--- v33
+++ v27
@@ -28,14 +28,14 @@
.../ABI/testing/procfs-attr-lsm_display | 22 +++
Documentation/security/lsm.rst | 14 ++
fs/proc/base.c | 1 +
- include/linux/security.h | 17 ++
+ include/linux/lsm_hooks.h | 17 ++
security/apparmor/include/apparmor.h | 3 +-
security/apparmor/lsm.c | 32 ++++
security/security.c | 166 ++++++++++++++++--
security/selinux/hooks.c | 11 ++
- security/selinux/include/classmap.h | 3 +-
+ security/selinux/include/classmap.h | 2 +-
security/smack/smack_lsm.c | 7 +
- 10 files changed, 257 insertions(+), 19 deletions(-)
+ 10 files changed, 256 insertions(+), 19 deletions(-)
create mode 100644 Documentation/ABI/testing/procfs-attr-lsm_display
diff --git a/Documentation/ABI/testing/procfs-attr-lsm_display b/Documentation/ABI/testing/procfs-attr-lsm_display
@@ -89,10 +89,10 @@
+module for which the ``/proc/pid/attr/current`` interface will
+apply. This interface can be written to.
diff --git a/fs/proc/base.c b/fs/proc/base.c
-index d654ce7150fd..e0d41adb38ba 100644
+index 3851bfcdba56..10de522f3112 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
-@@ -2828,6 +2828,7 @@ static const struct pid_entry attr_dir_stuff[] = {
+@@ -2807,6 +2807,7 @@ static const struct pid_entry attr_dir_stuff[] = {
ATTR(NULL, "fscreate", 0666),
ATTR(NULL, "keycreate", 0666),
ATTR(NULL, "sockcreate", 0666),
@@ -100,13 +100,13 @@
#ifdef CONFIG_SECURITY_SMACK
DIR("smack", 0555,
proc_smack_attr_dir_inode_ops, proc_smack_attr_dir_ops),
-diff --git a/include/linux/security.h b/include/linux/security.h
-index 955f75fc1007..9753bd9b4fdc 100644
---- a/include/linux/security.h
-+++ b/include/linux/security.h
-@@ -220,6 +220,23 @@ static inline u32 lsmblob_value(const struct lsmblob *blob)
- return 0;
- }
+diff --git a/include/linux/lsm_hooks.h b/include/linux/lsm_hooks.h
+index c61a16f0a5bc..d2c4bc94d47f 100644
+--- a/include/linux/lsm_hooks.h
++++ b/include/linux/lsm_hooks.h
+@@ -1686,4 +1686,21 @@ static inline void security_delete_hooks(struct security_hook_list *hooks,
+
+ extern int lsm_inode_alloc(struct inode *inode);
+/**
+ * lsm_task_ilsm - the "interface_lsm" for this task
@@ -125,9 +125,7 @@
+ return LSMBLOB_INVALID;
+}
+
- /* These functions are in security/commoncap.c */
- extern int cap_capable(const struct cred *cred, struct user_namespace *ns,
- int cap, unsigned int opts);
+ #endif /* ! __LINUX_LSM_HOOKS_H */
diff --git a/security/apparmor/include/apparmor.h b/security/apparmor/include/apparmor.h
index 1fbabdb565a8..b1622fcb4394 100644
--- a/security/apparmor/include/apparmor.h
@@ -144,7 +142,7 @@
/* Control parameters settable through module/boot flags */
extern enum audit_mode aa_g_audit;
diff --git a/security/apparmor/lsm.c b/security/apparmor/lsm.c
-index 1e53fea61335..29181bc8c693 100644
+index 392e25940d1f..4237536106aa 100644
--- a/security/apparmor/lsm.c
+++ b/security/apparmor/lsm.c
@@ -621,6 +621,25 @@ static int apparmor_getprocattr(struct task_struct *task, char *name,
@@ -194,10 +192,10 @@
if (args[size - 1] != '\0') {
/* null terminate */
diff --git a/security/security.c b/security/security.c
-index 27154c39d109..0bca482166d8 100644
+index c2a5c50e913b..fe18c8d8bc22 100644
--- a/security/security.c
+++ b/security/security.c
-@@ -78,7 +78,16 @@ static struct kmem_cache *lsm_file_cache;
+@@ -77,7 +77,16 @@ static struct kmem_cache *lsm_file_cache;
static struct kmem_cache *lsm_inode_cache;
char *lsm_names;
@@ -215,7 +213,7 @@
/* Boot-time LSM user choice */
static __initdata const char *chosen_lsm_order;
-@@ -672,6 +681,8 @@ int lsm_inode_alloc(struct inode *inode)
+@@ -671,6 +680,8 @@ int lsm_inode_alloc(struct inode *inode)
*/
static int lsm_task_alloc(struct task_struct *task)
{
@@ -224,7 +222,7 @@
if (blob_sizes.lbs_task == 0) {
task->security = NULL;
return 0;
-@@ -680,6 +691,15 @@ static int lsm_task_alloc(struct task_struct *task)
+@@ -679,6 +690,15 @@ static int lsm_task_alloc(struct task_struct *task)
task->security = kzalloc(blob_sizes.lbs_task, GFP_KERNEL);
if (task->security == NULL)
return -ENOMEM;
@@ -240,7 +238,7 @@
return 0;
}
-@@ -1739,14 +1759,26 @@ int security_file_open(struct file *file)
+@@ -1734,14 +1754,26 @@ int security_file_open(struct file *file)
int security_task_alloc(struct task_struct *task, unsigned long clone_flags)
{
@@ -270,7 +268,7 @@
}
void security_task_free(struct task_struct *task)
-@@ -2178,23 +2210,110 @@ int security_getprocattr(struct task_struct *p, const char *lsm, char *name,
+@@ -2173,23 +2205,110 @@ int security_getprocattr(struct task_struct *p, const char *lsm, char *name,
char **value)
{
struct security_hook_list *hp;
@@ -381,7 +379,7 @@
return hp->hook.setprocattr(name, value, size);
}
return LSM_RET_DEFAULT(setprocattr);
-@@ -2214,15 +2333,15 @@ EXPORT_SYMBOL(security_ismaclabel);
+@@ -2209,15 +2328,15 @@ EXPORT_SYMBOL(security_ismaclabel);
int security_secid_to_secctx(struct lsmblob *blob, char **secdata, u32 *seclen)
{
struct security_hook_list *hp;
@@ -402,7 +400,7 @@
}
return LSM_RET_DEFAULT(secid_to_secctx);
-@@ -2233,16 +2352,15 @@ int security_secctx_to_secid(const char *secdata, u32 seclen,
+@@ -2228,16 +2347,15 @@ int security_secctx_to_secid(const char *secdata, u32 seclen,
struct lsmblob *blob)
{
struct security_hook_list *hp;
@@ -423,7 +421,7 @@
}
return 0;
}
-@@ -2250,7 +2368,14 @@ EXPORT_SYMBOL(security_secctx_to_secid);
+@@ -2245,7 +2363,14 @@ EXPORT_SYMBOL(security_secctx_to_secid);
void security_release_secctx(char *secdata, u32 seclen)
{
@@ -439,7 +437,7 @@
}
EXPORT_SYMBOL(security_release_secctx);
-@@ -2391,8 +2516,15 @@ EXPORT_SYMBOL(security_sock_rcv_skb);
+@@ -2386,8 +2511,15 @@ EXPORT_SYMBOL(security_sock_rcv_skb);
int security_socket_getpeersec_stream(struct socket *sock, char __user *optval,
int __user *optlen, unsigned len)
{
@@ -458,10 +456,10 @@
int security_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb,
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
-index d67bcd1aeaf5..3469ffe195e6 100644
+index 0133b142e938..dba867721336 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
-@@ -6405,6 +6405,17 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
+@@ -6510,6 +6510,17 @@ static int selinux_setprocattr(const char *name, void *value, size_t size)
/*
* Basic control over ability to set these attributes at all.
*/
@@ -474,30 +472,29 @@
+ if (!strcmp(name, "interface_lsm"))
+ return avc_has_perm(&selinux_state,
+ mysid, mysid, SECCLASS_PROCESS2,
-+ PROCESS2__SETINTERFACE_LSM, NULL);
++ PROCESS2__SETDISPLAY, NULL);
+
if (!strcmp(name, "exec"))
error = avc_has_perm(&selinux_state,
mysid, mysid, SECCLASS_PROCESS,
diff --git a/security/selinux/include/classmap.h b/security/selinux/include/classmap.h
-index 35aac62a662e..79b480983bdc 100644
+index 62d19bccf3de..8f4b0dd6dd78 100644
--- a/security/selinux/include/classmap.h
+++ b/security/selinux/include/classmap.h
-@@ -53,7 +53,8 @@ struct security_class_mapping secclass_map[] = {
+@@ -53,7 +53,7 @@ struct security_class_mapping secclass_map[] = {
"execmem", "execstack", "execheap", "setkeycreate",
"setsockcreate", "getrlimit", NULL } },
{ "process2",
- { "nnp_transition", "nosuid_transition", NULL } },
-+ { "nnp_transition", "nosuid_transition", "setinterface_lsm",
-+ NULL } },
++ { "nnp_transition", "nosuid_transition", "setdisplay", NULL } },
{ "system",
{ "ipc_info", "syslog_read", "syslog_mod",
"syslog_console", "module_request", "module_load", NULL } },
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
-index ff832d47479f..3c1cf65cac87 100644
+index 5c10ad27be37..7aa7ea38f627 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
-@@ -3516,6 +3516,13 @@ static int smack_setprocattr(const char *name, void *value, size_t size)
+@@ -3508,6 +3508,13 @@ static int smack_setprocattr(const char *name, void *value, size_t size)
struct smack_known_list_elem *sklep;
int rc;
@@ -512,5 +509,5 @@
return -EPERM;
--
-2.31.1
+2.29.2