tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

lsm: infrastructure management of the perf_event security blob

Move management of the perf_event->security blob out of the individual
security modules and into the security infrastructure. Instead of
allocating the blobs from within the modules the modules tell the
infrastructure how much space is required, and the space is allocated
there. There are no longer any modules that require the perf_event_free()
hook. The hook definition has been removed.

Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
Reviewed-by: John Johansen <john.johansen@canonical.com>
[PM: subject tweak]
Signed-off-by: Paul Moore <paul@paul-moore.com>

authored by

Casey Schaufler and committed by
Paul Moore 61a1dcdc 66de33a0

+29 -17
-1
include/linux/lsm_hook_defs.h
··· 439 439 #ifdef CONFIG_PERF_EVENTS 440 440 LSM_HOOK(int, 0, perf_event_open, struct perf_event_attr *attr, int type) 441 441 LSM_HOOK(int, 0, perf_event_alloc, struct perf_event *event) 442 - LSM_HOOK(void, LSM_RET_VOID, perf_event_free, struct perf_event *event) 443 442 LSM_HOOK(int, 0, perf_event_read, struct perf_event *event) 444 443 LSM_HOOK(int, 0, perf_event_write, struct perf_event *event) 445 444 #endif /* CONFIG_PERF_EVENTS */
+1
include/linux/lsm_hooks.h
··· 79 79 int lbs_ipc; 80 80 int lbs_key; 81 81 int lbs_msg_msg; 82 + int lbs_perf_event; 82 83 int lbs_task; 83 84 int lbs_xattr_count; /* number of xattr slots in new_xattrs array */ 84 85 int lbs_tun_dev;
+18 -2
security/security.c
··· 28 28 #include <linux/xattr.h> 29 29 #include <linux/msg.h> 30 30 #include <linux/overflow.h> 31 + #include <linux/perf_event.h> 31 32 #include <net/flow.h> 32 33 #include <net/sock.h> 33 34 ··· 231 230 lsm_set_blob_size(&needed->lbs_ipc, &blob_sizes.lbs_ipc); 232 231 lsm_set_blob_size(&needed->lbs_key, &blob_sizes.lbs_key); 233 232 lsm_set_blob_size(&needed->lbs_msg_msg, &blob_sizes.lbs_msg_msg); 233 + lsm_set_blob_size(&needed->lbs_perf_event, &blob_sizes.lbs_perf_event); 234 234 lsm_set_blob_size(&needed->lbs_sock, &blob_sizes.lbs_sock); 235 235 lsm_set_blob_size(&needed->lbs_superblock, &blob_sizes.lbs_superblock); 236 236 lsm_set_blob_size(&needed->lbs_task, &blob_sizes.lbs_task); ··· 414 412 init_debug("msg_msg blob size = %d\n", blob_sizes.lbs_msg_msg); 415 413 init_debug("sock blob size = %d\n", blob_sizes.lbs_sock); 416 414 init_debug("superblock blob size = %d\n", blob_sizes.lbs_superblock); 415 + init_debug("perf event blob size = %d\n", blob_sizes.lbs_perf_event); 417 416 init_debug("task blob size = %d\n", blob_sizes.lbs_task); 418 417 init_debug("tun device blob size = %d\n", blob_sizes.lbs_tun_dev); 419 418 init_debug("xattr slots = %d\n", blob_sizes.lbs_xattr_count); ··· 5688 5685 */ 5689 5686 int security_perf_event_alloc(struct perf_event *event) 5690 5687 { 5691 - return call_int_hook(perf_event_alloc, event); 5688 + int rc; 5689 + 5690 + rc = lsm_blob_alloc(&event->security, blob_sizes.lbs_perf_event, 5691 + GFP_KERNEL); 5692 + if (rc) 5693 + return rc; 5694 + 5695 + rc = call_int_hook(perf_event_alloc, event); 5696 + if (rc) { 5697 + kfree(event->security); 5698 + event->security = NULL; 5699 + } 5700 + return rc; 5692 5701 } 5693 5702 5694 5703 /** ··· 5711 5696 */ 5712 5697 void security_perf_event_free(struct perf_event *event) 5713 5698 { 5714 - call_void_hook(perf_event_free, event); 5699 + kfree(event->security); 5700 + event->security = NULL; 5715 5701 } 5716 5702 5717 5703 /**
+4 -14
security/selinux/hooks.c
··· 6955 6955 .lbs_ipc = sizeof(struct ipc_security_struct), 6956 6956 .lbs_key = sizeof(struct key_security_struct), 6957 6957 .lbs_msg_msg = sizeof(struct msg_security_struct), 6958 + #ifdef CONFIG_PERF_EVENTS 6959 + .lbs_perf_event = sizeof(struct perf_event_security_struct), 6960 + #endif 6958 6961 .lbs_sock = sizeof(struct sk_security_struct), 6959 6962 .lbs_superblock = sizeof(struct superblock_security_struct), 6960 6963 .lbs_xattr_count = SELINUX_INODE_INIT_XATTRS, ··· 6989 6986 { 6990 6987 struct perf_event_security_struct *perfsec; 6991 6988 6992 - perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL); 6993 - if (!perfsec) 6994 - return -ENOMEM; 6995 - 6989 + perfsec = selinux_perf_event(event->security); 6996 6990 perfsec->sid = current_sid(); 6997 - event->security = perfsec; 6998 6991 6999 6992 return 0; 7000 - } 7001 - 7002 - static void selinux_perf_event_free(struct perf_event *event) 7003 - { 7004 - struct perf_event_security_struct *perfsec = event->security; 7005 - 7006 - event->security = NULL; 7007 - kfree(perfsec); 7008 6993 } 7009 6994 7010 6995 static int selinux_perf_event_read(struct perf_event *event) ··· 7307 7316 7308 7317 #ifdef CONFIG_PERF_EVENTS 7309 7318 LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open), 7310 - LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free), 7311 7319 LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read), 7312 7320 LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write), 7313 7321 #endif
+6
security/selinux/include/objsec.h
··· 217 217 return ib_sec + selinux_blob_sizes.lbs_ib; 218 218 } 219 219 220 + static inline struct perf_event_security_struct * 221 + selinux_perf_event(void *perf_event) 222 + { 223 + return perf_event + selinux_blob_sizes.lbs_perf_event; 224 + } 225 + 220 226 #endif /* _SELINUX_OBJSEC_H_ */