This patch against lsm-2.4 is a backport of the changes accepted into the 2.5/6 kernel. It adds the following security hooks: inode_getsecurity, inode_setsecurity, and inode_listsecurity. These hooks are used by an devpts xattr handler to convert between xattr values and the security labels stored in the inode security field by the security module. The new 2.4-based SELinux (a backport of the 2.6-based SELinux) depends on these, so we'd like to get them into the lsm-2.4 tree so that we can also merge the new 2.4-based SELinux into it. This is a continuation of a series of patches backporting the changes to the LSM API required for the new SELinux (all of which are already in 2.6). For further reference see Stephen Smalley's email to the LSM list on 15 May 2003. http://mail.wirex.com/pipermail/linux-security-module/2003-May/4402.html If there are no objections, I will ask Steve to merge it. include/linux/security.h | 52 +++++++++++++++++++++++++++++++++++++++++++++++ security/dummy.c | 18 ++++++++++++++++ 2 files changed, 70 insertions(+) diff -Nru a/include/linux/security.h b/include/linux/security.h --- a/include/linux/security.h Mon Sep 29 10:43:04 2003 +++ b/include/linux/security.h Mon Sep 29 10:43:04 2003 @@ -375,6 +375,25 @@ * Check permission before removing the extended attribute * identified by @name for @dentry. * Return 0 if permission is granted. + * @inode_getsecurity: + * Copy the extended attribute representation of the security label + * associated with @name for @dentry into @buffer. @buffer may be + * NULL to request the size of the buffer required. @size indicates + * the size of @buffer in bytes. Note that @name is the remainder + * of the attribute name after the security. prefix has been removed. + * Return number of bytes used/required on success. + * @inode_setsecurity: + * Set the security label associated with @name for @dentry from the + * extended attribute value @value. @size indicates the size of the + * @value in bytes. @flags may be XATTR_CREATE, XATTR_REPLACE, or 0. + * Note that @name is the remainder of the attribute name after the + * security. prefix has been removed. + * Return 0 on success. + * @inode_listsecurity: + * Copy the extended attribute names for the security labels + * associated with @dentry into @buffer. @buffer may be NULL to + * request the size of the buffer required. + * Returns number of bytes used/required on success. * * Security hooks for file operations * @@ -1324,6 +1343,9 @@ int (*inode_getxattr) (struct dentry *dentry, char *name); int (*inode_listxattr) (struct dentry *dentry); int (*inode_removexattr) (struct dentry *dentry, char *name); + int (*inode_getsecurity)(struct dentry *dentry, const char *name, void *buffer, size_t size); + int (*inode_setsecurity)(struct dentry *dentry, const char *name, const void *value, size_t size, int flags); + int (*inode_listsecurity)(struct dentry *dentry, char *buffer); int (*file_permission) (struct file * file, int mask); int (*file_alloc_security) (struct file * file); @@ -1896,6 +1918,21 @@ return security_ops->inode_removexattr (dentry, name); } +static inline int security_inode_getsecurity(struct dentry *dentry, const char *name, void *buffer, size_t size) +{ + return security_ops->inode_getsecurity(dentry, name, buffer, size); +} + +static inline int security_inode_setsecurity(struct dentry *dentry, const char *name, const void *value, size_t size, int flags) +{ + return security_ops->inode_setsecurity(dentry, name, value, size, flags); +} + +static inline int security_inode_listsecurity(struct dentry *dentry, char *buffer) +{ + return security_ops->inode_listsecurity(dentry, buffer); +} + static inline int security_file_permission (struct file *file, int mask) { return security_ops->file_permission (file, mask); @@ -2595,6 +2632,21 @@ } static inline int security_inode_removexattr (struct dentry *dentry, char *name) +{ + return 0; +} + +static inline int security_inode_getsecurity(struct dentry *dentry, const char *name, void *buffer, size_t size) +{ + return -EOPNOTSUPP; +} + +static inline int security_inode_setsecurity(struct dentry *dentry, const char *name, const void *value, size_t size, int flags) +{ + return -EOPNOTSUPP; +} + +static inline int security_inode_listsecurity(struct dentry *dentry, char *buffer) { return 0; } diff -Nru a/security/dummy.c b/security/dummy.c --- a/security/dummy.c Mon Sep 29 10:43:04 2003 +++ b/security/dummy.c Mon Sep 29 10:43:04 2003 @@ -452,6 +452,21 @@ return 0; } +static int dummy_inode_getsecurity(struct dentry *dentry, const char *name, void *buffer, size_t size) +{ + return -EOPNOTSUPP; +} + +static int dummy_inode_setsecurity(struct dentry *dentry, const char *name, const void *value, size_t size, int flags) +{ + return -EOPNOTSUPP; +} + +static int dummy_inode_listsecurity(struct dentry *dentry, char *buffer) +{ + return 0; +} + static int dummy_file_permission (struct file *file, int mask) { return 0; @@ -1026,6 +1041,9 @@ set_to_dummy_if_null(ops, inode_getxattr); set_to_dummy_if_null(ops, inode_listxattr); set_to_dummy_if_null(ops, inode_removexattr); + set_to_dummy_if_null(ops, inode_getsecurity); + set_to_dummy_if_null(ops, inode_setsecurity); + set_to_dummy_if_null(ops, inode_listsecurity); set_to_dummy_if_null(ops, file_permission); set_to_dummy_if_null(ops, file_alloc_security); set_to_dummy_if_null(ops, file_free_security); -- James Carter <jwcart2@private> National Security Agency
This archive was generated by hypermail 2b30 : Wed Oct 01 2003 - 07:18:31 PDT