Commit 2039bda1 authored by Kees Cook's avatar Kees Cook Committed by Greg Kroah-Hartman
Browse files

LSM: Add "contents" flag to kernel_read_file hook 



As with the kernel_load_data LSM hook, add a "contents" flag to the
kernel_read_file LSM hook that indicates whether the LSM can expect
a matching call to the kernel_post_read_file LSM hook with the full
contents of the file. With the coming addition of partial file read
support for kernel_read_file*() API, the LSM will no longer be able
to always see the entire contents of a file during the read calls.

For cases where the LSM must read examine the complete file contents,
it will need to do so on its own every time the kernel_read_file
hook is called with contents=false (or reject such cases). Adjust all
existing LSMs to retain existing behavior.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Reviewed-by: default avatarMimi Zohar <zohar@linux.ibm.com>
Link: https://lore.kernel.org/r/20201002173828.2099543-12-keescook@chromium.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 38f90173

fs/kernel_read_file.c

+1 −1
Original line number Diff line number Diff line
@@ -39,7 +39,7 @@ int kernel_read_file(struct file *file, void **buf, 
	if (ret)

		return ret;



	ret = security_kernel_read_file(file, id);

	ret = security_kernel_read_file(file, id, true);

	if (ret)

		goto out;

include/linux/ima.h

+4 −2
Original line number Diff line number Diff line
@@ -23,7 +23,8 @@ extern int ima_file_mprotect(struct vm_area_struct *vma, unsigned long prot); 
extern int ima_load_data(enum kernel_load_data_id id, bool contents);

extern int ima_post_load_data(char *buf, loff_t size,

			      enum kernel_load_data_id id, char *description);

extern int ima_read_file(struct file *file, enum kernel_read_file_id id);

extern int ima_read_file(struct file *file, enum kernel_read_file_id id,

			 bool contents);

extern int ima_post_read_file(struct file *file, void *buf, loff_t size,

			      enum kernel_read_file_id id);

extern void ima_post_path_mknod(struct dentry *dentry);
@@ -92,7 +93,8 @@ static inline int ima_post_load_data(char *buf, loff_t size, 
	return 0;

}



static inline int ima_read_file(struct file *file, enum kernel_read_file_id id)

static inline int ima_read_file(struct file *file, enum kernel_read_file_id id,

				bool contents)

{

	return 0;

}

include/linux/lsm_hook_defs.h

+1 −1
Original line number Diff line number Diff line
@@ -188,7 +188,7 @@ LSM_HOOK(int, 0, kernel_load_data, enum kernel_load_data_id id, bool contents) 
LSM_HOOK(int, 0, kernel_post_load_data, char *buf, loff_t size,

	 enum kernel_read_file_id id, char *description)

LSM_HOOK(int, 0, kernel_read_file, struct file *file,

	 enum kernel_read_file_id id)

	 enum kernel_read_file_id id, bool contents)

LSM_HOOK(int, 0, kernel_post_read_file, struct file *file, char *buf,

	 loff_t size, enum kernel_read_file_id id)

LSM_HOOK(int, 0, task_fix_setuid, struct cred *new, const struct cred *old,

include/linux/lsm_hooks.h

+3 −0
Original line number Diff line number Diff line
@@ -651,6 +651,7 @@ 
 *	@file contains the file structure pointing to the file being read

 *	by the kernel.

 *	@id kernel read file identifier

 *	@contents if a subsequent @kernel_post_read_file will be called.

 *	Return 0 if permission is granted.

 * @kernel_post_read_file:

 *	Read a file specified by userspace.
@@ -659,6 +660,8 @@ 
 *	@buf pointer to buffer containing the file contents.

 *	@size length of the file contents.

 *	@id kernel read file identifier

 *	This must be paired with a prior @kernel_read_file call that had

 *	@contents set to true.

 *	Return 0 if permission is granted.

 * @task_fix_setuid:

 *	Update the module's state after setting one or more of the user

include/linux/security.h

+4 −2
Original line number Diff line number Diff line
@@ -391,7 +391,8 @@ int security_kernel_load_data(enum kernel_load_data_id id, bool contents); 
int security_kernel_post_load_data(char *buf, loff_t size,

				   enum kernel_load_data_id id,

				   char *description);

int security_kernel_read_file(struct file *file, enum kernel_read_file_id id);

int security_kernel_read_file(struct file *file, enum kernel_read_file_id id,

			      bool contents);

int security_kernel_post_read_file(struct file *file, char *buf, loff_t size,

				   enum kernel_read_file_id id);

int security_task_fix_setuid(struct cred *new, const struct cred *old,
@@ -1030,7 +1031,8 @@ static inline int security_kernel_post_load_data(char *buf, loff_t size, 
}



static inline int security_kernel_read_file(struct file *file,

					    enum kernel_read_file_id id)

					    enum kernel_read_file_id id,

					    bool contents)

{

	return 0;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE