *     Receive message.
+ * @kdbus_name_acquire:
+ *     Request a well-known bus name to associate with the connection.
+ * @kdbus_name_list:
+ *     Retrieve the list of all currently registered well-known and unique
+ *     names.
+ * @kdbus_ep_create:
+ *     Endpoint create
+ * @kdbus_connect:
+ *     Connect
+ * @kdbus_conn_free:
+ *     Deallocate connection
+ * @kdbus_conn_info:
+ *     Retrieve credentials and properties of the initial creator of the
+ *     connection.
+ * @kdbus_talk:
+ *     Talk to a given peer.
+ *
  * This is the main security structure.
  */
 struct security_operations {
@@ -1672,6 +1706,29 @@ struct security_operations {
        int (*inode_setsecctx)(struct dentry *dentry, void *ctx, u32 ctxlen);
        int (*inode_getsecctx)(struct inode *inode, void **ctx, u32 *ctxlen);
 
+       int (*kdbus_domain_alloc)(struct kdbus_domain *domain);
+       void (*kdbus_domain_free)(struct kdbus_domain *domain);
+
+       int (*kdbus_bus_alloc)(struct kdbus_bus *bus);
+       void (*kdbus_bus_free)(struct kdbus_bus *bus);
+       int (*kdbus_send)(const struct kdbus_conn *conn,
+                         const struct kdbus_bus *bus);
+       int (*kdbus_recv)(const struct kdbus_conn *conn,
+                         const struct kdbus_bus *bus);
+       int (*kdbus_name_acquire)(const struct kdbus_conn *conn,
+                         const char *name);
+       int (*kdbus_name_list)(const struct kdbus_bus *bus);
+
+       int (*kdbus_ep_create)(const struct kdbus_bus *bus);
+       int (*kdbus_ep_setpolicy)(const struct kdbus_bus *bus);
+
+       int (*kdbus_connect)(struct kdbus_conn *conn,
+                            const char *secctx, u32 seclen);
+       void (*kdbus_conn_free)(struct kdbus_conn *conn);
+       int (*kdbus_conn_info)(const struct kdbus_conn *conn);
+       int (*kdbus_talk)(const struct kdbus_conn *src,
+                         const struct kdbus_conn *dst);
+
 #ifdef CONFIG_SECURITY_NETWORK
        int (*unix_stream_connect) (struct sock *sock, struct sock *other, struct sock *newsk);
        int (*unix_may_send) (struct socket *sock, struct socket *other);
@@ -1939,6 +1996,30 @@ void security_release_secctx(char *secdata, u32 seclen);
 int security_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen);
 int security_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen);
 int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen);
+
+int security_kdbus_domain_alloc(struct kdbus_domain *domain);
+void security_kdbus_domain_free(struct kdbus_domain *domain);
+
+int security_kdbus_bus_alloc(struct kdbus_bus *bus);
+void security_kdbus_bus_free(struct kdbus_bus *bus);
+int security_kdbus_send(const struct kdbus_conn *conn,
+                       const struct kdbus_bus *bus);
+int security_kdbus_recv(const struct kdbus_conn *conn,
+                       const struct kdbus_bus *bus);
+int security_kdbus_name_acquire(const struct kdbus_conn *conn,
+                               const char *name);
+int security_kdbus_name_list(const struct kdbus_bus *bus);
+
+int security_kdbus_ep_create(struct kdbus_bus *bus);
+int security_kdbus_ep_setpolicy(struct kdbus_bus *bus);
+
+int security_kdbus_connect(struct kdbus_conn *conn,
+                          const char *secctx, u32 seclen);
+void security_kdbus_conn_free(struct kdbus_conn *conn);
+int security_kdbus_conn_info(const struct kdbus_conn *conn);
+int security_kdbus_talk(const struct kdbus_conn *src,
+                       const struct kdbus_conn *dst);
+
 #else /* CONFIG_SECURITY */
 struct security_mnt_opts {
 };
@@ -2688,6 +2769,78 @@ static inline int security_inode_getsecctx(struct inode *inode, void **ctx, u32
 {
        return -EOPNOTSUPP;
 }
+
+static inline int security_kdbus_domain_alloc(struct kdbus_domain *domain)
+{
+       return 0;
+}
+static inline void security_kdbus_domain_free(struct kdbus_domain *domain)
+{
+}
+
+static inline int security_kdbus_bus_alloc(struct kdbus_bus *bus)
+{
+       return 0;
+}
+
+static inline void security_kdbus_bus_free(struct kdbus_bus *bus)
+{
+}
+
+static inline int security_kdbus_send(const struct kdbus_conn *conn,
+                                     const struct kdbus_bus *bus)
+{
+       return 0;
+}
+
+static inline int security_kdbus_recv(const struct kdbus_conn *conn,
+                                     const struct kdbus_bus *bus)
+{
+       return 0;
+}
+
+static inline int security_kdbus_name_acquire(const struct kdbus_conn *conn,
+                                             const char *name)
+{
+       return 0;
+}
+
+static inline int security_kdbus_name_list(const struct kdbus_bus *bus)
+{
+       return 0;
+}
+
+static inline int security_kdbus_ep_create(const struct kdbus_bus *bus)
+{
+       return 0;
+}
+
+static inline int security_kdbus_ep_setpolicy(const struct kdbus_bus *bus)
+{
+       return 0;
+}
+
+static inline int security_kdbus_connect(struct kdbus_conn *conn,
+                                        const char *secctx, u32 seclen)
+{
+       return 0;
+}
+
+static inline void security_kdbus_conn_free(struct kdbus_conn *conn)
+{
+}
+
+static inline int security_kdbus_conn_info(const struct kdbus_conn *conn)
+{
+       return 0;
+}
+
+static inline int security_kdbus_talk(const struct kdbus_conn *src,
+                                     const struct kdbus_conn *dst)
+{
+       return 0;
+}
+
 #endif /* CONFIG_SECURITY */
 
 #ifdef CONFIG_SECURITY_NETWORK

diff --git a/security/capability.c b/security/capability.c
index 070dd46f62f4f57c7262211352775e121439e8a2..41ec20c762eb48e72ffd7c9d2ccf9a03c0b1f356 100644 (file)
--- a/security/capability.c
+++ b/security/capability.c
@@ -595,6 +595,79 @@ static int cap_sem_semop(struct sem_array *sma, struct sembuf *sops,
        return 0;
 }
 
+static int cap_kdbus_domain_alloc(struct kdbus_domain *domain)
+{
+       return 0;
+}
+
+static void cap_kdbus_domain_free(struct kdbus_domain *domain)
+{
+}
+
+static int cap_kdbus_bus_alloc(struct kdbus_bus *bus)
+{
+       return 0;
+}
+
+static void cap_kdbus_bus_free(struct kdbus_bus *bus)
+{
+}
+
+static int cap_kdbus_send(const struct kdbus_conn *conn,
+                         const struct kdbus_bus *bus)
+
+{
+       return 0;
+}
+
+static int cap_kdbus_recv(const struct kdbus_conn *conn,
+                         const struct kdbus_bus *bus)
+{
+       return 0;
+}
+
+static int cap_kdbus_name_acquire(const struct kdbus_conn *conn,
+                                 const char *name)
+{
+       return 0;
+}
+
+static int cap_kdbus_name_list(const struct kdbus_bus *bus)
+{
+       return 0;
+}
+
+static int cap_kdbus_ep_create(const struct kdbus_bus *bus)
+{
+       return 0;
+}
+
+static int cap_kdbus_ep_setpolicy(const struct kdbus_bus *bus)
+{
+       return 0;
+}
+
+static int cap_kdbus_connect(struct kdbus_conn *conn,
+                            const char *secctx, u32 seclen)
+{
+       return 0;
+}
+
+static int cap_kdbus_conn_info(const struct kdbus_conn *conn)
+{
+       return 0;
+}
+
+static void cap_kdbus_conn_free(struct kdbus_conn *conn)
+{
+}
+
+static int cap_kdbus_talk(const struct kdbus_conn *src,
+                         const struct kdbus_conn *dst)
+{
+       return 0;
+}
+
 #ifdef CONFIG_SECURITY_NETWORK
 static int cap_unix_stream_connect(struct sock *sock, struct sock *other,
                                   struct sock *newsk)
@@ -1097,6 +1170,20 @@ void __init security_fixup_ops(struct security_operations *ops)
        set_to_cap_if_null(ops, inode_notifysecctx);
        set_to_cap_if_null(ops, inode_setsecctx);
        set_to_cap_if_null(ops, inode_getsecctx);
+       set_to_cap_if_null(ops, kdbus_domain_alloc);
+       set_to_cap_if_null(ops, kdbus_domain_free);
+       set_to_cap_if_null(ops, kdbus_bus_alloc);
+       set_to_cap_if_null(ops, kdbus_bus_free);
+       set_to_cap_if_null(ops, kdbus_send);
+       set_to_cap_if_null(ops, kdbus_recv);
+       set_to_cap_if_null(ops, kdbus_name_acquire);
+       set_to_cap_if_null(ops, kdbus_name_list);
+       set_to_cap_if_null(ops, kdbus_ep_create);
+       set_to_cap_if_null(ops, kdbus_ep_setpolicy);
+       set_to_cap_if_null(ops, kdbus_connect);
+       set_to_cap_if_null(ops, kdbus_conn_free);
+       set_to_cap_if_null(ops, kdbus_conn_info);
+       set_to_cap_if_null(ops, kdbus_talk);
 #ifdef CONFIG_SECURITY_NETWORK
        set_to_cap_if_null(ops, unix_stream_connect);
        set_to_cap_if_null(ops, unix_may_send);

diff --git a/security/security.c b/security/security.c
index 4d647c78ac6cad8ff1307b77e90bd3bd36c99a82..0e95549858d331d99a9ec4b812fb805a7b6bf409 100644 (file)
--- a/security/security.c
+++ b/security/security.c
@@ -1153,6 +1153,95 @@ int security_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
 }
 EXPORT_SYMBOL(security_inode_getsecctx);
 
+int security_kdbus_domain_alloc(struct kdbus_domain *domain)
+{
+       return security_ops->kdbus_domain_alloc(domain);
+}
+EXPORT_SYMBOL(security_kdbus_domain_alloc);
+
+void security_kdbus_domain_free(struct kdbus_domain *domain)
+{
+       security_ops->kdbus_domain_free(domain);
+}
+EXPORT_SYMBOL(security_kdbus_domain_free);
+
+int security_kdbus_bus_alloc(struct kdbus_bus *bus)
+{
+       return security_ops->kdbus_bus_alloc(bus);
+}
+EXPORT_SYMBOL(security_kdbus_bus_alloc);
+
+void security_kdbus_bus_free(struct kdbus_bus *bus)
+{
+       security_ops->kdbus_bus_free(bus);
+}
+EXPORT_SYMBOL(security_kdbus_bus_free);
+
+int security_kdbus_send(const struct kdbus_conn *conn,
+                       const struct kdbus_bus *bus)
+{
+       return security_ops->kdbus_send(conn, bus);
+}
+EXPORT_SYMBOL(security_kdbus_send);
+
+int security_kdbus_recv(const struct kdbus_conn *conn,
+                       const struct kdbus_bus *bus)
+{
+       return security_ops->kdbus_recv(conn, bus);
+}
+EXPORT_SYMBOL(security_kdbus_recv);
+
+int security_kdbus_name_acquire(const struct kdbus_conn *conn,
+                               const char *name)
+{
+       return security_ops->kdbus_name_acquire(conn, name);
+}
+EXPORT_SYMBOL(security_kdbus_name_acquire);
+
+int security_kdbus_name_list(const struct kdbus_bus *bus)
+{
+       return security_ops->kdbus_name_list(bus);
+}
+EXPORT_SYMBOL(security_kdbus_name_list);
+
+int security_kdbus_ep_create(struct kdbus_bus *bus)
+{
+       return security_ops->kdbus_ep_create(bus);
+}
+EXPORT_SYMBOL(security_kdbus_ep_create);
+
+int security_kdbus_ep_setpolicy(struct kdbus_bus *bus)
+{
+       return security_ops->kdbus_ep_setpolicy(bus);
+}
+EXPORT_SYMBOL(security_kdbus_ep_setpolicy);
+
+int security_kdbus_connect(struct kdbus_conn *conn,
+                          const char *secctx, u32 seclen)
+{
+       return security_ops->kdbus_connect(conn, secctx, seclen);
+}
+EXPORT_SYMBOL(security_kdbus_connect);
+
+void security_kdbus_conn_free(struct kdbus_conn *conn)
+{
+       security_ops->kdbus_conn_free(conn);
+}
+EXPORT_SYMBOL(security_kdbus_conn_free);
+
+int security_kdbus_conn_info(const struct kdbus_conn *conn)
+{
+       return security_ops->kdbus_conn_info(conn);
+}
+EXPORT_SYMBOL(security_kdbus_conn_info);
+
+int security_kdbus_talk(const struct kdbus_conn *src,
+                       const struct kdbus_conn *dst)
+{
+       return security_ops->kdbus_talk(src, dst);
+}
+EXPORT_SYMBOL(security_kdbus_talk);
+
 #ifdef CONFIG_SECURITY_NETWORK
 
 int security_unix_stream_connect(struct sock *sock, struct sock *other, struct sock *newsk)