As of Chris Wright's feedback on [1], this patch uses _IOC_DIR macro
for checking read/write ioctl commands which fall through getattr/setattr
permission checks, thus avoiding the need of hard-coded ioctl commands
inside the file_ioctl hook.
For a complex and more complete implementation which includes generic
ioctl permissions for the LSM framework, please check [1].
1:
http://selinux.tuxedo-es.org/patches/lsm-checkioctl-hook.patch
---
security/selinux/hooks.c | 25 +++++++------------------
1 file changed, 7 insertions(+), 18 deletions(-)
diff -puN security/selinux/hooks.c~selinux-file_ioctl-iocdir-checks security/selinux/hooks.c
--- linux-2.6.14.2/security/selinux/hooks.c~selinux-file_ioctl-iocdir-checks 2005-11-13 04:06:23.000000000 +0000
+++ linux-2.6.14.2-lorenzo/security/selinux/hooks.c 2005-11-13 04:51:20.000000000 +0000
@@ -2351,25 +2351,14 @@ static int selinux_file_ioctl(struct fil
{
int error = 0;
- switch (cmd) {
- case FIONREAD:
- /* fall through */
- case FIBMAP:
- /* fall through */
- case FIGETBSZ:
- /* fall through */
- case EXT2_IOC_GETFLAGS:
- /* fall through */
- case EXT2_IOC_GETVERSION:
- error = file_has_perm(current, file, FILE__GETATTR);
- break;
-
- case EXT2_IOC_SETFLAGS:
- /* fall through */
- case EXT2_IOC_SETVERSION:
- error = file_has_perm(current, file, FILE__SETATTR);
- break;
+ /* generic check for getattr/setattr ioctls */
+ if ((_IOC_DIR(cmd) & _IOC_READ)) {
+ file_has_perm(current, file, FILE__GETATTR);
+ } else if ((_IOC_DIR(cmd) & _IOC_WRITE)) {
+ file_has_perm(current, file, FILE__SETATTR);
+ }
+ switch (cmd) {
/* sys_ioctl() checks */
case FIONBIO:
/* fall through */
_
Please, lemme know if you want a GPG signed patch. I can't send inline
patches signed because they get line-wrapped. I know it's not a big deal anyways,
for a ~25 lines patch ;).
Ah, despite the base name of the diff, it's based on -mm2.
Cheers and many thanks for the feedback,
--
Lorenzo Hernández García-Hierro <lorenzo@private>
[1024D/6F2B2DEC] & [2048g/9AE91A22][http://tuxedo-es.org]
This archive was generated by hypermail 2.1.3 : Sat Nov 12 2005 - 21:07:40 PST