Commit 6326948f authored by Paul Moore's avatar Paul Moore
Browse files

lsm: security_task_getsecid_subj() -> security_current_getsecid_subj() 



The security_task_getsecid_subj() LSM hook invites misuse by allowing
callers to specify a task even though the hook is only safe when the
current task is referenced.  Fix this by removing the task_struct
argument to the hook, requiring LSM implementations to use the
current task.  While we are changing the hook declaration we also
rename the function to security_current_getsecid_subj() in an effort
to reinforce that the hook captures the subjective credentials of the
current task and not an arbitrary task on the system.

Reviewed-by: default avatarSerge Hallyn <serge@hallyn.com>
Reviewed-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent fa55b7dc

include/linux/lsm_hook_defs.h

+1 −2
Original line number Diff line number Diff line
@@ -206,8 +206,7 @@ LSM_HOOK(int, 0, task_fix_setgid, struct cred *new, const struct cred * old, 
LSM_HOOK(int, 0, task_setpgid, struct task_struct *p, pid_t pgid)

LSM_HOOK(int, 0, task_getpgid, struct task_struct *p)

LSM_HOOK(int, 0, task_getsid, struct task_struct *p)

LSM_HOOK(void, LSM_RET_VOID, task_getsecid_subj,

	 struct task_struct *p, u32 *secid)

LSM_HOOK(void, LSM_RET_VOID, current_getsecid_subj, u32 *secid)

LSM_HOOK(void, LSM_RET_VOID, task_getsecid_obj,

	 struct task_struct *p, u32 *secid)

LSM_HOOK(int, 0, task_setnice, struct task_struct *p, int nice)

include/linux/lsm_hooks.h

+3 −5
Original line number Diff line number Diff line
@@ -719,11 +719,9 @@ 
 *	@p.

 *	@p contains the task_struct for the process.

 *	Return 0 if permission is granted.

 * @task_getsecid_subj:

 *	Retrieve the subjective security identifier of the task_struct in @p

 *	and return it in @secid.  Special care must be taken to ensure that @p

 *	is the either the "current" task, or the caller has exclusive access

 *	to @p.

 * @current_getsecid_subj:

 *	Retrieve the subjective security identifier of the current task and

 *	return it in @secid.

 *	In case of failure, @secid will be set to zero.

 * @task_getsecid_obj:

 *	Retrieve the objective security identifier of the task_struct in @p

include/linux/security.h

+2 −2
Original line number Diff line number Diff line
@@ -418,7 +418,7 @@ int security_task_fix_setgid(struct cred *new, const struct cred *old, 
int security_task_setpgid(struct task_struct *p, pid_t pgid);

int security_task_getpgid(struct task_struct *p);

int security_task_getsid(struct task_struct *p);

void security_task_getsecid_subj(struct task_struct *p, u32 *secid);

void security_current_getsecid_subj(u32 *secid);

void security_task_getsecid_obj(struct task_struct *p, u32 *secid);

int security_task_setnice(struct task_struct *p, int nice);

int security_task_setioprio(struct task_struct *p, int ioprio);
@@ -1119,7 +1119,7 @@ static inline int security_task_getsid(struct task_struct *p) 
	return 0;

}



static inline void security_task_getsecid_subj(struct task_struct *p, u32 *secid)

static inline void security_current_getsecid_subj(u32 *secid)

{

	*secid = 0;

}

kernel/audit.c

+2 −2
Original line number Diff line number Diff line
@@ -2132,7 +2132,7 @@ int audit_log_task_context(struct audit_buffer *ab) 
	int error;

	u32 sid;



	security_task_getsecid_subj(current, &sid);

	security_current_getsecid_subj(&sid);

	if (!sid)

		return 0;
@@ -2353,7 +2353,7 @@ int audit_signal_info(int sig, struct task_struct *t) 
			audit_sig_uid = auid;

		else

			audit_sig_uid = uid;

		security_task_getsecid_subj(current, &audit_sig_sid);

		security_current_getsecid_subj(&audit_sig_sid);

	}



	return audit_signal_info_syscall(t);

kernel/auditfilter.c

+1 −2
Original line number Diff line number Diff line
@@ -1368,8 +1368,7 @@ int audit_filter(int msgtype, unsigned int listtype) 
			case AUDIT_SUBJ_SEN:

			case AUDIT_SUBJ_CLR:

				if (f->lsm_rule) {

					security_task_getsecid_subj(current,

								    &sid);

					security_current_getsecid_subj(&sid);

					result = security_audit_rule_match(sid,

						   f->type, f->op, f->lsm_rule);

				}