Home » Mailing list archives » linux-kernel » 2008 » January » 23

[PATCH 10/27] Security: Add a kernel_service object class to SELinux [try #2]

Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
[view in full thread]
From: David Howells
Subject: [PATCH 10/27] Security: Add a kernel_service object class to SELinux [try #2]
Date: Wednesday, January 23, 2008 - 10:21 am

Add a 'kernel_service' object class to SELinux and give this object class two
access vectors: 'use_as_override' and 'create_files_as'.

The first vector is used to grant a process the right to nominate an alternate
process security ID for the kernel to use as an override for the SELinux
subjective security when accessing stuff on behalf of another process.

For example, CacheFiles when accessing the cache on behalf on a process
accessing an NFS file needs to use a subjective security ID appropriate to the
cache rather then the one the calling process is using.  The cachefilesd
daemon will nominate the security ID to be used.

The second vector is used to grant a process the right to nominate a file
creation label for a kernel service to use.

Signed-off-by: David Howells <dhowells@redhat.com>
---

 security/selinux/include/av_perm_to_string.h |    2 ++
 security/selinux/include/av_permissions.h    |    2 ++
 security/selinux/include/class_to_string.h   |    1 +
 security/selinux/include/flask.h             |    1 +
 4 files changed, 6 insertions(+), 0 deletions(-)


diff --git a/security/selinux/include/av_perm_to_string.h b/security/selinux/include/av_perm_to_string.h
index caa0634..6ba8200 100644
--- a/security/selinux/include/av_perm_to_string.h
+++ b/security/selinux/include/av_perm_to_string.h
@@ -164,3 +164,5 @@
    S_(SECCLASS_DCCP_SOCKET, DCCP_SOCKET__NAME_CONNECT, "name_connect")
    S_(SECCLASS_MEMPROTECT, MEMPROTECT__MMAP_ZERO, "mmap_zero")
    S_(SECCLASS_PEER, PEER__RECV, "recv")
+   S_(SECCLASS_KERNEL_SERVICE, KERNEL_SERVICE__USE_AS_OVERRIDE, "use_as_override")
+   S_(SECCLASS_KERNEL_SERVICE, KERNEL_SERVICE__CREATE_FILES_AS, "create_files_as")
diff --git a/security/selinux/include/av_permissions.h b/security/selinux/include/av_permissions.h
index c2b5bb2..9500ba3 100644
--- a/security/selinux/include/av_permissions.h
+++ b/security/selinux/include/av_permissions.h
@@ -829,3 +829,5 @@
 #define DCCP_SOCKET__NAME_CONNECT                 0x00800000UL
 #define MEMPROTECT__MMAP_ZERO                     0x00000001UL
 #define PEER__RECV                                0x00000001UL
+#define KERNEL_SERVICE__USE_AS_OVERRIDE           0x00000001UL
+#define KERNEL_SERVICE__CREATE_FILES_AS           0x00000002UL
diff --git a/security/selinux/include/class_to_string.h b/security/selinux/include/class_to_string.h
index b1b0d1d..efe9efa 100644
--- a/security/selinux/include/class_to_string.h
+++ b/security/selinux/include/class_to_string.h
@@ -71,3 +71,4 @@
     S_(NULL)
     S_(NULL)
     S_("peer")
+    S_("kernel_service")
diff --git a/security/selinux/include/flask.h b/security/selinux/include/flask.h
index 09e9dd2..2bc251a 100644
--- a/security/selinux/include/flask.h
+++ b/security/selinux/include/flask.h
@@ -51,6 +51,7 @@
 #define SECCLASS_DCCP_SOCKET                             60
 #define SECCLASS_MEMPROTECT                              61
 #define SECCLASS_PEER                                    68
+#define SECCLASS_KERNEL_SERVICE                          69
 
 /*
  * Security identifier indices for initial entities

--
Previous message: [thread] [date] [author]
Next message: [thread] [date] [author]
Messages in current thread:
[PATCH 00/27] Permit filesystem local caching [try #2], David Howells, (Wed Jan 23, 10:20 am)
[PATCH 01/27] KEYS: Increase the payload size when instant ..., David Howells, (Wed Jan 23, 10:20 am)
[PATCH 02/27] KEYS: Check starting keyring as part of sear ..., David Howells, (Wed Jan 23, 10:20 am)
[PATCH 03/27] KEYS: Allow the callout data to be passed as ..., David Howells, (Wed Jan 23, 10:20 am)
[PATCH 04/27] KEYS: Add keyctl function to get a security ..., David Howells, (Wed Jan 23, 10:21 am)
[PATCH 05/27] Security: Change current-&gt;fs[ug]id to curren ..., David Howells, (Wed Jan 23, 10:21 am)
[PATCH 06/27] Security: Separate task security context fro ..., David Howells, (Wed Jan 23, 10:21 am)
[PATCH 07/27] Security: De-embed task security record from ..., David Howells, (Wed Jan 23, 10:21 am)
[PATCH 08/27] Add a secctx_to_secid() LSM hook to go along ..., David Howells, (Wed Jan 23, 10:21 am)
[PATCH 09/27] Security: Pre-add additional non-caching cla ..., David Howells, (Wed Jan 23, 10:21 am)
[PATCH 10/27] Security: Add a kernel_service object class ..., David Howells, (Wed Jan 23, 10:21 am)
[PATCH 11/27] Security: Allow kernel services to override ..., David Howells, (Wed Jan 23, 10:21 am)
[PATCH 12/27] Security: Make NFSD work with detached secur ..., David Howells, (Wed Jan 23, 10:21 am)
[PATCH 13/27] FS-Cache: Release page-&gt;private after failed ..., David Howells, (Wed Jan 23, 10:21 am)
[PATCH 14/27] FS-Cache: Recruit a couple of page flags for ..., David Howells, (Wed Jan 23, 10:21 am)
[PATCH 15/27] FS-Cache: Provide an add_wait_queue_tail() f ..., David Howells, (Wed Jan 23, 10:21 am)
[PATCH 16/27] FS-Cache: Generic filesystem caching facilit ..., David Howells, (Wed Jan 23, 10:22 am)
[PATCH 17/27] CacheFiles: Add missing copy_page export for ..., David Howells, (Wed Jan 23, 10:22 am)
[PATCH 18/27] CacheFiles: Be consistent about the use of m ..., David Howells, (Wed Jan 23, 10:22 am)
[PATCH 19/27] CacheFiles: Add a hook to write a single pag ..., David Howells, (Wed Jan 23, 10:22 am)
[PATCH 20/27] CacheFiles: Permit the page lock state to be ..., David Howells, (Wed Jan 23, 10:22 am)
[PATCH 21/27] CacheFiles: Export things for CacheFiles [tr ..., David Howells, (Wed Jan 23, 10:22 am)
[PATCH 22/27] CacheFiles: A cache that backs onto a mounte ..., David Howells, (Wed Jan 23, 10:22 am)
[PATCH 23/27] NFS: Fix memory leak [try #2], David Howells, (Wed Jan 23, 10:22 am)
[PATCH 24/27] NFS: Use local caching [try #2], David Howells, (Wed Jan 23, 10:22 am)
[PATCH 25/27] NFS: Configuration and mount option changes ..., David Howells, (Wed Jan 23, 10:22 am)
[PATCH 26/27] NFS: Display local caching state [try #2], David Howells, (Wed Jan 23, 10:22 am)
[PATCH 27/27] NFS: Separate caching by superblock, explici ..., David Howells, (Wed Jan 23, 10:23 am)
Re: [PATCH 24/27] NFS: Use local caching [try #2], Trond Myklebust, (Thu Jan 24, 2:08 pm)
Re: [PATCH 25/27] NFS: Configuration and mount option chan ..., Trond Myklebust, (Thu Jan 24, 2:14 pm)
Re: [PATCH 23/27] NFS: Fix memory leak [try #2], Trond Myklebust, (Thu Jan 24, 2:15 pm)
Re: [PATCH 24/27] NFS: Use local caching [try #2], Chuck Lever, (Thu Jan 24, 2:22 pm)
Re: [PATCH 24/27] NFS: Use local caching [try #2], David Howells, (Tue Jan 29, 8:25 pm)
Re: [PATCH 24/27] NFS: Use local caching [try #2], Trond Myklebust, (Tue Jan 29, 11:46 pm)
Re: [PATCH 24/27] NFS: Use local caching [try #2], Chuck Lever, (Wed Jan 30, 3:36 pm)
Re: [PATCH 24/27] NFS: Use local caching [try #2], David Howells, (Thu Jan 31, 4:29 pm)
Re: [PATCH 24/27] NFS: Use local caching [try #2], David Howells, (Thu Feb 7, 3:57 am)