security: report the module name to security_module_request

For SELinux to do better filtering in userspace we send the name of the module along with the AVC denial when a program is denied module_request. Example output: type=SYSCALL msg=audit(11/03/2009 10:59:43.510:9) : arch=x86_64 syscall=write success=yes exit=2 a0=3 a1=7fc28c0d56c0 a2=2 a3=7fffca0d7440 items=0 ppid=1727 pid=1729 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpc.nfsd exe=/usr/sbin/rpc.nfsd subj=system_u:system_r:nfsd_t:s0 key=(null) type=AVC msg=audit(11/03/2009 10:59:43.510:9) : avc: denied { module_request } for pid=1729 comm=rpc.nfsd kmod="net-pf-10" scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>

security: report the module name to security_module_request
For SELinux to do better filtering in userspace we send the name of the module along with the AVC denial when a program is denied module_request. Example output: type=SYSCALL msg=audit(11/03/2009 10:59:43.510:9) : arch=x86_64 syscall=write success=yes exit=2 a0=3 a1=7fc28c0d56c0 a2=2 a3=7fffca0d7440 items=0 ppid=1727 pid=1729 auid=unset uid=root gid=root euid=root suid=root fsuid=root egid=root sgid=root fsgid=root tty=(none) ses=unset comm=rpc.nfsd exe=/usr/sbin/rpc.nfsd subj=system_u:system_r:nfsd_t:s0 key=(null) type=AVC msg=audit(11/03/2009 10:59:43.510:9) : avc: denied { module_request } for pid=1729 comm=rpc.nfsd kmod="net-pf-10" scontext=system_u:system_r:nfsd_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=system Signed-off-by: Eric Paris <eparis@redhat.com> Signed-off-by: James Morris <jmorris@namei.org>
Eric Paris · James Morris
1 parent 6e65f92ff0
Showing 7 changed files with 36 additions and 20 deletions Side-by-side Diff
include/linux/lsm_audit.h
include/linux/security.h
kernel/kmod.c
security/capability.c
security/lsm_audit.c
security/security.c
security/selinux/hooks.c
@@ -26,14 +26,15 @@
  
 /* Auxiliary data to use in generating the audit record. */
 struct common_audit_data {
-	char    type;
-#define LSM_AUDIT_DATA_FS      1
-#define LSM_AUDIT_DATA_NET     2
-#define LSM_AUDIT_DATA_CAP     3
-#define LSM_AUDIT_DATA_IPC     4
-#define LSM_AUDIT_DATA_TASK    5
-#define LSM_AUDIT_DATA_KEY     6
-#define LSM_AUDIT_NO_AUDIT     7
+	char type;
+#define LSM_AUDIT_DATA_FS	1
+#define LSM_AUDIT_DATA_NET	2
+#define LSM_AUDIT_DATA_CAP	3
+#define LSM_AUDIT_DATA_IPC	4
+#define LSM_AUDIT_DATA_TASK	5
+#define LSM_AUDIT_DATA_KEY	6
+#define LSM_AUDIT_NO_AUDIT	7
+#define LSM_AUDIT_DATA_KMOD	8
 	struct task_struct *tsk;
 	union 	{
 		struct {
@@ -66,6 +67,7 @@
 			char *key_desc;
 		} key_struct;
 #endif
+		char *kmod_name;
 	} u;
 	/* this union contains LSM specific data */
 	union {
@@ -706,6 +706,7 @@
  * @kernel_module_request:
  *	Ability to trigger the kernel to automatically upcall to userspace for
  *	userspace to load a kernel module with the given name.
+ *	@kmod_name name of the module requested by the kernel
  *	Return 0 if successful.
  * @task_setuid:
  *	Check permission before setting one or more of the user identity
@@ -1577,7 +1578,7 @@
 	void (*cred_transfer)(struct cred *new, const struct cred *old);
 	int (*kernel_act_as)(struct cred *new, u32 secid);
 	int (*kernel_create_files_as)(struct cred *new, struct inode *inode);
-	int (*kernel_module_request)(void);
+	int (*kernel_module_request)(char *kmod_name);
 	int (*task_setuid) (uid_t id0, uid_t id1, uid_t id2, int flags);
 	int (*task_fix_setuid) (struct cred *new, const struct cred *old,
 				int flags);
@@ -1842,7 +1843,7 @@
 void security_transfer_creds(struct cred *new, const struct cred *old);
 int security_kernel_act_as(struct cred *new, u32 secid);
 int security_kernel_create_files_as(struct cred *new, struct inode *inode);
-int security_kernel_module_request(void);
+int security_kernel_module_request(char *kmod_name);
 int security_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags);
 int security_task_fix_setuid(struct cred *new, const struct cred *old,
 			     int flags);
@@ -2407,7 +2408,7 @@
 	return 0;
 }
  
-static inline int security_kernel_module_request(void)
+static inline int security_kernel_module_request(char *kmod_name)
 {
 	return 0;
 }
@@ -80,15 +80,15 @@
 #define MAX_KMOD_CONCURRENT 50	/* Completely arbitrary value - KAO */
 	static int kmod_loop_msg;
  
-	ret = security_kernel_module_request();
-	if (ret)
-		return ret;
-
 	va_start(args, fmt);
 	ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
 	va_end(args);
 	if (ret >= MODULE_NAME_LEN)
 		return -ENAMETOOLONG;
+
+	ret = security_kernel_module_request(module_name);
+	if (ret)
+		return ret;
  
 	/* If modprobe needs a service that is in a module, we get a recursive
 	 * loop.  Limit the number of running kmod threads to max_threads/2 or
@@ -421,7 +421,7 @@
 	return 0;
 }
  
-static int cap_kernel_module_request(void)
+static int cap_kernel_module_request(char *kmod_name)
 {
 	return 0;
 }
@@ -354,6 +354,10 @@
 		}
 		break;
 #endif
+	case LSM_AUDIT_DATA_KMOD:
+		audit_log_format(ab, " kmod=");
+		audit_log_untrustedstring(ab, a->u.kmod_name);
+		break;
 	} /* switch (a->type) */
 }
  
@@ -764,9 +764,9 @@
 	return security_ops->kernel_create_files_as(new, inode);
 }
  
-int security_kernel_module_request(void)
+int security_kernel_module_request(char *kmod_name)
 {
-	return security_ops->kernel_module_request();
+	return security_ops->kernel_module_request(kmod_name);
 }
  
 int security_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
@@ -3337,9 +3337,18 @@
 	return 0;
 }
  
-static int selinux_kernel_module_request(void)
+static int selinux_kernel_module_request(char *kmod_name)
 {
-	return task_has_system(current, SYSTEM__MODULE_REQUEST);
+	u32 sid;
+	struct common_audit_data ad;
+
+	sid = task_sid(current);
+
+	COMMON_AUDIT_DATA_INIT(&ad, KMOD);
+	ad.u.kmod_name = kmod_name;
+
+	return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
+			    SYSTEM__MODULE_REQUEST, &ad);
 }
  
 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
...	...	@@ -26,14 +26,15 @@
26	26
27	27	/* Auxiliary data to use in generating the audit record. */
28	28	struct common_audit_data {
29		- char type;
30		-#define LSM_AUDIT_DATA_FS 1
31		-#define LSM_AUDIT_DATA_NET 2
32		-#define LSM_AUDIT_DATA_CAP 3
33		-#define LSM_AUDIT_DATA_IPC 4
34		-#define LSM_AUDIT_DATA_TASK 5
35		-#define LSM_AUDIT_DATA_KEY 6
36		-#define LSM_AUDIT_NO_AUDIT 7
	29	+ char type;
	30	+#define LSM_AUDIT_DATA_FS 1
	31	+#define LSM_AUDIT_DATA_NET 2
	32	+#define LSM_AUDIT_DATA_CAP 3
	33	+#define LSM_AUDIT_DATA_IPC 4
	34	+#define LSM_AUDIT_DATA_TASK 5
	35	+#define LSM_AUDIT_DATA_KEY 6
	36	+#define LSM_AUDIT_NO_AUDIT 7
	37	+#define LSM_AUDIT_DATA_KMOD 8
37	38	struct task_struct *tsk;
38	39	union {
39	40	struct {
...	...	@@ -66,6 +67,7 @@
66	67	char *key_desc;
67	68	} key_struct;
68	69	#endif
	70	+ char *kmod_name;
69	71	} u;
70	72	/* this union contains LSM specific data */
71	73	union {
...	...	@@ -706,6 +706,7 @@
706	706	* @kernel_module_request:
707	707	* Ability to trigger the kernel to automatically upcall to userspace for
708	708	* userspace to load a kernel module with the given name.
	709	+ * @kmod_name name of the module requested by the kernel
709	710	* Return 0 if successful.
710	711	* @task_setuid:
711	712	* Check permission before setting one or more of the user identity
...	...	@@ -1577,7 +1578,7 @@
1577	1578	void (cred_transfer)(struct cred new, const struct cred *old);
1578	1579	int (kernel_act_as)(struct cred new, u32 secid);
1579	1580	int (kernel_create_files_as)(struct cred new, struct inode *inode);
1580		- int (*kernel_module_request)(void);
	1581	+ int (kernel_module_request)(char kmod_name);
1581	1582	int (*task_setuid) (uid_t id0, uid_t id1, uid_t id2, int flags);
1582	1583	int (task_fix_setuid) (struct cred new, const struct cred *old,
1583	1584	int flags);
...	...	@@ -1842,7 +1843,7 @@
1842	1843	void security_transfer_creds(struct cred new, const struct cred old);
1843	1844	int security_kernel_act_as(struct cred *new, u32 secid);
1844	1845	int security_kernel_create_files_as(struct cred new, struct inode inode);
1845		-int security_kernel_module_request(void);
	1846	+int security_kernel_module_request(char *kmod_name);
1846	1847	int security_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags);
1847	1848	int security_task_fix_setuid(struct cred new, const struct cred old,
1848	1849	int flags);
...	...	@@ -2407,7 +2408,7 @@
2407	2408	return 0;
2408	2409	}
2409	2410
2410		-static inline int security_kernel_module_request(void)
	2411	+static inline int security_kernel_module_request(char *kmod_name)
2411	2412	{
2412	2413	return 0;
2413	2414	}
...	...	@@ -80,15 +80,15 @@
80	80	#define MAX_KMOD_CONCURRENT 50 /* Completely arbitrary value - KAO */
81	81	static int kmod_loop_msg;
82	82
83		- ret = security_kernel_module_request();
84		- if (ret)
85		- return ret;
86		-
87	83	va_start(args, fmt);
88	84	ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
89	85	va_end(args);
90	86	if (ret >= MODULE_NAME_LEN)
91	87	return -ENAMETOOLONG;
	88	+
	89	+ ret = security_kernel_module_request(module_name);
	90	+ if (ret)
	91	+ return ret;
92	92
93	93	/* If modprobe needs a service that is in a module, we get a recursive
94	94	* loop. Limit the number of running kmod threads to max_threads/2 or
...	...	@@ -421,7 +421,7 @@
421	421	return 0;
422	422	}
423	423
424		-static int cap_kernel_module_request(void)
	424	+static int cap_kernel_module_request(char *kmod_name)
425	425	{
426	426	return 0;
427	427	}
...	...	@@ -354,6 +354,10 @@
354	354	}
355	355	break;
356	356	#endif
	357	+ case LSM_AUDIT_DATA_KMOD:
	358	+ audit_log_format(ab, " kmod=");
	359	+ audit_log_untrustedstring(ab, a->u.kmod_name);
	360	+ break;
357	361	} /* switch (a->type) */
358	362	}
359	363
...	...	@@ -764,9 +764,9 @@
764	764	return security_ops->kernel_create_files_as(new, inode);
765	765	}
766	766
767		-int security_kernel_module_request(void)
	767	+int security_kernel_module_request(char *kmod_name)
768	768	{
769		- return security_ops->kernel_module_request();
	769	+ return security_ops->kernel_module_request(kmod_name);
770	770	}
771	771
772	772	int security_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
...	...	@@ -3337,9 +3337,18 @@
3337	3337	return 0;
3338	3338	}
3339	3339
3340		-static int selinux_kernel_module_request(void)
	3340	+static int selinux_kernel_module_request(char *kmod_name)
3341	3341	{
3342		- return task_has_system(current, SYSTEM__MODULE_REQUEST);
	3342	+ u32 sid;
	3343	+ struct common_audit_data ad;
	3344	+
	3345	+ sid = task_sid(current);
	3346	+
	3347	+ COMMON_AUDIT_DATA_INIT(&ad, KMOD);
	3348	+ ad.u.kmod_name = kmod_name;
	3349	+
	3350	+ return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
	3351	+ SYSTEM__MODULE_REQUEST, &ad);
3343	3352	}
3344	3353
3345	3354	static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)