| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20241101-lsm-secctx-v1@google.com>
Date: Fri, 1 Nov 2024 17:48:55 +0000
From: Alice Ryhl <aliceryhl@...gle.com>
To: paul@...l-moore.com, ojeda@...nel.org, brauner@...nel.org
Cc: anders.roxell@...aro.org, arnd@...db.de, dan.carpenter@...aro.org,
kees@...nel.org, naresh.kamboju@...aro.org, casey@...aufler-ca.com,
linux-kernel@...r.kernel.org, lkft-triage@...ts.linaro.org,
regressions@...ts.linux.dev, rust-for-linux@...r.kernel.org,
linux-security-module@...r.kernel.org, lkft@...aro.org,
benno.lossin@...ton.me, yakoyoku@...il.com, tmgross@...ch.edu,
gary@...yguo.net, aliceryhl@...gle.com
Subject: [PATCH] rust: security: add abstraction for secctx
Add an abstraction for viewing the string representation of a security
context.
This is needed by Rust Binder because it has a feature where a process
can view the string representation of the security context for incoming
transactions. The process can use that to authenticate incoming
transactions, and since the feature is provided by the kernel, the
process can trust that the security context is legitimate.
This abstraction makes the following assumptions about the C side:
* When a call to `security_secid_to_secctx` is successful, it returns an
lsm context containing a pointer and length. The pointer references a
byte string and is valid for reading for that many bytes.
* The string may be referenced until `security_release_secctx` is
called.
* If CONFIG_SECURITY is set, then the three methods mentioned in
rust/helpers are available without a helper. (That is, they are not a
#define or `static inline`.)
This patch had to be modified after its first landing due to some
conflicts with other changes. Please see [1] for details.
Reviewed-by: Benno Lossin <benno.lossin@...ton.me>
Reviewed-by: Martin Rodriguez Reboredo <yakoyoku@...il.com>
Reviewed-by: Trevor Gross <tmgross@...ch.edu>
Reviewed-by: Gary Guo <gary@...yguo.net>
Reviewed-by: Kees Cook <kees@...nel.org>
Link: https://lore.kernel.org/r/20241101095620.2526421-1-aliceryhl@google.com [1]
Signed-off-by: Alice Ryhl <aliceryhl@...gle.com>
---
rust/bindings/bindings_helper.h | 1 +
rust/helpers/helpers.c | 1 +
rust/helpers/security.c | 15 +++++++
rust/kernel/lib.rs | 1 +
rust/kernel/security.rs | 70 +++++++++++++++++++++++++++++++++
5 files changed, 88 insertions(+)
create mode 100644 rust/helpers/security.c
create mode 100644 rust/kernel/security.rs
diff --git a/rust/bindings/bindings_helper.h b/rust/bindings/bindings_helper.h
index ae82e9c941af..3f3c39f9a83b 100644
--- a/rust/bindings/bindings_helper.h
+++ b/rust/bindings/bindings_helper.h
@@ -18,6 +18,7 @@
#include <linux/phy.h>
#include <linux/refcount.h>
#include <linux/sched.h>
+#include <linux/security.h>
#include <linux/slab.h>
#include <linux/wait.h>
#include <linux/workqueue.h>
diff --git a/rust/helpers/helpers.c b/rust/helpers/helpers.c
index 30f40149f3a9..36a0c833e7b4 100644
--- a/rust/helpers/helpers.c
+++ b/rust/helpers/helpers.c
@@ -17,6 +17,7 @@
#include "page.c"
#include "rbtree.c"
#include "refcount.c"
+#include "security.c"
#include "signal.c"
#include "slab.c"
#include "spinlock.c"
diff --git a/rust/helpers/security.c b/rust/helpers/security.c
new file mode 100644
index 000000000000..f6deb0b28b48
--- /dev/null
+++ b/rust/helpers/security.c
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/security.h>
+
+#ifndef CONFIG_SECURITY
+int rust_helper_security_secid_to_secctx(u32 secid, struct lsm_context *cp)
+{
+ return security_secid_to_secctx(secid, cp);
+}
+
+void rust_helper_security_release_secctx(struct lsm_context *cp)
+{
+ security_release_secctx(cp);
+}
+#endif
diff --git a/rust/kernel/lib.rs b/rust/kernel/lib.rs
index 22a3bfa5a9e9..a71dc73a0d9d 100644
--- a/rust/kernel/lib.rs
+++ b/rust/kernel/lib.rs
@@ -46,6 +46,7 @@
pub mod print;
pub mod sizes;
pub mod rbtree;
+pub mod security;
mod static_assert;
#[doc(hidden)]
pub mod std_vendor;
diff --git a/rust/kernel/security.rs b/rust/kernel/security.rs
new file mode 100644
index 000000000000..25d2b1ac3833
--- /dev/null
+++ b/rust/kernel/security.rs
@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: GPL-2.0
+
+// Copyright (C) 2024 Google LLC.
+
+//! Linux Security Modules (LSM).
+//!
+//! C header: [`include/linux/security.h`](srctree/include/linux/security.h).
+
+use crate::{
+ bindings,
+ error::{to_result, Result},
+};
+
+/// A security context string.
+///
+/// # Invariants
+///
+/// The `ctx` field corresponds to a valid security context as returned by a successful call to
+/// `security_secid_to_secctx`, that has not yet been destroyed by `security_release_secctx`.
+pub struct SecurityCtx {
+ ctx: bindings::lsm_context,
+}
+
+impl SecurityCtx {
+ /// Get the security context given its id.
+ pub fn from_secid(secid: u32) -> Result<Self> {
+ // SAFETY: `struct lsm_context` can be initialized to all zeros.
+ let mut ctx: bindings::lsm_context = unsafe { core::mem::zeroed() };
+
+ // SAFETY: Just a C FFI call. The pointer is valid for writes.
+ to_result(unsafe { bindings::security_secid_to_secctx(secid, &mut ctx) })?;
+
+ // INVARIANT: If the above call did not fail, then we have a valid security context.
+ Ok(Self { ctx })
+ }
+
+ /// Returns whether the security context is empty.
+ pub fn is_empty(&self) -> bool {
+ self.ctx.len == 0
+ }
+
+ /// Returns the length of this security context.
+ pub fn len(&self) -> usize {
+ self.ctx.len as usize
+ }
+
+ /// Returns the bytes for this security context.
+ pub fn as_bytes(&self) -> &[u8] {
+ let ptr = self.ctx.context;
+ if ptr.is_null() {
+ debug_assert_eq!(self.len(), 0);
+ // We can't pass a null pointer to `slice::from_raw_parts` even if the length is zero.
+ return &[];
+ }
+
+ // SAFETY: The call to `security_secid_to_secctx` guarantees that the pointer is valid for
+ // `self.len()` bytes. Furthermore, if the length is zero, then we have ensured that the
+ // pointer is not null.
+ unsafe { core::slice::from_raw_parts(ptr.cast(), self.len()) }
+ }
+}
+
+impl Drop for SecurityCtx {
+ fn drop(&mut self) {
+ // SAFETY: By the invariant of `Self`, this frees a context that came from a successful
+ // call to `security_secid_to_secctx` and has not yet been destroyed by
+ // `security_release_secctx`.
+ unsafe { bindings::security_release_secctx(&mut self.ctx) };
+ }
+}
base-commit: 1008010aafe7b1e06974b8b1bf29b052fcf87f92
--
2.47.0.199.ga7371fff76-goog
Powered by blists - more mailing lists