Skip to content

Commit e20b043

Browse files
cschauflerJames Morris
cschaufler
authored and
James Morris
committed
LSM: Add security module hook list heads
Add a list header for each security hook. They aren't used until later in the patch series. They are grouped together in a structure so that there doesn't need to be an external address for each. Macro-ize the initialization of the security_operations for each security module in anticipation of changing out the security_operations structure. Signed-off-by: Casey Schaufler <[email protected]> Acked-by: John Johansen <[email protected]> Acked-by: Kees Cook <[email protected]> Acked-by: Paul Moore <[email protected]> Acked-by: Stephen Smalley <[email protected]> Acked-by: Tetsuo Handa <[email protected]> Signed-off-by: James Morris <[email protected]>
1 parent f25fce3 commit e20b043

File tree

6 files changed

+626
-402
lines changed

6 files changed

+626
-402
lines changed

‎include/linux/lsm_hooks.h

Lines changed: 220 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1626,6 +1626,226 @@ struct security_operations {
16261626
#endif /* CONFIG_AUDIT */
16271627
};
16281628

1629+
struct security_hook_heads {
1630+
struct list_head binder_set_context_mgr;
1631+
struct list_head binder_transaction;
1632+
struct list_head binder_transfer_binder;
1633+
struct list_head binder_transfer_file;
1634+
struct list_head ptrace_access_check;
1635+
struct list_head ptrace_traceme;
1636+
struct list_head capget;
1637+
struct list_head capset;
1638+
struct list_head capable;
1639+
struct list_head quotactl;
1640+
struct list_head quota_on;
1641+
struct list_head syslog;
1642+
struct list_head settime;
1643+
struct list_head vm_enough_memory;
1644+
struct list_head bprm_set_creds;
1645+
struct list_head bprm_check_security;
1646+
struct list_head bprm_secureexec;
1647+
struct list_head bprm_committing_creds;
1648+
struct list_head bprm_committed_creds;
1649+
struct list_head sb_alloc_security;
1650+
struct list_head sb_free_security;
1651+
struct list_head sb_copy_data;
1652+
struct list_head sb_remount;
1653+
struct list_head sb_kern_mount;
1654+
struct list_head sb_show_options;
1655+
struct list_head sb_statfs;
1656+
struct list_head sb_mount;
1657+
struct list_head sb_umount;
1658+
struct list_head sb_pivotroot;
1659+
struct list_head sb_set_mnt_opts;
1660+
struct list_head sb_clone_mnt_opts;
1661+
struct list_head sb_parse_opts_str;
1662+
struct list_head dentry_init_security;
1663+
#ifdef CONFIG_SECURITY_PATH
1664+
struct list_head path_unlink;
1665+
struct list_head path_mkdir;
1666+
struct list_head path_rmdir;
1667+
struct list_head path_mknod;
1668+
struct list_head path_truncate;
1669+
struct list_head path_symlink;
1670+
struct list_head path_link;
1671+
struct list_head path_rename;
1672+
struct list_head path_chmod;
1673+
struct list_head path_chown;
1674+
struct list_head path_chroot;
1675+
#endif
1676+
struct list_head inode_alloc_security;
1677+
struct list_head inode_free_security;
1678+
struct list_head inode_init_security;
1679+
struct list_head inode_create;
1680+
struct list_head inode_link;
1681+
struct list_head inode_unlink;
1682+
struct list_head inode_symlink;
1683+
struct list_head inode_mkdir;
1684+
struct list_head inode_rmdir;
1685+
struct list_head inode_mknod;
1686+
struct list_head inode_rename;
1687+
struct list_head inode_readlink;
1688+
struct list_head inode_follow_link;
1689+
struct list_head inode_permission;
1690+
struct list_head inode_setattr;
1691+
struct list_head inode_getattr;
1692+
struct list_head inode_setxattr;
1693+
struct list_head inode_post_setxattr;
1694+
struct list_head inode_getxattr;
1695+
struct list_head inode_listxattr;
1696+
struct list_head inode_removexattr;
1697+
struct list_head inode_need_killpriv;
1698+
struct list_head inode_killpriv;
1699+
struct list_head inode_getsecurity;
1700+
struct list_head inode_setsecurity;
1701+
struct list_head inode_listsecurity;
1702+
struct list_head inode_getsecid;
1703+
struct list_head file_permission;
1704+
struct list_head file_alloc_security;
1705+
struct list_head file_free_security;
1706+
struct list_head file_ioctl;
1707+
struct list_head mmap_addr;
1708+
struct list_head mmap_file;
1709+
struct list_head file_mprotect;
1710+
struct list_head file_lock;
1711+
struct list_head file_fcntl;
1712+
struct list_head file_set_fowner;
1713+
struct list_head file_send_sigiotask;
1714+
struct list_head file_receive;
1715+
struct list_head file_open;
1716+
struct list_head task_create;
1717+
struct list_head task_free;
1718+
struct list_head cred_alloc_blank;
1719+
struct list_head cred_free;
1720+
struct list_head cred_prepare;
1721+
struct list_head cred_transfer;
1722+
struct list_head kernel_act_as;
1723+
struct list_head kernel_create_files_as;
1724+
struct list_head kernel_fw_from_file;
1725+
struct list_head kernel_module_request;
1726+
struct list_head kernel_module_from_file;
1727+
struct list_head task_fix_setuid;
1728+
struct list_head task_setpgid;
1729+
struct list_head task_getpgid;
1730+
struct list_head task_getsid;
1731+
struct list_head task_getsecid;
1732+
struct list_head task_setnice;
1733+
struct list_head task_setioprio;
1734+
struct list_head task_getioprio;
1735+
struct list_head task_setrlimit;
1736+
struct list_head task_setscheduler;
1737+
struct list_head task_getscheduler;
1738+
struct list_head task_movememory;
1739+
struct list_head task_kill;
1740+
struct list_head task_wait;
1741+
struct list_head task_prctl;
1742+
struct list_head task_to_inode;
1743+
struct list_head ipc_permission;
1744+
struct list_head ipc_getsecid;
1745+
struct list_head msg_msg_alloc_security;
1746+
struct list_head msg_msg_free_security;
1747+
struct list_head msg_queue_alloc_security;
1748+
struct list_head msg_queue_free_security;
1749+
struct list_head msg_queue_associate;
1750+
struct list_head msg_queue_msgctl;
1751+
struct list_head msg_queue_msgsnd;
1752+
struct list_head msg_queue_msgrcv;
1753+
struct list_head shm_alloc_security;
1754+
struct list_head shm_free_security;
1755+
struct list_head shm_associate;
1756+
struct list_head shm_shmctl;
1757+
struct list_head shm_shmat;
1758+
struct list_head sem_alloc_security;
1759+
struct list_head sem_free_security;
1760+
struct list_head sem_associate;
1761+
struct list_head sem_semctl;
1762+
struct list_head sem_semop;
1763+
struct list_head netlink_send;
1764+
struct list_head d_instantiate;
1765+
struct list_head getprocattr;
1766+
struct list_head setprocattr;
1767+
struct list_head ismaclabel;
1768+
struct list_head secid_to_secctx;
1769+
struct list_head secctx_to_secid;
1770+
struct list_head release_secctx;
1771+
struct list_head inode_notifysecctx;
1772+
struct list_head inode_setsecctx;
1773+
struct list_head inode_getsecctx;
1774+
#ifdef CONFIG_SECURITY_NETWORK
1775+
struct list_head unix_stream_connect;
1776+
struct list_head unix_may_send;
1777+
struct list_head socket_create;
1778+
struct list_head socket_post_create;
1779+
struct list_head socket_bind;
1780+
struct list_head socket_connect;
1781+
struct list_head socket_listen;
1782+
struct list_head socket_accept;
1783+
struct list_head socket_sendmsg;
1784+
struct list_head socket_recvmsg;
1785+
struct list_head socket_getsockname;
1786+
struct list_head socket_getpeername;
1787+
struct list_head socket_getsockopt;
1788+
struct list_head socket_setsockopt;
1789+
struct list_head socket_shutdown;
1790+
struct list_head socket_sock_rcv_skb;
1791+
struct list_head socket_getpeersec_stream;
1792+
struct list_head socket_getpeersec_dgram;
1793+
struct list_head sk_alloc_security;
1794+
struct list_head sk_free_security;
1795+
struct list_head sk_clone_security;
1796+
struct list_head sk_getsecid;
1797+
struct list_head sock_graft;
1798+
struct list_head inet_conn_request;
1799+
struct list_head inet_csk_clone;
1800+
struct list_head inet_conn_established;
1801+
struct list_head secmark_relabel_packet;
1802+
struct list_head secmark_refcount_inc;
1803+
struct list_head secmark_refcount_dec;
1804+
struct list_head req_classify_flow;
1805+
struct list_head tun_dev_alloc_security;
1806+
struct list_head tun_dev_free_security;
1807+
struct list_head tun_dev_create;
1808+
struct list_head tun_dev_attach_queue;
1809+
struct list_head tun_dev_attach;
1810+
struct list_head tun_dev_open;
1811+
struct list_head skb_owned_by;
1812+
#endif /* CONFIG_SECURITY_NETWORK */
1813+
#ifdef CONFIG_SECURITY_NETWORK_XFRM
1814+
struct list_head xfrm_policy_alloc_security;
1815+
struct list_head xfrm_policy_clone_security;
1816+
struct list_head xfrm_policy_free_security;
1817+
struct list_head xfrm_policy_delete_security;
1818+
struct list_head xfrm_state_alloc;
1819+
struct list_head xfrm_state_alloc_acquire;
1820+
struct list_head xfrm_state_free_security;
1821+
struct list_head xfrm_state_delete_security;
1822+
struct list_head xfrm_policy_lookup;
1823+
struct list_head xfrm_state_pol_flow_match;
1824+
struct list_head xfrm_decode_session;
1825+
#endif /* CONFIG_SECURITY_NETWORK_XFRM */
1826+
#ifdef CONFIG_KEYS
1827+
struct list_head key_alloc;
1828+
struct list_head key_free;
1829+
struct list_head key_permission;
1830+
struct list_head key_getsecurity;
1831+
#endif /* CONFIG_KEYS */
1832+
#ifdef CONFIG_AUDIT
1833+
struct list_head audit_rule_init;
1834+
struct list_head audit_rule_known;
1835+
struct list_head audit_rule_match;
1836+
struct list_head audit_rule_free;
1837+
#endif /* CONFIG_AUDIT */
1838+
};
1839+
1840+
/*
1841+
* Initializing a security_hook_list structure takes
1842+
* up a lot of space in a source file. This macro takes
1843+
* care of the common case and reduces the amount of
1844+
* text involved.
1845+
* Casey says: Comment is true in the next patch.
1846+
*/
1847+
#define LSM_HOOK_INIT(HEAD, HOOK) .HEAD = HOOK
1848+
16291849
/* prototypes */
16301850
extern int security_module_enable(struct security_operations *ops);
16311851
extern int register_security(struct security_operations *ops);

‎security/apparmor/lsm.c

Lines changed: 42 additions & 42 deletions
Original file line numberDiff line numberDiff line change
@@ -616,48 +616,48 @@ static int apparmor_task_setrlimit(struct task_struct *task,
616616
}
617617

618618
static struct security_operations apparmor_ops = {
619-
.name = "apparmor",
620-
621-
.ptrace_access_check = apparmor_ptrace_access_check,
622-
.ptrace_traceme = apparmor_ptrace_traceme,
623-
.capget = apparmor_capget,
624-
.capable = apparmor_capable,
625-
626-
.path_link = apparmor_path_link,
627-
.path_unlink = apparmor_path_unlink,
628-
.path_symlink = apparmor_path_symlink,
629-
.path_mkdir = apparmor_path_mkdir,
630-
.path_rmdir = apparmor_path_rmdir,
631-
.path_mknod = apparmor_path_mknod,
632-
.path_rename = apparmor_path_rename,
633-
.path_chmod = apparmor_path_chmod,
634-
.path_chown = apparmor_path_chown,
635-
.path_truncate = apparmor_path_truncate,
636-
.inode_getattr = apparmor_inode_getattr,
637-
638-
.file_open = apparmor_file_open,
639-
.file_permission = apparmor_file_permission,
640-
.file_alloc_security = apparmor_file_alloc_security,
641-
.file_free_security = apparmor_file_free_security,
642-
.mmap_file = apparmor_mmap_file,
643-
.mmap_addr = cap_mmap_addr,
644-
.file_mprotect = apparmor_file_mprotect,
645-
.file_lock = apparmor_file_lock,
646-
647-
.getprocattr = apparmor_getprocattr,
648-
.setprocattr = apparmor_setprocattr,
649-
650-
.cred_alloc_blank = apparmor_cred_alloc_blank,
651-
.cred_free = apparmor_cred_free,
652-
.cred_prepare = apparmor_cred_prepare,
653-
.cred_transfer = apparmor_cred_transfer,
654-
655-
.bprm_set_creds = apparmor_bprm_set_creds,
656-
.bprm_committing_creds = apparmor_bprm_committing_creds,
657-
.bprm_committed_creds = apparmor_bprm_committed_creds,
658-
.bprm_secureexec = apparmor_bprm_secureexec,
659-
660-
.task_setrlimit = apparmor_task_setrlimit,
619+
LSM_HOOK_INIT(name, "apparmor"),
620+
621+
LSM_HOOK_INIT(ptrace_access_check, apparmor_ptrace_access_check),
622+
LSM_HOOK_INIT(ptrace_traceme, apparmor_ptrace_traceme),
623+
LSM_HOOK_INIT(capget, apparmor_capget),
624+
LSM_HOOK_INIT(capable, apparmor_capable),
625+
626+
LSM_HOOK_INIT(path_link, apparmor_path_link),
627+
LSM_HOOK_INIT(path_unlink, apparmor_path_unlink),
628+
LSM_HOOK_INIT(path_symlink, apparmor_path_symlink),
629+
LSM_HOOK_INIT(path_mkdir, apparmor_path_mkdir),
630+
LSM_HOOK_INIT(path_rmdir, apparmor_path_rmdir),
631+
LSM_HOOK_INIT(path_mknod, apparmor_path_mknod),
632+
LSM_HOOK_INIT(path_rename, apparmor_path_rename),
633+
LSM_HOOK_INIT(path_chmod, apparmor_path_chmod),
634+
LSM_HOOK_INIT(path_chown, apparmor_path_chown),
635+
LSM_HOOK_INIT(path_truncate, apparmor_path_truncate),
636+
LSM_HOOK_INIT(inode_getattr, apparmor_inode_getattr),
637+
638+
LSM_HOOK_INIT(file_open, apparmor_file_open),
639+
LSM_HOOK_INIT(file_permission, apparmor_file_permission),
640+
LSM_HOOK_INIT(file_alloc_security, apparmor_file_alloc_security),
641+
LSM_HOOK_INIT(file_free_security, apparmor_file_free_security),
642+
LSM_HOOK_INIT(mmap_file, apparmor_mmap_file),
643+
LSM_HOOK_INIT(mmap_addr, cap_mmap_addr),
644+
LSM_HOOK_INIT(file_mprotect, apparmor_file_mprotect),
645+
LSM_HOOK_INIT(file_lock, apparmor_file_lock),
646+
647+
LSM_HOOK_INIT(getprocattr, apparmor_getprocattr),
648+
LSM_HOOK_INIT(setprocattr, apparmor_setprocattr),
649+
650+
LSM_HOOK_INIT(cred_alloc_blank, apparmor_cred_alloc_blank),
651+
LSM_HOOK_INIT(cred_free, apparmor_cred_free),
652+
LSM_HOOK_INIT(cred_prepare, apparmor_cred_prepare),
653+
LSM_HOOK_INIT(cred_transfer, apparmor_cred_transfer),
654+
655+
LSM_HOOK_INIT(bprm_set_creds, apparmor_bprm_set_creds),
656+
LSM_HOOK_INIT(bprm_committing_creds, apparmor_bprm_committing_creds),
657+
LSM_HOOK_INIT(bprm_committed_creds, apparmor_bprm_committed_creds),
658+
LSM_HOOK_INIT(bprm_secureexec, apparmor_bprm_secureexec),
659+
660+
LSM_HOOK_INIT(task_setrlimit, apparmor_task_setrlimit),
661661
};
662662

663663
/*

0 commit comments

Comments
 (0)