Thread (42 messages) 42 messages, 4 authors, 2022-06-23

[PATCH v36 01/33] integrity: disassociate ima_filter_rule from security_audit_rule

STALE1562d REVIEWED: 6 (6M)

From: Casey Schaufler <casey@schaufler-ca.com>
Date: 2022-06-09 23:02:06
Also in: linux-integrity, lkml, selinux
Subsystem: extended verification module (evm), integrity measurement architecture (ima), security subsystem, the rest · Maintainers: Mimi Zohar, Roberto Sassu, Dmitry Kasatkin, Paul Moore, James Morris, "Serge E. Hallyn", Linus Torvalds

Revision v36 of 55 in this series; 2 review trailers (1 from subsystem maintainers).

Revisions (55)
  1. v1 [diff vs current]
  2. v1 [diff vs current]
  3. v1 [diff vs current]
  4. v1 [diff vs current]
  5. v1 [diff vs current]
  6. v1 [diff vs current]
  7. v2 [diff vs current]
  8. v3 [diff vs current]
  9. v3 [diff vs current]
  10. v4 [diff vs current]
  11. v5 [diff vs current]
  12. v7 [diff vs current]
  13. v10 [diff vs current]
  14. v10 [diff vs current]
  15. v10 [diff vs current]
  16. v11 [diff vs current]
  17. v11 [diff vs current]
  18. v11 [diff vs current]
  19. v11 [diff vs current]
  20. v11 [diff vs current]
  21. v12 [diff vs current]
  22. v12 [diff vs current]
  23. v12 [diff vs current]
  24. v12 [diff vs current]
  25. v13 [diff vs current]
  26. v14 [diff vs current]
  27. v15 [diff vs current]
  28. v15 [diff vs current]
  29. v15 [diff vs current]
  30. v15 [diff vs current]
  31. v17 [diff vs current]
  32. v18 [diff vs current]
  33. v19 [diff vs current]
  34. v20 [diff vs current]
  35. v21 [diff vs current]
  36. v22 [diff vs current]
  37. v22 [diff vs current]
  38. v22 [diff vs current]
  39. v24 [diff vs current]
  40. v25 [diff vs current]
  41. v26 [diff vs current]
  42. v27 [diff vs current]
  43. v28 [diff vs current]
  44. v28 [diff vs current]
  45. v29 [diff vs current]
  46. v30 [diff vs current]
  47. v31 [diff vs current]
  48. v32 [diff vs current]
  49. v33 [diff vs current]
  50. v34 [diff vs current]
  51. v34 [diff vs current]
  52. v35 [diff vs current]
  53. v36 current
  54. v37 [diff vs current]
  55. v38 [diff vs current] 
Create real functions for the ima_filter_rule interfaces.
These replace #defines that obscure the reuse of audit
interfaces. The new functions are put in security.c because
they use security module registered hooks that we don't
want exported.

Acked-by: Paul Moore <paul@paul-moore.com>
Reviewed-by: John Johansen <john.johansen@canonical.com>
Signed-off-by: Casey Schaufler <casey@schaufler-ca.com>
To: Mimi Zohar <zohar@linux.ibm.com>
Cc: linux-integrity@vger.kernel.org
---
 include/linux/security.h     | 24 ++++++++++++++++++++++++
 security/integrity/ima/ima.h | 26 --------------------------
 security/security.c          | 21 +++++++++++++++++++++
 3 files changed, 45 insertions(+), 26 deletions(-)

diff --git a/include/linux/security.h b/include/linux/security.h
index 7fc4e9f49f54..5260dbe9ef0d 100644
--- a/include/linux/security.h
+++ b/include/linux/security.h
@@ -1919,6 +1919,30 @@ static inline void security_audit_rule_free(void *lsmrule)
 #endif /* CONFIG_SECURITY */
 #endif /* CONFIG_AUDIT */
 
+#if defined(CONFIG_IMA_LSM_RULES) && defined(CONFIG_SECURITY)
+int ima_filter_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule);
+int ima_filter_rule_match(u32 secid, u32 field, u32 op, void *lsmrule);
+void ima_filter_rule_free(void *lsmrule);
+
+#else
+
+static inline int ima_filter_rule_init(u32 field, u32 op, char *rulestr,
+					   void **lsmrule)
+{
+	return 0;
+}
+
+static inline int ima_filter_rule_match(u32 secid, u32 field, u32 op,
+					    void *lsmrule)
+{
+	return 0;
+}
+
+static inline void ima_filter_rule_free(void *lsmrule)
+{ }
+
+#endif /* defined(CONFIG_IMA_LSM_RULES) && defined(CONFIG_SECURITY) */
+
 #ifdef CONFIG_SECURITYFS
 
 extern struct dentry *securityfs_create_file(const char *name, umode_t mode,
diff --git a/security/integrity/ima/ima.h b/security/integrity/ima/ima.h
index be965a8715e4..1b5d70ac2dc9 100644
--- a/security/integrity/ima/ima.h
+++ b/security/integrity/ima/ima.h
@@ -418,32 +418,6 @@ static inline void ima_free_modsig(struct modsig *modsig)
 }
 #endif /* CONFIG_IMA_APPRAISE_MODSIG */
 
-/* LSM based policy rules require audit */
-#ifdef CONFIG_IMA_LSM_RULES
-
-#define ima_filter_rule_init security_audit_rule_init
-#define ima_filter_rule_free security_audit_rule_free
-#define ima_filter_rule_match security_audit_rule_match
-
-#else
-
-static inline int ima_filter_rule_init(u32 field, u32 op, char *rulestr,
-				       void **lsmrule)
-{
-	return -EINVAL;
-}
-
-static inline void ima_filter_rule_free(void *lsmrule)
-{
-}
-
-static inline int ima_filter_rule_match(u32 secid, u32 field, u32 op,
-					void *lsmrule)
-{
-	return -EINVAL;
-}
-#endif /* CONFIG_IMA_LSM_RULES */
-
 #ifdef	CONFIG_IMA_READ_POLICY
 #define	POLICY_FILE_FLAGS	(S_IWUSR | S_IRUSR)
 #else
diff --git a/security/security.c b/security/security.c
index 188b8f782220..8b176769dd86 100644
--- a/security/security.c
+++ b/security/security.c
@@ -2580,6 +2580,27 @@ int security_audit_rule_match(u32 secid, u32 field, u32 op, void *lsmrule)
 }
 #endif /* CONFIG_AUDIT */
 
+#ifdef CONFIG_IMA_LSM_RULES
+/*
+ * The integrity subsystem uses the same hooks as
+ * the audit subsystem.
+ */
+int ima_filter_rule_init(u32 field, u32 op, char *rulestr, void **lsmrule)
+{
+	return call_int_hook(audit_rule_init, 0, field, op, rulestr, lsmrule);
+}
+
+void ima_filter_rule_free(void *lsmrule)
+{
+	call_void_hook(audit_rule_free, lsmrule);
+}
+
+int ima_filter_rule_match(u32 secid, u32 field, u32 op, void *lsmrule)
+{
+	return call_int_hook(audit_rule_match, 0, secid, field, op, lsmrule);
+}
+#endif /* CONFIG_IMA_LSM_RULES */
+
 #ifdef CONFIG_BPF_SYSCALL
 int security_bpf(int cmd, union bpf_attr *attr, unsigned int size)
 {
-- 
2.35.1
Other recent patches touching these files
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help