linux-kernel - [PATCH 1/2] Security: hooks for seccomp as extended attribute

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <50D231EC.2000804@gmail.com>
Date:	Thu, 20 Dec 2012 08:30:20 +1100
From:	Michael Cassaniti <m.cassaniti@...il.com>
To:	Linux Security Module mailing list 
	<linux-security-module@...r.kernel.org>,
	linux-kernel@...r.kernel.org
Subject: [PATCH 1/2] Security: hooks for seccomp as extended attribute

 From Michael Cassaniti <m.cassaniti@...il.com>

Superficial patch showing hooks for seccomp extended attribute filter code
Written against Linux 3.5

Signed-off-by: Michael Cassaniti <m.cassaniti@...il.com>
---

diff -uprN -X linux-3.5-rp1/Documentation/dontdiff linux-3.5/fs/exec.c 
linux-3.5-rp1/fs/exec.c
--- linux-3.5/fs/exec.c    2012-07-22 06:58:29.000000000 +1000
+++ linux-3.5-rp1/fs/exec.c    2012-09-13 12:27:14.966076904 +1000
@@ -1537,6 +1537,10 @@ static int do_execve_common(const char *
      if (retval < 0)
          goto out;

+    retval = security_seccomp_from_vfs(bprm);
+    if (retval < 0)
+        goto out;
+
      retval = copy_strings_kernel(1, &bprm->filename, bprm);
      if (retval < 0)
          goto out;
diff -uprN -X linux-3.5-rp1/Documentation/dontdiff 
linux-3.5/include/linux/seccomp.h linux-3.5-rp1/include/linux/seccomp.h
--- linux-3.5/include/linux/seccomp.h    2012-07-22 06:58:29.000000000 
+1000
+++ linux-3.5-rp1/include/linux/seccomp.h    2012-09-21 
12:43:28.215772113 +1000
@@ -119,6 +119,14 @@ static inline int seccomp_mode(struct se
  extern void put_seccomp_filter(struct task_struct *tsk);
  extern void get_seccomp_filter(struct task_struct *tsk);
  extern u32 seccomp_bpf_load(int off);
+
+#define SECCOMP_XATTR_NAME "security.seccomp"
+#define SECCOMP_XATTR_LEN        128
+#define SECCOMP_XATTR_BIT_EN        0
+#define SECCOMP_XATTR_BIT_DEF_ACTION    1
+#define SECCOMP_XATTR_BIT_DEF_RETURN    2
+#define SECCOMP_XATTR_BITMAP_START    3
+
  #else  /* CONFIG_SECCOMP_FILTER */
  static inline void put_seccomp_filter(struct task_struct *tsk)
  {
diff -uprN -X linux-3.5-rp1/Documentation/dontdiff 
linux-3.5/include/linux/security.h linux-3.5-rp1/include/linux/security.h
--- linux-3.5/include/linux/security.h    2012-07-22 06:58:29.000000000 
+1000
+++ linux-3.5-rp1/include/linux/security.h    2012-09-21 
12:00:24.026007169 +1000
@@ -3023,5 +3023,23 @@ static inline void free_secdata(void *se
  { }
  #endif /* CONFIG_SECURITY */

+#ifdef CONFIG_SECCOMP_FILTER
+
+extern int append_seccomp_from_vfs(struct linux_binprm *bprm);
+
+static inline int security_seccomp_from_vfs(struct linux_binprm *bprm)
+{
+    return append_seccomp_from_vfs(bprm);
+}
+
+#else
+
+static inline int security_seccomp_from_vfs(struct linux_binprm *bprm)
+{
+    return 0;
+}
+
+#endif /* CONFIG_SECCOMP_FILTER */
+
  #endif /* ! __LINUX_SECURITY_H */

diff -uprN -X linux-3.5-rp1/Documentation/dontdiff 
linux-3.5/kernel/seccomp.c linux-3.5-rp1/kernel/seccomp.c
--- linux-3.5/kernel/seccomp.c    2012-07-22 06:58:29.000000000 +1000
+++ linux-3.5-rp1/kernel/seccomp.c    2012-09-21 13:23:52.254969072 +1000
@@ -502,3 +502,9 @@ long prctl_set_seccomp(unsigned long sec
  out:
      return ret;
  }
+
+int append_seccomp_from_vfs(struct linux_binprm *bprm)
+{
+    pr_debug("Entered stub %s\n", __func__);
+    return 0;
+}

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/