diff options
| author | Matthew Garrett <[email protected]> | 2018-01-08 21:36:19 +0000 |
|---|---|---|
| committer | Mimi Zohar <[email protected]> | 2018-03-23 10:31:11 +0000 |
| commit | 3ec30113264a7bcd389f51d1738e42da0f41bb5a (patch) | |
| tree | 75a1465c8f53522dafcf2d41085c925cb025e29f /security/selinux/hooks.c | |
| parent | Merge tag 'v4.16-rc6' into next-general (diff) | |
| download | kernel-3ec30113264a7bcd389f51d1738e42da0f41bb5a.tar.gz kernel-3ec30113264a7bcd389f51d1738e42da0f41bb5a.zip | |
security: Add a cred_getsecid hook
For IMA purposes, we want to be able to obtain the prepared secid in the
bprm structure before the credentials are committed. Add a cred_getsecid
hook that makes this possible.
Signed-off-by: Matthew Garrett <[email protected]>
Acked-by: Paul Moore <[email protected]>
Cc: Paul Moore <[email protected]>
Cc: Stephen Smalley <[email protected]>
Cc: Casey Schaufler <[email protected]>
Signed-off-by: Mimi Zohar <[email protected]>
Diffstat (limited to 'security/selinux/hooks.c')
| -rw-r--r-- | security/selinux/hooks.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c index 8abd542c6b7c..b7d4473edbde 100644 --- a/security/selinux/hooks.c +++ b/security/selinux/hooks.c @@ -3844,6 +3844,11 @@ static void selinux_cred_transfer(struct cred *new, const struct cred *old) *tsec = *old_tsec; } +static void selinux_cred_getsecid(const struct cred *c, u32 *secid) +{ + *secid = cred_sid(c); +} + /* * set the security data for a kernel service * - all the creation contexts are set to unlabelled @@ -6482,6 +6487,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { LSM_HOOK_INIT(cred_free, selinux_cred_free), LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare), LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer), + LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid), LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as), LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as), LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request), |