5:47 p.m.
On 10/12/2022 2:14 PM, Mickaël Salaün wrote:
On 27/09/2022 21:53, Casey Schaufler wrote:
> Add an integer member "id" to the struct lsm_id. This value is
> a unique identifier associated with each security module. The
> values are defined in a new UAPI header file. Each existing LSM
> has been updated to include it's LSMID in the lsm_id.
>
> Signed-off-by: Casey Schaufler <casey(a)schaufler-ca.com>
> ---
> include/linux/lsm_hooks.h | 1 +
> include/uapi/linux/lsm.h | 32 ++++++++++++++++++++++++++++++++
> security/apparmor/lsm.c | 2 ++
> security/bpf/hooks.c | 2 ++
> security/commoncap.c | 2 ++
> security/landlock/setup.c | 2 ++
> security/loadpin/loadpin.c | 2 ++
> security/lockdown/lockdown.c | 4 +++-
> security/safesetid/lsm.c | 2 ++
> security/selinux/hooks.c | 2 ++
> security/smack/smack_lsm.c | 2 ++
> security/tomoyo/tomoyo.c | 2 ++
> security/yama/yama_lsm.c | 2 ++
> 13 files changed, 56 insertions(+), 1 deletion(-)
> create mode 100644 include/uapi/linux/lsm.h
>
> diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
> index 23054881eb08..407f57aaa6ef 100644
> --- a/include/linux/lsm_hooks.h
> +++ b/include/linux/lsm_hooks.h
> @@ -1603,6 +1603,7 @@ struct security_hook_heads {
> */
> struct lsm_id {
> const char *lsm; /* Name of the LSM */
> + int id; /* LSM ID */
> };
> /*
> diff --git a/include/uapi/linux/lsm.h b/include/uapi/linux/lsm.h
> new file mode 100644
> index 000000000000..5647c3e220c0
> --- /dev/null
> +++ b/include/uapi/linux/lsm.h
> @@ -0,0 +1,32 @@
> +/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
> +/*
> + * Linus Security Modules (LSM) - User space API
> + *
> + * Copyright (C) 2022 Casey Schaufler <casey(a)schaufler-ca.com>
> + * Copyright (C) Intel Corporation
> + */
> +
> +#ifndef _UAPI_LINUX_LSM_H
> +#define _UAPI_LINUX_LSM_H
> +
> +/*
> + * ID values to identify security modules.
> + * A system may use more than one security module.
> + *
> + * LSM_ID_XXX values 32 and below are reserved for future use
What do you have in mind? Why not "reserve" higher bits instead and
start with SELinux at 1?
I don't know what (if anything) Paul had in mind when he suggested the reserved
values.
It's not like there's a shortage of numbers, and as it's part of the ABI and
can't
change I'll err on the side of caution.
> + */
> +#define LSM_ID_INVALID -1
> +#define LSM_ID_SELINUX 33
> +#define LSM_ID_SMACK 34
> +#define LSM_ID_TOMOYO 35
> +#define LSM_ID_IMA 36
> +#define LSM_ID_APPARMOR 37
> +#define LSM_ID_YAMA 38
> +#define LSM_ID_LOADPIN 39
> +#define LSM_ID_SAFESETID 40
> +#define LSM_ID_LOCKDOWN 41
> +#define LSM_ID_BPF 42
> +#define LSM_ID_LANDLOCK 43
> +#define LSM_ID_CAPABILITY 44
Out of curiosity, why this order?
Order of inclusion upstream. Except for capability. In the next version
I plan to fix the order by putting LSM_ID_CAPABILITY first at 32 and
changing the comment. If we wanted something less mundane we could hex
encode the first 4 letters of the name, but except for hacker style debugging
that doesn't gain anything.
> +
> +#endif /* _UAPI_LINUX_LSM_H */
> diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
> index b71f7d4159d7..fb6c7edd5393 100644
> --- a/security/apparmor/lsm.c
> +++ b/security/apparmor/lsm.c
> @@ -24,6 +24,7 @@
> #include <linux/zlib.h>
> #include <net/sock.h>
> #include <uapi/linux/mount.h>
> +#include <uapi/linux/lsm.h>
> #include "include/apparmor.h"
> #include "include/apparmorfs.h"
> @@ -1204,6 +1205,7 @@ struct lsm_blob_sizes apparmor_blob_sizes
> __lsm_ro_after_init = {
> static struct lsm_id apparmor_lsmid __lsm_ro_after_init = {
> .lsm = "apparmor",
> + .id = LSM_ID_APPARMOR,
> };
> static struct security_hook_list apparmor_hooks[]
> __lsm_ro_after_init = {
> diff --git a/security/bpf/hooks.c b/security/bpf/hooks.c
> index e50de3abfde2..c462fc41dd57 100644
> --- a/security/bpf/hooks.c
> +++ b/security/bpf/hooks.c
> @@ -5,6 +5,7 @@
> */
> #include <linux/lsm_hooks.h>
> #include <linux/bpf_lsm.h>
> +#include <uapi/linux/lsm.h>
> static struct security_hook_list bpf_lsm_hooks[]
> __lsm_ro_after_init = {
> #define LSM_HOOK(RET, DEFAULT, NAME, ...) \
> @@ -21,6 +22,7 @@ static struct security_hook_list bpf_lsm_hooks[]
> __lsm_ro_after_init = {
> */
> struct lsm_id bpf_lsmid __lsm_ro_after_init = {
> .lsm = "bpf",
> + .id = LSM_ID_BPF,
> };
> static int __init bpf_lsm_init(void)
> diff --git a/security/commoncap.c b/security/commoncap.c
> index dab1b5f5e6aa..4e9b140159d8 100644
> --- a/security/commoncap.c
> +++ b/security/commoncap.c
> @@ -25,6 +25,7 @@
> #include <linux/binfmts.h>
> #include <linux/personality.h>
> #include <linux/mnt_idmapping.h>
> +#include <uapi/linux/lsm.h>
> /*
> * If a non-root user executes a setuid-root binary in
> @@ -1448,6 +1449,7 @@ int cap_mmap_file(struct file *file, unsigned
> long reqprot,
> static struct lsm_id capability_lsmid __lsm_ro_after_init = {
> .lsm = "capability",
> + .id = LSM_ID_CAPABILITY,
> };
> static struct security_hook_list capability_hooks[]
> __lsm_ro_after_init = {
> diff --git a/security/landlock/setup.c b/security/landlock/setup.c
> index fc7b69c5839e..1242c61c9de4 100644
> --- a/security/landlock/setup.c
> +++ b/security/landlock/setup.c
> @@ -8,6 +8,7 @@
> #include <linux/init.h>
> #include <linux/lsm_hooks.h>
> +#include <uapi/linux/lsm.h>
> #include "common.h"
> #include "cred.h"
> @@ -25,6 +26,7 @@ struct lsm_blob_sizes landlock_blob_sizes
> __lsm_ro_after_init = {
> struct lsm_id landlock_lsmid __lsm_ro_after_init = {
> .lsm = LANDLOCK_NAME,
> + .id = LSM_ID_LANDLOCK,
Please only use one space after ".id"
Yeah, I got that from the comments on 01/39. I will make that change
throughout the set.