leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Smack: Brutalist io_uring support

Browse Source 
Add Smack privilege checks for io_uring. Use CAP_MAC_OVERRIDE
for the override_creds case and CAP_MAC_ADMIN for creating a
polling thread. These choices are based on conjecture regarding
the intent of the surrounding code.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
[PM: make the smack_uring_* funcs static, remove debug code]
Signed-off-by: Paul Moore <paul@paul-moore.com>
This commit is contained in:
Casey Schaufler
2021-05-21 11:21:16 -07:00
committed by Paul Moore
parent 740b03414b
commit d9d8c93938
1 changed files with 46 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

46
security/smack/smack_lsm.c
View File

@@ -4691,6 +4691,48 @@ static int smack_dentry_create_files_as(struct dentry *dentry, int mode,
return 0; return 0;
} }
#ifdef CONFIG_IO_URING
/**
* smack_uring_override_creds - Is io_uring cred override allowed?
* @new: the target creds
*
* Check to see if the current task is allowed to override it's credentials
* to service an io_uring operation.
*/
static int smack_uring_override_creds(const struct cred *new)
{
struct task_smack *tsp = smack_cred(current_cred());
struct task_smack *nsp = smack_cred(new);
/*
* Allow the degenerate case where the new Smack value is
* the same as the current Smack value.
*/
if (tsp->smk_task == nsp->smk_task)
return 0;
if (smack_privileged_cred(CAP_MAC_OVERRIDE, current_cred()))
return 0;
return -EPERM;
}
/**
* smack_uring_sqpoll - check if a io_uring polling thread can be created
*
* Check to see if the current task is allowed to create a new io_uring
* kernel polling thread.
*/
static int smack_uring_sqpoll(void)
{
if (smack_privileged_cred(CAP_MAC_ADMIN, current_cred()))
return 0;
return -EPERM;
}
#endif /* CONFIG_IO_URING */
struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = { struct lsm_blob_sizes smack_blob_sizes __lsm_ro_after_init = {
.lbs_cred = sizeof(struct task_smack), .lbs_cred = sizeof(struct task_smack),
.lbs_file = sizeof(struct smack_known *), .lbs_file = sizeof(struct smack_known *),
@@ -4843,6 +4885,10 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
LSM_HOOK_INIT(inode_copy_up, smack_inode_copy_up), LSM_HOOK_INIT(inode_copy_up, smack_inode_copy_up),
LSM_HOOK_INIT(inode_copy_up_xattr, smack_inode_copy_up_xattr), LSM_HOOK_INIT(inode_copy_up_xattr, smack_inode_copy_up_xattr),
LSM_HOOK_INIT(dentry_create_files_as, smack_dentry_create_files_as), LSM_HOOK_INIT(dentry_create_files_as, smack_dentry_create_files_as),
#ifdef CONFIG_IO_URING
LSM_HOOK_INIT(uring_override_creds, smack_uring_override_creds),
LSM_HOOK_INIT(uring_sqpoll, smack_uring_sqpoll),
#endif
}; };