Define the functions to be used by LSMs to add, retrieve, and remove
elements to the kernel object ->security hlists.
Signed-off-by: Serge Hallyn <[email protected]>
---
include/linux/security-stack.h | 51 +++++++++++++++++++++++++++
include/linux/security.h | 29 +++++++++++++++
security/security.c | 75 +++++++++++++++++++++++++++++++++++++++++
3 files changed, 155 insertions(+)
Index: linux-2.6.13-rc1/include/linux/security-stack.h
===================================================================
--- /dev/null 1970-01-01 00:00:00.000000000 +0000
+++ linux-2.6.13-rc1/include/linux/security-stack.h 2005-06-30 14:11:36.000000000 -0500
@@ -0,0 +1,51 @@
+/*
+ * security-stack.h
+ *
+ * Contains function prototypes or inline definitions for the
+ * function which manipulate kernel object security annotations.
+ *
+ * If stacker is compiled in, then we use the full functions as
+ * defined in security/security.c. Otherwise we use the #defines
+ * here.
+ */
+
+#ifdef CONFIG_SECURITY_STACKER
+extern struct security_list *security_get_value(struct hlist_head *head,
+ int security_id);
+
+extern struct security_list *security_set_value(struct hlist_head *head,
+ int security_id, struct security_list *obj_node);
+extern struct security_list *security_add_value(struct hlist_head *head,
+ int security_id, struct security_list *obj_node);
+extern struct security_list *security_del_value(struct hlist_head *head,
+ int security_id);
+#else
+static inline struct security_list *
+security_get_value(struct hlist_head *head, int security_id)
+{
+ struct hlist_node *tmp = head->first;
+ return tmp ? hlist_entry(tmp, struct security_list, list) : NULL;
+}
+
+static inline struct security_list *
+security_set_value(struct hlist_head *head, int security_id,
+ struct security_list *obj_node)
+{
+ head->first = &obj_node->list;
+}
+
+static inline struct security_list *
+security_add_value(struct hlist_head *head, int security_id,
+ struct security_list *obj_node)
+{
+ head->first = &obj_node->list;
+}
+
+static inline struct security_list *
+security_del_value(struct hlist_head *head, int security_id)
+{
+ struct hlist_node *tmp = head->first;
+ head->first = NULL;
+ return tmp ? hlist_entry(tmp, struct security_list, list) : NULL;
+}
+#endif
Index: linux-2.6.13-rc1/include/linux/security.h
===================================================================
--- linux-2.6.13-rc1.orig/include/linux/security.h 2005-06-30 14:03:13.000000000 -0500
+++ linux-2.6.13-rc1/include/linux/security.h 2005-06-30 14:11:36.000000000 -0500
@@ -34,6 +34,35 @@
struct ctl_table;
/*
+ * structure to be embedded at top of each LSM's security
+ * objects.
+ */
+struct security_list {
+ struct hlist_node list;
+ int security_id;
+};
+
+
+/*
+ * These #defines present more convenient interfaces to
+ * LSMs for using the security{g,d,s}et_value functions.
+ */
+#define security_get_value_type(head, id, type) ( { \
+ struct security_list *v = security_get_value(head, id); \
+ v ? hlist_entry(v, type, lsm_list) : NULL; } )
+
+#define security_set_value_type(head, id, value) \
+ security_set_value(head, id, &value->lsm_list);
+
+#define security_add_value_type(head, id, value) \
+ security_add_value(head, id, &value->lsm_list);
+
+#define security_del_value_type(head, id, type) ( { \
+ struct security_list *v; \
+ v = security_del_value(head, id); \
+ v ? hlist_entry(v, type, lsm_list) : NULL; } )
+
+/*
* These functions are in security/capability.c and are used
* as the default capabilities functions
*/
Index: linux-2.6.13-rc1/security/security.c
===================================================================
--- linux-2.6.13-rc1.orig/security/security.c 2005-06-30 14:03:54.000000000 -0500
+++ linux-2.6.13-rc1/security/security.c 2005-06-30 14:11:36.000000000 -0500
@@ -20,6 +20,81 @@
#define SECURITY_FRAMEWORK_VERSION "1.0.0"
+#ifdef CONFIG_SECURITY_STACKER
+fastcall struct security_list *
+security_get_value(struct hlist_head *head, int security_id)
+{
+ struct security_list *e, *ret = NULL;
+ struct hlist_node *tmp;
+
+ rcu_read_lock();
+ for (tmp = head->first; tmp;
+ tmp = rcu_dereference(tmp->next)) {
+ e = hlist_entry(tmp, struct security_list, list);
+ if (e->security_id == security_id) {
+ ret = e;
+ goto out;
+ }
+ }
+
+out:
+ rcu_read_unlock();
+ return ret;
+}
+
+fastcall void
+security_set_value(struct hlist_head *head, int security_id,
+ struct security_list *obj_node)
+{
+
+ obj_node->security_id = security_id;
+ hlist_add_head(&obj_node->list, head);
+}
+
+static DEFINE_SPINLOCK(stacker_value_spinlock);
+
+fastcall void
+security_add_value(struct hlist_head *head, int security_id,
+ struct security_list *obj_node)
+{
+
+ spin_lock(&stacker_value_spinlock);
+ obj_node->security_id = security_id;
+ hlist_add_head_rcu(&obj_node->list, head);
+ spin_unlock(&stacker_value_spinlock);
+}
+
+/*
+ * XXX Serge: is it possible to add a security_del_value_locked(),
+ * which waits for a full rcu read cycle before returning an object
+ * to be deleted, so that it would be safe to use along with racing
+ * security_get_value()?
+ */
+
+/* No locking needed: only called during object_destroy */
+fastcall struct security_list *
+security_del_value(struct hlist_head *head, int security_id)
+{
+ struct security_list *e;
+ struct hlist_node *tmp;
+
+ for (tmp = head->first; tmp; tmp = tmp->next) {
+ e = hlist_entry(tmp, struct security_list, list);
+ if (e->security_id == security_id) {
+ hlist_del(&e->list);
+ return e;
+ }
+ }
+
+ return NULL;
+}
+
+EXPORT_SYMBOL_GPL(security_get_value);
+EXPORT_SYMBOL_GPL(security_set_value);
+EXPORT_SYMBOL_GPL(security_add_value);
+EXPORT_SYMBOL_GPL(security_del_value);
+#endif
+
/* things that live in dummy.c */
extern struct security_operations dummy_security_ops;
extern void security_fixup_ops(struct security_operations *ops);
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
[Index of Archives]
[Kernel Newbies]
[Netfilter]
[Bugtraq]
[Photo]
[Stuff]
[Gimp]
[Yosemite News]
[MIPS Linux]
[ARM Linux]
[Linux Security]
[Linux RAID]
[Video 4 Linux]
[Linux for the blind]
[Linux Resources]
