Commit 1fb057dc authored by Paul Moore's avatar Paul Moore
Browse files

smack: differentiate between subjective and objective task credentials 



With the split of the security_task_getsecid() into subjective and
objective variants it's time to update Smack to ensure it is using
the correct task creds.

Acked-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Reviewed-by: default avatarRichard Guy Briggs <rgb@redhat.com>
Reviewed-by: default avatarJohn Johansen <john.johansen@canonical.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent eb1231f7

security/smack/smack.h

+17 −1
Original line number Diff line number Diff line
@@ -383,7 +383,23 @@ static inline struct smack_known *smk_of_task(const struct task_smack *tsp) 
	return tsp->smk_task;

}



static inline struct smack_known *smk_of_task_struct(

static inline struct smack_known *smk_of_task_struct_subj(

						const struct task_struct *t)

{

	struct smack_known *skp;

	const struct cred *cred;



	rcu_read_lock();



	cred = rcu_dereference(t->cred);

	skp = smk_of_task(smack_cred(cred));



	rcu_read_unlock();



	return skp;

}



static inline struct smack_known *smk_of_task_struct_obj(

						const struct task_struct *t)

{

	struct smack_known *skp;

security/smack/smack_lsm.c

+27 −13
Original line number Diff line number Diff line
@@ -159,7 +159,7 @@ static int smk_bu_current(char *note, struct smack_known *oskp, 
static int smk_bu_task(struct task_struct *otp, int mode, int rc)

{

	struct task_smack *tsp = smack_cred(current_cred());

	struct smack_known *smk_task = smk_of_task_struct(otp);

	struct smack_known *smk_task = smk_of_task_struct_obj(otp);

	char acc[SMK_NUM_ACCESS_TYPE + 1];



	if (rc <= 0)
@@ -479,7 +479,7 @@ static int smack_ptrace_access_check(struct task_struct *ctp, unsigned int mode) 
{

	struct smack_known *skp;



	skp = smk_of_task_struct(ctp);

	skp = smk_of_task_struct_obj(ctp);



	return smk_ptrace_rule_check(current, skp, mode, __func__);

}
@@ -2033,7 +2033,7 @@ static int smk_curacc_on_task(struct task_struct *p, int access, 
				const char *caller)

{

	struct smk_audit_info ad;

	struct smack_known *skp = smk_of_task_struct(p);

	struct smack_known *skp = smk_of_task_struct_subj(p);

	int rc;



	smk_ad_init(&ad, caller, LSM_AUDIT_DATA_TASK);
@@ -2078,15 +2078,29 @@ static int smack_task_getsid(struct task_struct *p) 
}



/**

 * smack_task_getsecid - get the secid of the task

 * @p: the object task

 * smack_task_getsecid_subj - get the subjective secid of the task

 * @p: the task

 * @secid: where to put the result

 *

 * Sets the secid to contain a u32 version of the smack label.

 * Sets the secid to contain a u32 version of the task's subjective smack label.

 */

static void smack_task_getsecid_subj(struct task_struct *p, u32 *secid)

{

	struct smack_known *skp = smk_of_task_struct_subj(p);



	*secid = skp->smk_secid;

}



/**

 * smack_task_getsecid_obj - get the objective secid of the task

 * @p: the task

 * @secid: where to put the result

 *

 * Sets the secid to contain a u32 version of the task's objective smack label.

 */

static void smack_task_getsecid(struct task_struct *p, u32 *secid)

static void smack_task_getsecid_obj(struct task_struct *p, u32 *secid)

{

	struct smack_known *skp = smk_of_task_struct(p);

	struct smack_known *skp = smk_of_task_struct_obj(p);



	*secid = skp->smk_secid;

}
@@ -2174,7 +2188,7 @@ static int smack_task_kill(struct task_struct *p, struct kernel_siginfo *info, 
{

	struct smk_audit_info ad;

	struct smack_known *skp;

	struct smack_known *tkp = smk_of_task_struct(p);

	struct smack_known *tkp = smk_of_task_struct_obj(p);

	int rc;



	if (!sig)
@@ -2212,7 +2226,7 @@ static int smack_task_kill(struct task_struct *p, struct kernel_siginfo *info, 
static void smack_task_to_inode(struct task_struct *p, struct inode *inode)

{

	struct inode_smack *isp = smack_inode(inode);

	struct smack_known *skp = smk_of_task_struct(p);

	struct smack_known *skp = smk_of_task_struct_obj(p);



	isp->smk_inode = skp;

	isp->smk_flags |= SMK_INODE_INSTANT;
@@ -3483,7 +3497,7 @@ static void smack_d_instantiate(struct dentry *opt_dentry, struct inode *inode) 
 */

static int smack_getprocattr(struct task_struct *p, char *name, char **value)

{

	struct smack_known *skp = smk_of_task_struct(p);

	struct smack_known *skp = smk_of_task_struct_subj(p);

	char *cp;

	int slen;
@@ -4759,8 +4773,8 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { 
	LSM_HOOK_INIT(task_setpgid, smack_task_setpgid),

	LSM_HOOK_INIT(task_getpgid, smack_task_getpgid),

	LSM_HOOK_INIT(task_getsid, smack_task_getsid),

	LSM_HOOK_INIT(task_getsecid_subj, smack_task_getsecid),

	LSM_HOOK_INIT(task_getsecid_obj, smack_task_getsecid),

	LSM_HOOK_INIT(task_getsecid_subj, smack_task_getsecid_subj),

	LSM_HOOK_INIT(task_getsecid_obj, smack_task_getsecid_obj),

	LSM_HOOK_INIT(task_setnice, smack_task_setnice),

	LSM_HOOK_INIT(task_setioprio, smack_task_setioprio),

	LSM_HOOK_INIT(task_getioprio, smack_task_getioprio),