Commit d9d8c939 authored by Casey Schaufler's avatar Casey Schaufler Committed by Paul Moore
Browse files

Smack: Brutalist io_uring support 



Add Smack privilege checks for io_uring. Use CAP_MAC_OVERRIDE
for the override_creds case and CAP_MAC_ADMIN for creating a
polling thread. These choices are based on conjecture regarding
the intent of the surrounding code.

Signed-off-by: default avatarCasey Schaufler <casey@schaufler-ca.com>
[PM: make the smack_uring_* funcs static, remove debug code]
Signed-off-by: default avatarPaul Moore <paul@paul-moore.com>
parent 740b0341

security/smack/smack_lsm.c

+46 −0
Original line number Diff line number Diff line
@@ -4691,6 +4691,48 @@ static int smack_dentry_create_files_as(struct dentry *dentry, int mode, 
	return 0;

}



#ifdef CONFIG_IO_URING

/**

 * smack_uring_override_creds - Is io_uring cred override allowed?

 * @new: the target creds

 *

 * Check to see if the current task is allowed to override it's credentials

 * to service an io_uring operation.

 */

static int smack_uring_override_creds(const struct cred *new)

{

	struct task_smack *tsp = smack_cred(current_cred());

	struct task_smack *nsp = smack_cred(new);



	/*

	 * Allow the degenerate case where the new Smack value is

	 * the same as the current Smack value.

	 */

	if (tsp->smk_task == nsp->smk_task)

		return 0;



	if (smack_privileged_cred(CAP_MAC_OVERRIDE, current_cred()))

		return 0;



	return -EPERM;

}



/**

 * smack_uring_sqpoll - check if a io_uring polling thread can be created

 *

 * Check to see if the current task is allowed to create a new io_uring

 * kernel polling thread.

 */

static int smack_uring_sqpoll(void)

{

	if (smack_privileged_cred(CAP_MAC_ADMIN, current_cred()))

		return 0;



	return -EPERM;

}



#endif /* CONFIG_IO_URING */



struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {

	.lbs_cred = sizeof(struct task_smack),

	.lbs_file = sizeof(struct smack_known *),
@@ -4843,6 +4885,10 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = { 
	LSM_HOOK_INIT(inode_copy_up, smack_inode_copy_up),

	LSM_HOOK_INIT(inode_copy_up_xattr, smack_inode_copy_up_xattr),

	LSM_HOOK_INIT(dentry_create_files_as, smack_dentry_create_files_as),

#ifdef CONFIG_IO_URING

	LSM_HOOK_INIT(uring_override_creds, smack_uring_override_creds),

	LSM_HOOK_INIT(uring_sqpoll, smack_uring_sqpoll),

#endif

};